Suppliers, People, Measuring Equipment: clauses 7 and 8.4 without a paper war

16 modules · about 88 minutes · final test with 38 questions, 31 correct to pass · certificate of participation as PDF

What this course is about

Every order needs three things before it starts: material from suppliers, people who can do it, and tools that are right. ISO 9001 regulates this in clause 7 (resources, competence, awareness, knowledge) and 8.4 (externally provided processes, products and services) – and it is exactly in these clauses that most minor nonconformities in small companies lie: suppliers never evaluated, briefing only verbal, calliper never checked, maintenance without a plan.

No registration needed. We only ask for your name and e-mail address before the final test – just for your certificate. Your progress is saved in this browser. You can stop at any time and continue later.

Module 1 of 16

Four lists for clauses 7 and 8.4 — and why most minor nonconformities lie here

In small companies most minor nonconformities do not arise in value creation — there people work, check, deliver — but in the surroundings: the supplier who was never evaluated, the employee whose briefing nobody wrote down, the calliper without inspection date, the machine without maintenance plan. Not because it is not done — but because the record is missing. Clauses 7 and 8.4 require it at four places, and for each one list is enough:

Add three things without a list of their own: awareness (7.3) — one line in the meeting minutes; organisational knowledge (7.1.6) — one paragraph in the manual and a place where it lies; communication (7.4) — the meeting routine. And for outsourced processes (8.4.2) one line in the supplier list.

Effort: set-up in one afternoon per list; maintenance two to three hours a year plus briefing per new employee. The four lists hang on the order file from the course “The Order from Enquiry to Invoice”: tab 4 (purchase orders) points to the supplier list, tab 5 to the qualification matrix, tab 6 to the measuring equipment list.

📄 The four lists: clause, mandatory content, maintenance effort, auditor's question (German – English version to follow)

The auditor's method is the same for all four: he goes to a workplace, takes a part, a person, a measuring instrument, a machine — and asks for the list. If list and reality match, the clause is passed. That is why every list starts with reality, not with the template.

Module 2 of 16

Supplier list: who is evaluated, who is not — and by which criteria

Clause 8.4.1 requires the company to determine and apply criteria for the selection, evaluation, performance monitoring and re-evaluation of external providers — and to retain documented information on it. That sounds like supplier audit and scorecard; in a small company it is a table with one row per main supplier and three grades.

Who is evaluated: only suppliers whose products or services influence your output — typically five to fifteen. The classification:

The three criteria — proven because everyone understands them without explanation:

Grade scale (1 very good to 6 unsatisfactory, as in many school systems), default value at first status 2, not applicable = X. From grade 4 an action is initiated (talk), from grade 5 alternatives are sought — that stands as a footnote under the table and is at the same time the rule for re-evaluation.

New supplier: entry in the list with class, reason for selection (recommendation, sample checked, certificate, price) and initials of the MD. That is the evidence of selection by criteria. Certificates (ISO 9001) of the supplier are filed but do not replace the evaluation.

📄 Supplier list with class, evaluation on a grade scale, action column and year-on-year comparison (Excel) (German – English version to follow)

What auditors ask: “Show me your most important supplier: why do you buy there, and what happens if he fails tomorrow?” — row in the list (class A, grades, reason), and for single suppliers a reference to the risk and opportunity analysis (second supplier or deliberate risk).

Module 3 of 16

The annual evaluation in one hour — and what follows from it

The evaluation takes place once a year — before the management review, in which it appears as an input under 9.3.2 c 7 (performance of external providers). One hour for ten suppliers if three sources are available:

1. Goods receipt: complaints per supplier (delivery notes with note, module 4).
2. Nonconformity sheets / complaints with origin “supplier”.
3. Deadlines: late deliveries from order files or purchasing system.

Example — specialist retailer with six A suppliers:

The columns action, responsible/deadline and status/result turn the evaluation into a small action plan; actions with a deadline are additionally transferred to the action plan (one-plan rule).

