8.4外部提供的过程、产品和服务的控制
8.4.1、总则
组织应确保外部提供的过程、产品和服务符合要求。
组织应对所有从外部提供的过程、产品和服务的符合性负责，包括从顾客指定的来源。
当要求时，组织应确保使用客户指定或批准的外部供方，包括过程来源（例如：特殊过程）。
组织应识别和管理与外部提供的过程、产品和服务，以及和外部供方的选择和使用有关的风险，。
组织应要求外部供方对他们直接或者次级的外部供方实施适当的控制，以确保满足要求。
在下列情况下，组织应确定对外部提供的过程、产品和服务实施的控制：
a. 外部供方的过程、产品和服务将构成组织自身的产品和服务的一部分；
b. 外部供方代表组织直接将产品和服务提供给顾客；
c. 组织决定由外部供方提供的过程或过程的一部分。
组织应基于外部供方按照要求提供过程、产品或服务的能力，确定外部供方的评价、选择、绩效监视以及再评价的准则，并加以实施。对于这些活动和由评价引发的任何必要的措施，组织应保留形成文件的信息。
注：在外部供方评价和选择时，组织可使用来自客观和可靠的外部来源的供应商质量数据作为组织的评估,（例如：来自授信的质量管理体系或过程认证机构的信息,政府当局或客户对外部供方的批准）。使用这种数据只是组织对外部供方控制过程的一个组成部分，组织仍然负有验证外部提供的过程、产品和服务满足规定要求的责任。
8.4.1、General
The organization shall ensure that externally provided processes, products and services conform to requirements.
The organization shall be responsible for the conformity of all externally provided processes, products, and services, including from sources defined by the customer.
The organization shall ensure, when required, that customer-designated or approved external providers, including process sources (e.g., special processes), are used.
The organization shall identify and manage the risks associated with the external provision of processes, products, and services, as well as the selection and use of external providers.
The organization shall require that external providers apply appropriate controls to their direct and sub-tier external providers, to ensure that requirements are met.
The organization shall determine the controls to be applied to externally provided processes, products and services when:
a. products and services from external providers are intended for incorporation into the organization’s own products and services;
b. products and services are provided directly to the customer(s. by external providers on behalf of the organization;
c. a process, or part of a process, is provided by an external provider as a result of a decision by the organization.
The organization shall determine and apply criteria for the evaluation, selection, monitoring of performance, and re-evaluation of external providers, based on their ability to provide processes or products and services in accordance with requirements. The organization shall retain documented information of these activities and any necessary actions arising from the evaluations.
NOTE: During external provider evaluation and selection, the organization can use quality data from objective and reliable external sources, as evaluated by the organization (e.g., information from accredited quality management system or process certification bodies, external provider approvals from government authorities or customers). Use of such data would be only one element of an organization’s external provider control process and the organization remains responsible for verifying that externally provided processes, products, and services meet specified requirements.
