What to Review Before Reapproving a Long-Standing Supplier

01Q1. What has materially changed since the original approval?

Begin with the approved scope, legal entity, operating site, product family and critical processes. Compare these with the present relationship. Has the supplier moved production, changed ownership, adopted different equipment, outsourced a special process or substituted key materials? Has the customer's requirement become more demanding because of new regulations, product design, markets or customer commitments? Reapproval is not meaningful when it only checks the original questionnaire without testing whether its assumptions remain true.

Look beyond formal supplier announcements. Recurring exceptions, late deliveries, new staff contacts, process capability drift or unusual invoice changes may signal a shift in controls. Verify material changes through direct discussion, documentation and operational evidence. Not every organizational change requires disqualification, but unexplained change is a reason to reconsider the existing assurance plan.

02Q2. Which historical performance evidence deserves the most weight?

Review representative normal transactions, serious incidents, responsiveness to changes and the effectiveness of previous corrective actions. A long average can hide a recent deterioration. Separate current patterns from events already resolved through proven corrective action. For low-volume specialized providers, qualitative evidence from a small number of critical transactions may be more informative than a percentage score.

Include complaints from receiving teams, engineering, operations and customers where relevant. Check whether recurring workarounds have become normalized: extra inspection, informal expediting or personal intervention by a buyer. These can conceal a deteriorating supplier beneath apparently acceptable formal KPIs. The correct question is whether routine controls work without hidden heroics.

Relevant source: ISO 9001:2026 — Quality management systems — Requirements.

03Q3. Are certificates and audit reports sufficient for reapproval?

A current management system certificate can contribute to assurance, but its scope, issuing body, site coverage and relevance must be understood. It is not a substitute for verifying the specific purchased product or service. ISO 19011:2026 offers guidance on management-system auditing; it does not make every supplier audit mandatory or establish a universal frequency for reapproval.

Use evidence proportionate to the exposure. A targeted remote review may be enough for a stable low-risk service. For a safety-critical process showing significant drift, a site visit, technical sample, process demonstration or independent test may be justified. Document why the chosen verification depth is adequate for the current decision.

04Q4. What should happen to unresolved corrective actions?

Open actions require a disposition rather than disappearance into a renewal presentation. Distinguish overdue paperwork from unresolved operational risk. For significant nonconformities, verify containment and whether corrective actions address the actual cause. A supplier's statement that an action is “closed” should be supported by subsequent performance evidence when the exposure justifies it.

Where the supplier cannot complete improvement before the renewal date, a conditional approval may be suitable if the residual risk is tolerable and monitored. It needs clear scope, mitigation, accountable authority and expiration. For unacceptable safety or regulatory exposure, continuation on the same basis is not justified by the commercial inconvenience of finding alternatives.

Further context: ISO 44001:2017 — Collaborative business relationship management.

05Q5. Has the relationship become dependent on a hidden single point of failure?

A long-standing provider may rely on one technician, a single machine, a sole subcontractor or an aging IT platform. Evaluate succession, capacity, disaster recovery, tooling ownership and exit capability. For digital providers, review current access rights, incident history and changes in data handling. A review that ignores dependency can mistake familiarity for resilience.

Ask what would happen if the supplier could not deliver for a defined recovery window. The answer may lead to buffer stock, alternate source qualification, retained expertise, a contingency service arrangement or acceptance of a documented risk. The choice depends on business consequences, not an arbitrary rule that every supplier must have two backups.

06Q6. How should commercial terms influence a quality reapproval?

Price and service value matter, but they should be assessed alongside conformity, continuity and current business need. A supplier can remain technically suitable and no longer be commercially competitive; another can be inexpensive but operationally unacceptable. Keep these judgments explicit so a financial review does not silently overrule a critical technical concern.

Use comparable scope and total-use cost when considering renewal. Review whether contract changes have created gaps in acceptance criteria, reporting, responsibilities or access rights. Confirm that the agreed service level matches what users need today, not the workload assumed at the first contract signature.

07Q7. Who should approve continued use, and on what conditions?

Procurement typically coordinates the review, while technical, operational, quality, security or compliance owners assess the risks in their domains. The final authority should match the consequence of failure and established delegation of authority. A single purchasing tick-box cannot represent unresolved opinions from different disciplines.