Re-evaluation: after completion of an action (talk, trial delivery) or in the next year. A supplier with grade 5 without action for two years is a nonconformity — not the grade, but the missing reaction.

Supplier talk: ten minutes on the phone with three points: what happened, what we expect, by when. Note in the column status/result. That is 8.4.3 (information for external providers) in practice.

Year-on-year comparison: the template keeps the grades of previous years in columns next to it — that way the management review sees trends, and the auditor sees that evaluation takes place, not just filling in.

Module 4 of 16

Goods receipt: the inspection everyone does and nobody writes down

Every company checks its goods receipt — the warehouse worker counts, the fitter looks, the technician unpacks. The standard requires this verification to be planned (8.4.2: type and extent of control according to the impact on the output) and that before use it is ensured that the product meets the requirements. The evidence: a note on the delivery note. Date, initials, OK or complaint. No form.

Extent by risk — defined in the supplier list (column “goods receipt inspection”) or in process S2:

Batches and serial numbers are recorded at inspection levels 2 to 4 (on the delivery note or in the order file) — that is traceability under 8.5.2 where it is required.

Complaint: note on the delivery note, photo, e-mail to the supplier, block the goods (8.7), entry in the nonconformity sheet with origin “supplier” → flows into the annual evaluation. The audit question “Let's take your last goods receipt with defects: what did you check, how did the complaint go to the supplier, and where is that written?” is answered with three documents.

Drop shipping (goods go directly from the supplier to the customer): the company never had the goods in hand — nevertheless they are its output. Control then via: supplier with class A and certificate, copy of the delivery note with recipient confirmation, enquiry with the customer after receipt, complaint route agreed. That is in S2 as a paragraph of its own.

Service providers: goods receipt exists here too — hardware at the IT company, cleaning agents at the building service, the customer's documents at the consultant (completeness check). The same note, the same rule.

📄 Goods receipt: four inspection levels, assignment per supplier class, note stamp, drop shipping (German – English version to follow)

Module 5 of 16

Outsourced processes: contract manufacturer, subcontractor, data centre, haulier

An outsourced process is a part of your output that someone else provides for you — and the customer sees only you. The standard says clearly: the responsibility stays with you (8.4.2: “ensure that externally provided processes remain within the control of its quality management system”). The only question is how you control — and that depends on the risk.

Three rules:

1. Entry in the supplier list with class A and note “outsourced process” — and in the process map as a note (“S1 Purchasing: contract manufacturing of cutting outsourced to …”).
2. Information for the provider (8.4.3): what you expect is in the purchase order or contract — specification, release, qualification of the persons, records, access to his premises if you want to check.
3. The result is verified like your own work: goods receipt, acceptance of the partial service, site check. A certificate of the provider does not replace the verification; it only reduces its extent.

The audit finding that threatens here: “The company has not recognised contract manufacturing as an outsourced process; no determination of control.” Avoidable with one line in the supplier list and one paragraph in S1.

Staffing agencies and freelancers are externally provided persons: the company must ensure their competence just as for its own (7.2) — briefing, records in the qualification matrix with note “external”.

Module 6 of 16

Determining competence: the qualification matrix (7.2)

Clause 7.2 is short and is almost always checked: the organisation must determine the necessary competence, ensure that the persons have it, take actions (training, briefing, reassignment), evaluate their effectiveness and retain documented information as evidence. The one document that shows all four points is the qualification matrix: tasks in the rows, persons in the columns, in the cells a level.

Levels: 1 = being briefed · 2 = independent · 3 = may brief and check · – = not intended. Mandatory: per task at least two persons with level 2 (deputy) — where that is not possible, it is in the risk analysis.

Column evidence names what substantiates the entry: briefing record, certificate, licence with expiry date, diploma. For expiry dates (forklift, first aider, welder, driving licence, electrical briefing, working at height) the date is entered — the matrix thus becomes the due-date list at the same time.

