Criteria
Quality management under ISO 9001 requires criteria to select, evaluate and monitor external providers. NIS2 adds information security (§ 32 (4)(d) NISG 2026).
| Area | Typical criteria | Where the data comes from |
|---|---|---|
| Quality | Defect rate, complaints, certificates such as ISO 9001 | Goods receipt, complaints |
| Delivery | On-time delivery, quantities, response time | Orders, inventory system |
| Price and cost | Price trend, payment terms, total cost | Procurement, accounting |
| Information security | Questionnaire, certificate such as ISO/IEC 27001, public setup | Supplier, outside-in check |
| Compliance | Sanctions lists, code of conduct, data processing agreement | Lists, contracts |
| Financial stability | Master data, insolvency notices, credit rating | Official registers, data partners |
| Sustainability | Environmental certificates, human rights, country risk | Supplier, country indices |
Six steps
- Set goal and scopeDecide why you assess: selection, steering or evidence for an audit.
- Classify suppliersCombine spend (ABC analysis) with risk. A small IT provider with admin access can be more critical than a large material supplier.
- Choose criteria and weightsPick five to seven criteria per group. More criteria rarely make the result better.
- Collect dataUse existing data from procurement and quality first. Ask the supplier only what you cannot know yourself.
- Rate and classifySum up the result in classes, for example A to D. State what follows from each class.
- Agree actions and cycleAgree improvements with deadlines. Decide when you assess again.
Weighting: an example
| Criterion | Production supplier | IT service provider |
|---|---|---|
| Quality | 35 % | 15 % |
| Delivery | 25 % | 15 % |
| Price and cost | 15 % | 15 % |
| Information security | 10 % | 40 % |
| Compliance | 10 % | 10 % |
| Financial stability | 5 % | 5 % |
The values are an example, not a standard. Adapt them to your risk.
A proven cycle: critical suppliers every year, high risk every two years, the rest every three years. Reassess at once after an incident, a new owner or a new service.
Supplier audits
An audit checks on site or by video whether statements are true. It costs both sides time. It pays off for critical suppliers, after incidents or when evidence is in doubt.
Template: assessment sheet per supplier
These fields fit into any spreadsheet.
- Supplier, service, contact and domain.
- Classification: spend and risk, resulting class.
- Per criterion: points from 0 to 100, weight and data source.
- Overall result with class A to D.
- Evidence with expiry date, such as certificates.
- Open actions with deadline and responsible person.
- Date of assessment, assessor, next date.
- Short reason for the class.
You may copy and adapt this list freely.
Frequently asked questions
What is the difference between an assessment and an audit?
The assessment rates continuously against criteria, mostly from existing data. The audit checks on site whether statements are true. An audit is one possible source of the assessment.
Which criteria are mandatory?
There are no fixed criteria. ISO 9001 requires your own criteria without defining them. For NIS2 entities, the cybersecurity practices of suppliers belong in it (§ 32 (4)(d) NISG 2026).
Is a spreadsheet template enough?
For a few suppliers, yes. With many suppliers, spreadsheets often lack reminders, expiry dates and a log of changes.
Sources
- NISG 2026, § 32 (4)(d), BGBl. I Nr. 94/2025
- ISO 9001:2015, clause 8.4, Control of externally provided processes, products and services
Legal sources checked on 31 October 2026. Legal information, not legal advice. For your own case, please ask a professional. The German version is binding.