The reapproval record should identify scope, current evidence, changes, exceptions, residual risk, decision owner, conditions and next trigger. An unconditional approval is appropriate only when its relevant assumptions are supported. Where a review is limited, describe the boundary of the conclusion rather than implying an enterprise-wide assessment.

08Q8. When is reapproval complete?

The review is complete when the decision can be used by operations: the supplier's approved scope is current, contacts and contract terms are aligned, open conditions are assigned and monitoring reflects remaining risk. Communicate changes to the receiving teams so that old approval status does not continue to authorize superseded products or services.

Set the next review using both a risk-appropriate interval and event triggers: major ownership or process changes, serious nonconformities, altered legal requirements, new critical subcontractors or deterioration in service continuity. Avoid calendar dates as the only mechanism. Continued approval is a managed decision, not a permanent entitlement.

Illustrative scenario: a familiar precision-machining provider

A buyer has used a small machining supplier for a decade. During reapproval, the buyer learns that the supplier plans to move a critical operation to a new subcontractor. No defect has yet been detected. In this illustrative scenario, the decision turns on a changed manufacturing arrangement rather than a historic scorecard.

Engineering requires evidence of technical equivalence and a controlled trial for the affected parts. Procurement updates the approved scope and contractual notification terms. Quality increases incoming verification for a defined initial period. The supplier can remain approved for unaffected parts while the changed process is conditionally restricted. This preserves continuity without pretending that the old assessment covers a different process.

Reapproval decision checklist

• Confirm current entity, location, scope and key process changes.
• Evaluate recent performance, major incidents and corrected recurrence.
• Verify the relevance and scope of certificates or audits, if used.
• Identify critical dependencies and exit or recovery arrangements.
• Distinguish commercial competitiveness from technical suitability.
• Record conditions, authorization, monitoring and event-based triggers.

Use a risk-based review plan instead of a uniform questionnaire

A routine supplier of widely available noncritical items may need a quick confirmation of current identity, commercial status and recent delivery exceptions. A provider handling sensitive data, regulated processes or indispensable equipment requires deeper verification of present controls. Construct the review package from the consequences of failure, change history, detectability and availability of alternatives. Do not assume that a supplier's spend or years of service is a reliable proxy for criticality.

For each significant question, choose an evidence method: documented demonstration, recorded sample, technical test, observed process or management discussion. Document why the selected method is sufficient and what its limitations are. A remote review can be efficient where records are reliable; an on-site assessment may be justified when a crucial process is uncertain. Use escalation when findings cross predetermined risk thresholds rather than automatically sending the same questionnaire to all suppliers.

Preserve a clear approval history through changes

The supplier-master record should represent the actual scope of approval. If an approved facility closes, a company changes legal ownership or a previously internal process is subcontracted, the new configuration may need a different authorization. Preserve the old approval record for traceability, but do not allow it to serve as indefinite permission for the changed operation. Where the buyer has multiple business units, communicate restrictions to all purchasing groups that may use the supplier.

Record which standards, contractual requirements and internal procedures were considered as part of each approval. A management-system standard may inform external provision controls, while sector regulations impose additional obligations; the decision must respect the governing requirements for the specific product or service. A useful reapproval ends with a living scope statement and event-based triggers that connect historical evidence to future operating decisions.

Apply review findings across locations and purchasing categories

An approval may be shared by several factories or business units even though the underlying evidence was collected for one product family. When a reapproval identifies a changed material, subcontracted operation or capacity constraint, determine which other buying units depend on the same supplier configuration. Communicate the specific scope and any restriction. Otherwise, one team may block a critical process while another continues ordering under an outdated unrestricted status.

A central supplier register should support these distinctions without becoming unwieldy. Link approved scope, sites, key product or service categories, review status and critical conditions. Preserve responsible names and the decision record. The register is not the control by itself; its value depends on buyers and receiving personnel actually using current approval information at the point of ordering and acceptance.

Closing perspective

A credible reapproval respects history without becoming captive to it. The best question is not “Have we always used this supplier?” but “Would we make this approval decision today with the evidence and risks now in front of us?” Answering that question makes renewals both efficient and defensible.