Determining competence means: the rows of the matrix are the tasks from the process descriptions (V1 step 7 “Check and release” is one row) plus the statutory mandatory qualifications from the list of standards and laws. A company of up to 50 employees rarely has more than 15 to 20 rows.

📄 Qualification matrix (Excel): tasks × persons, levels 1–3, evidence, expiry date with due-date colour (German – English version to follow)

What the auditor does: he stands at the inspection station, asks “Who may release here?”, takes the name, goes to the matrix (level 3?) and to the evidence (briefing record available?). Three steps, three minutes. If one does not match, it is the most frequent minor nonconformity of small companies: 7.2.

External persons (temporary workers, freelancers, casual staff) are in the matrix with note “external” — their competence is your responsibility as long as they work for you.

Module 7 of 16

Briefing, training plan and effectiveness — the record most often missing

The number one minor nonconformity in small companies is not “no briefing” but “briefing not demonstrated”. The new employee was accompanied by the foreman for two weeks — nobody wrote it down. The briefing record solves that on one page.

Briefing record — five blocks:

Two signatures (briefed by / briefed), date per block, filing in the personnel file, entry in the matrix. The record demonstrates 7.2 (competence), 7.3 (awareness) and the initial occupational safety briefing in one.

Training plan — once a year, after the annual review: needs from four sources — gaps in the matrix (deputy missing), annual review (wish, development), law and customer (refreshers, new regulations), projects (new machine, new software, new standard). Per row: who, what, why, by when, costs, done on, effectiveness.

Evaluating effectiveness (7.2 c, last half-sentence) is the point almost everyone forgets: three months after the training one sentence — does the person apply it? Error rate down? Deputy works? Without this sentence the training is done but not evaluated.

Training records (attendance certificate, certificate, internal note) are in the personnel file; the matrix refers to them. External certificates with expiry are scheduled in the matrix.

📄 Briefing record (five blocks) and training plan with effectiveness column (German – English version to follow)

Occupational safety briefings (annual, under the occupational safety law of your country) are not a QM topic — but their record demonstrates 7.2 for safety-relevant tasks at the same time. Anyone who includes them in the training plan has one list instead of two.

Module 8 of 16

Awareness (7.3) and communication (7.4): the two clauses without a form

Two short clauses for which no company needs a form — and which the auditor checks anyway, because they show whether the system is lived.

Awareness (7.3): the persons must be aware of the quality policy, the relevant objectives, their contribution and the consequences of nonconformity. Not: recite them by heart. The auditor asks the employee at the machine: “What matters most to you in your work — and what happens if the part goes out with a defect?” The answer “Dimensionally accurate, otherwise it comes back and the customer is gone” is awareness. The answer “Don't know, ask the boss” is a nonconformity against 7.3.

How awareness arises and is demonstrated:

Communication (7.4): the standard requires determining what, when, with whom, how and who communicates — internally and externally. In a small company a table with five to eight rows in the manual:

Minutes line instead of minutes: one sentence per meeting — date, participants, three topics, decisions — in the meeting book or a file. That demonstrates 7.3, 7.4, 5.2.2 (policy communicated), 6.2.1 f (objectives communicated) and 10.3 (improvement) at once. The cheapest record of the whole system.

Module 9 of 16

Measuring equipment list: which instruments require inspection — and which do not (7.1.5.1)

Clause 7.1.5.1 requires that the resources with which you measure and check are suitable and are maintained — with documented information as evidence of fitness for purpose. That applies to every measuring instrument whose result you use to demonstrate conformity. The measuring equipment list answers three questions: which measuring instruments do we have? Which of them require inspection? When were they last checked?

Three classes — the most important decision of the list:

The classification justifies why the folding rule has no label — and the auditor accepts that if it is in the list. Without a list every measuring instrument without a label is a question.

Columns of the measuring equipment list: no. · designation · class · measuring range / accuracy · location / user · inspection method (external accredited / external manufacturer / internal against reference no. …) · interval · last inspection · next inspection · result / remark.

