How to keep an ISO 9001 approved supplier list and its certificates up to date

Keep an approved supplier list up to date by running it as a register, with an expiry date against every certificate. For each supplier whose goods or services go into your product, record what you require, the certificate you hold, its number, what its scope covers and when it expires, then ask for the replacement before that date, not after the auditor finds the gap. Chasing and filing are clerical work, and deciding who is on the list is the quality manager's job. Keeping the two apart is what keeps the list current.

What starts the job, and who does it today

Three things start it: purchasing wants to use a new supplier, a certificate on file reaches its expiry date, or an audit is booked. In most small manufacturers the quality manager does all of it, between inspections.

The steps

1. Decide who belongs on the list. NQA's guide to ISO 9001:2015 describes a quality system as concerned mainly with suppliers whose products or services are incorporated with your own: material stockholders, subcontract platers, heat treaters and machinists. Add the calibration laboratories your measurements depend on. Mark the suppliers a failure would hurt most.

2. Set what you require of each kind. An ISO 9001 certificate from a subcontract processor, accreditation for the calibrations a laboratory performs for you, material certificates with each delivery from a stockholder, insurance where your customer asks for it. Write it as a table by supplier category.

3. Ask. Send a questionnaire and a document request to each new supplier, and to existing ones with nothing on file.

4. Check what comes back. Is the name on it the company you buy from, at the site you buy from? Does the scope cover what you buy? Is it in date, and to the 2015 edition or ISO 9001:2026, published on 16 September 2026? NQA, a certification body, gives 30 September 2029 as the expected deadline for moving ISO 9001:2015 certificates to the new edition, and says 2015 certification can be maintained during the transition period. Then confirm it is real, in UKAS's three steps: check the certification body is accredited by a recognised accreditation body, check that claim is valid, then confirm the certificate itself. CertCheck, UKAS's free database, covers UKAS accredited management system certificates only: a search by certificate number or registered trading name shows the scope, issue date, locations and certification body. A certificate issued under another accreditation body will not be there, so confirm it with the certification body that issued it.

5. Decide. The quality manager approves the supplier, approves it with a restriction, or declines it, and records why.

6. Register it. Supplier, category, each document, certificate number, expiry date, who approved and when.

7. Renew before expiry. Ask for the new certificate ahead of the date, by a lead time you choose, and chase until it arrives.

8. Review. At the interval your own procedure sets, look at each critical supplier's deliveries and rejects, and confirm or change its status.

What you can change tomorrow

• Add an expiry column and sort by it.

• Check your ten most critical suppliers' certificates.

• Name files so they can be found: supplier, document, expiry date.

• Tell purchasing the rule. No order to a supplier that is not on the list without the quality manager's say.

• Put calibration certificates in the same register. Your gauges have due dates too.

The rest of the quality office's paperwork is on our manufacturing page.

Which steps an AI worker can take on

The clerical part can be work for an AI worker, answering here to the quality manager. It can send the questionnaire and the document request to a new supplier when purchasing asks, read each document as it comes back, and compare the name, scope wording and dates with your requirement table. Whoever checks a certificate on CertCheck, a person or the agent, does it only by the route UKAS publishes, the search by number or name. Where that search is not open to the agent, it passes the look-up to the quality manager with the certificate number ready. The agent can then assemble the file with a one-page summary and the exceptions for the quality manager, as the supplier onboarding role sets out. After approval it can keep the register: open each renewal at your lead time, email the supplier for the new certificate, remind at the intervals you set, check the replacement against the old entry, file it and set the next date, and list what is expired or about to be on any day. That work is the renewals and expiry tracking role.

What waits for a person, and why

• Approval. Putting a supplier on the list, restricting it or removing it is the quality manager's decision, recorded as theirs.

• A lapsed certificate. Whether you keep buying while a supplier's renewal is late is a judgement about risk. The agent reports the lapse. It does not block or permit an order.

• Whether a scope is good enough. The agent can show that the certificate says "machining" and you buy "machining and anodising". Whether that matters is a technical call.

• Batch paperwork. Whether the material certificate with a delivery meets the specification, and whether your own certificate of conformity is signed, belongs to inspection and quality.

• Audits, visits and phone calls. A second-party audit of a supplier, and the call to one who has gone quiet, are a person's.

• Bank details. Anything about paying the supplier stays with finance.

What to have ready

• The current list.

• The requirement table by supplier category.

• Your questionnaire.

• The folder of certificates.

• A quality contact at each supplier.

• Your lead time for renewals.

• The date of your next audit.

How this paperwork limits a small manufacturer's growth is in how to scale a manufacturing business without hiring more staff.

An AI worker would request a manufacturer's supplier certificates, check them against your requirements and chase each renewal in time, with your quality manager deciding who is approved. A supplier list checked only the week before an audit can miss certificates that lapsed in between. Talk to our agent.