8.4.1、总则
组织应确保外部提供的过程、产品和服务符合要求。
组织必须对所有从外部提供的过程、产品和服务的符合性负责，包括顾客指定的来源。
当要求时，组织应确保使用顾客指定或批准的外部供方，包括过程来源（如特殊过程）；
组织应识别和管理与外部提供的过程、产品和服务以及挑选和使用外部供方相关的风险。
组织应要求外部供方对他们的直接或下级外部供方进行适当的控制，以保证满足要求。
在下列情况下，组织应确定对外部提供的过程、产品和服务实施的控制：
a）外部供方的产品和服务将构成组织自身的产品和服务的一部分；
b）外部供方代表组织直接将产品和服务提供给顾客；
c）组织决定由外部供方提供过程或部分过程。
组织应基于外部供方按照要求提供过程、产品和服务的能力，确定并实施外部供方的评价、选择、绩效监视以及再评价的准则。对于这些活动和由评价引发的任何必要的措施，组织应保留成文信息。
注：在选择和评价外部供方时，可使用来自客观和可靠外部提供的质量数据作为组织自己的评估（例如：信息来自授信的质量管理体系或过程认证机构,政府机构对外部供方的批准）。使用这种数据只能是组织对外部供方控制过程的一个组成部分，组织仍然有验证采购的产品满足规定采购要求的责任。
8.4.1、General
The organization shall ensure that externally provided processes, products, and services conform to requirements.
The organization shall be responsible for the conformity of all externally provided processes, products, and services, including from sources defined by the customer.
The organization shall ensure, when required, that customer-designated or approved external providers, including process sources (e.g., special processes), are used.
The organization shall identify and manage the risks associated with the external provision of processes, products, and services, as well as the selection and use of external providers.
The organization shall require that external providers apply appropriate controls to their external providers, to ensure that requirements are met.
The organization shall determine the controls to be applied to externally provided processes, products, and services when:
a. products and services from external providers are intended for incorporation into the organization’s own products and services;
a. products and services are provided directly to the customer(s) by external providers on behalf of the organization;
b. a process, or part of a process, is provided by an external provider as a result of a decision by the organization.
The organization shall determine and apply criteria for the evaluation, selection, monitoring of performance, and re- evaluation of external providers, based on their ability to provide processes or products and services in accordance with requirements. The organization shall retain documented information of these activities and any necessary actions arising from the evaluations.
NOTE: During external provider evaluation and selection, the organization can use quality data from objective and reliable external sources, as evaluated by the organization (e.g., information from accredited quality management system or process certification bodies, external provider approvals from government authorities or customers). Use of such data would be only one element of an organization’s external provider control process and the organization remains responsible for verifying that externally provided processes, products, and services meet specified requirements.