Intervals (empirical values, not a requirement of the standard): callipers and micrometers 12 months · torque wrenches 12 months or 5,000 operations · scales subject to legal metrology verification under the law of your country (often 2 years) or annually internal · thermometers 12 months · electrical test instruments per manufacturer's specification (usually 12 to 24 months) · reference standards (gauge blocks, test weights) external 24 to 36 months.

Software as measuring equipment (7.1.5.1, application example): test software, measurement data acquisition, Excel evaluation with formulas — confirm fitness for purpose once (test data set) and again on change. One row in the list with method “verification with test data set”.

Employees' own measuring instruments (own calliper in the pocket): either into the list and checked — or the rule “at the check point only measuring instruments from the list”, and the private instrument is class H.

📄 Measuring equipment list (Excel) with classes P/W/H, interval, due-date formula and colour (German – English version to follow)

Service providers and retailers without measuring equipment at the check point keep a list with the row “no inspection equipment; conformity by function test / visual inspection / comparison” and exclude 7.1.5.2. Cleaning companies: dosing devices are class W (visual check); building services with temperature measurement (legionella) have class P.

Module 10 of 16

Calibration and traceability: external, internal, and what happens when “unfit” (7.1.5.2)

7.1.5.2 is the only place in clause 7 that may be excluded — and the one that is checked most closely at everyone who measures. It applies when measurement traceability is a requirement (customer, law, sector standard) or the company considers it essential — which it does as soon as its inspection record contains dimensions that the customer is to accept as evidence. Then class P inspection equipment must be:

1. calibrated or verified — at specified intervals, against standards traceable to national or international measurement standards (the chain up to the national metrology institute);
2. identified so that the status is recognisable (label, number, list);
3. protected from adjustment, damage, deterioration (case, storage, not the toolbox).

External or internal?

The chain must close: the internal calliper is checked against a gauge block, the gauge block is externally (accredited) calibrated. That is traceability in a small company — a set of gauge blocks or three gauge blocks (10, 50, 100 mm) are enough for the whole workshop.

Unfit — the procedure everyone forgets (7.1.5.2, last paragraph): if the check reveals that a measuring instrument was out of tolerance, the company must evaluate whether previous measurement results are affected and take action. In practice: the measuring equipment list shows which orders were released with this instrument since the last check (inspection records name the equipment no.); compare the deviation with the product tolerance; if critical: inform the customer (8.7). One sentence in S7 and one line in the nonconformity sheet.

Exclusion of 7.1.5.2: permissible if no measuring instrument demonstrates conformity — retail, IT, consulting, cleaning without measurement. Reasoning in the manual chapter 1.3. Anyone who has scales for sales weights or a thermometer for the cold chain cannot exclude it.

📄 Check instruction for internal checking of calliper, micrometer, scales, thermometer against reference — with record (German – English version to follow)

Status of the information: intervals and costs are empirical values of October 2026; binding are manufacturer's specifications, legal metrology and customer requirements.

Module 11 of 16

Infrastructure and maintenance plan: machines, vehicles, IT, buildings (7.1.3, 7.1.4)

Infrastructure is everything that carries your output: buildings, machines, vehicles, tools, IT, software. The standard requires it to be provided and maintained — and the auditor asks at the machine: “When was that last serviced, and where is that written?” The maintenance plan is the answer: a list in which all equipment stands with interval, type of maintenance and date.

Two lists in one: the statutory inspection duties of your country (electrical equipment, forklifts, ladders, pressure equipment, lifts, gates, fire extinguishers) belong in the same maintenance plan — then it demonstrates 7.1.3 and occupational safety at the same time, and the company has one due-date list instead of three.

IT as infrastructure: the audit question is not “Do you have a backup?” but “When did you last test whether data can be restored?” One restore test a year with a record (date, data volume, duration, result) is the evidence — and for companies with customer data at the same time the validation under 8.5.1 f.

Unplanned failures are recorded as a nonconformity sheet (origin “infrastructure”); two failures of the same equipment in a year are a candidate for the risk analysis (replacement investment).

Work environment (7.1.4): light, temperature, cleanliness, noise, space — as far as they influence the result. One paragraph in the manual (“workshop heated, inspection station with daylight lamp, warehouse dry, office quiet”) and visual inspection are enough; anyone who paints or bonds needs temperature and humidity data with measurement (then class P).

📄 Maintenance plan (Excel) with statutory inspection duties, interval, due date and colour (German – English version to follow)

Module 12 of 16

Organisational knowledge (7.1.6): what is gone when the foreman leaves

7.1.6 is the clause that was new in 2015 and that small companies understand best — because everyone knows the sentence: “When the foreman leaves, we no longer know how customer X wants his parts.” The standard requires determining the knowledge necessary for the processes, maintaining it and, on changes, considering how additional knowledge is acquired.

Kinds of knowledge in a small company — and where they sit:

Three tools, no more:

1. One place — wiki, project folder, customer file with field “special features”. Rule: at project close-out enter two sentences (V1 last step).
2. Deputy with induction — the qualification matrix with two persons per task is knowledge safeguarding; level 3 means “can pass it on”.
3. Knowledge list — a table in the manual as above, five to eight rows, reviewed annually in the management review: is the holder still there? Is the safeguard current?

Succession and knowledge drain as a risk: “Foreman retires in 2028” is in the risk and opportunity analysis with action (induct successor, work instructions for the five critical processes by 2027). That is 7.1.6 b (additional knowledge on change) in practice.

What the auditor asks: “Let's take your most experienced employee: what does only he know — and what happens if he is out for four weeks?” The knowledge list and the matrix answer that. “All in his head” is the nonconformity.

Module 13 of 16

What the auditor asks at workplace, warehouse and office — 30 questions on clauses 7 and 8.4

Clauses 7 and 8.4 are not checked at the desk but on the walk-through. The auditor takes what he sees — a pallet in goods receipt, the employee at the saw, the calliper at the inspection station, the forklift — and goes from there to the list and the evidence. Three steps, always the same:

Typical questions (from real audits, anonymised):

• “Show me your list of all measuring instruments, and let's take three of them straight from the workplace: how do I recognise that they are checked?” → list, number, label, record — and the three match.
• “Who last welded here — and show me his qualification for exactly this process and this material.” → welder qualification with validity, matrix.
• “Let's take your most recently hired employee: how did the induction go, and how do you know that she masters the task?” → briefing record with release, effectiveness note.
• “Show me your most important supplier: why do you buy there, and what happens if he fails?” → supplier list (class A, reason, grades), risk analysis.
• “Let's take your last sampling from overseas: how did you secure the quality before the parts were here?” → initial sample inspection report, inspection level 4, supplier evaluation.
• “When did you last test whether your data can be restored?” → test record.

The six most frequent minor nonconformities: suppliers not evaluated (8.4.1) · briefing not demonstrated (7.2) · effectiveness of training not evaluated (7.2 c) · measuring instruments without identification/inspection date (7.1.5) · maintenance without plan or record (7.1.3) · outsourced process not recognised (8.4.2). All six are fixed with the four lists in one afternoon.

📄 Thirty audit questions on suppliers, people, measuring equipment and infrastructure with evidence (German – English version to follow)

Answer in five minutes: the four lists are ready printed or as a file; the walk-through starts at goods receipt and ends at the inspection station. Anyone who has done that once himself (internal audit) knows his gaps before the certification body.

Module 14 of 16

Case study: Brenner & Sohn Specialist Retail — four lists for two locations

Brenner & Sohn Specialist Retail (fictitious) trades in fastening technology, fittings, tools and power tools for trades and industry — two locations (main warehouse with sales in Würzburg, Germany, branch with sales in Schweinfurt), 22 employees, plus an installation service (two fitters install gates and drives). The company wants to certify; the four lists are missing.

Starting point — from the questionnaire:

• Suppliers (12): two wholesalers for fittings, one manufacturer of drives (single supplier, installation to manufacturer's specification), three tool manufacturers, one electronics distributor, haulier, parcel service, IT system house (cloud ERP), office supplies, electricity provider.
• Staff: sales (8, of which 3 at the branch), warehouse (6, two forklift drivers), installation (2; installation management and qualified electrician: MD son), office (3), purchasing (1), management (2 — father and son). Briefings so far verbal; forklift licences available; first aiders: 2 at the main location, 0 at the branch.
• Measuring equipment: scales in the warehouse (sale by weight: screws), folding rules, the fitters' torque wrenches (safety-critical bolting of drives), installation tester (qualified electrician), multimeter.
• Infrastructure: 2 forklifts, 3 vehicles, racking (inspection duty under the racking standard), local server plus cloud, gate with drive in the warehouse, ladders.

Your task (90 minutes):

1. Supplier list: all twelve with class A/B/C, reason, inspection level at goods receipt; mark outsourced processes; evaluation for the A suppliers with plausible grades.
2. Qualification matrix: tasks from V1 (sales, picking, dispatch check, installation, acceptance) plus mandatory qualifications; take two locations into account.
3. Measuring equipment list with classes — and the decision: can Brenner exclude 7.1.5.2?
4. Maintenance plan with statutory inspections.
5. Find three gaps that would be minor nonconformities in the audit.

📄 Brenner & Sohn: starting point, supplier, staff, measuring equipment and equipment list to work on (German – English version to follow)

📄 Brenner & Sohn: model solution — four lists filled in, three gaps with clause (German – English version to follow)

Where most fail: the drive manufacturer is class A and specifier for the installation (manufacturer training of the fitters = mandatory qualification) · the scales make the exclusion of 7.1.5.2 impossible (sales weight = conformity) — so class P, subject to legal metrology · the branch without first aider and without a level 3 person for dispatch check is a gap in 7.2, not only in occupational safety.

Time balance: setting up the four lists at Brenner: two afternoons (MD and purchasing). In the stage 2 audit clauses 7 and 8.4 were checked in 40 minutes at both locations — one minor nonconformity (racking inspection not demonstrated), which was already scheduled in the maintenance plan.

Module 15 of 16

Records: the four lists through the year — and what flows into the management review

Four lists, each with a fixed date in the year — that is the whole effort for clauses 7 and 8.4 after set-up.

In addition once a year: review the knowledge list (7.1.6), check the communication table (7.4), meeting routine running (7.3).

Retention: supplier evaluations 10 years (product liability: where did the material come from?); briefing and training records duration of employment plus 3 years; calibration certificates period of use plus 3 years (retrospective evaluation); maintenance and inspection records as required by regulation (at least until the next inspection, better 10 years).

Checklist — your own four lists in 16 criteria:

📄 Checklist: rate supplier list, qualification matrix, measuring equipment list, maintenance plan in 16 criteria (German – English version to follow)

Below 20 of 32 points: repeat module 14, set up the lists for your own company, rate again after four weeks. From 26: clauses 7 and 8.4 audit-proof.

What follows: the nonconformity sheets with origin “supplier” and the customers' feedback are the material of the course “Complaints, KPIs, Customer Satisfaction”; supplier evaluation and training plan are inputs of the course “Management Review and Year End”.

Module 16 of 16

Procedure in our company

Your company completes this module. The general part of the training ends here; what follows, only your company knows:

Companies with a company account of the Academy receive this module with their own details; participants then see the names, dates and filing locations of their company. Without customisation: ask your management or your quality manager where these details are laid down in your company — usually in the quality manual.

Final test

38 questions, one correct answer each. You need 31 correct answers to pass (80 %). Scoring happens on the server — there is no answer key on this page.

Your result