The requirement that applies today
The organization sets criteria for choosing, evaluating, monitoring and re-evaluating outside providers of processes, products and services. It communicates its requirements to them, makes sure what they supply does not harm its ability to meet the system requirements, and keeps records of the evaluations and the actions taken.
ISO 22000:2018, 7.1.6 Control of externally provided processes, products or services; ISO/DIS 22000:2026, 7.1.6.
What the draft does
Retitled in the draft: The current heading starts with Control and lists externally provided processes, products or services. The public contents start it with Management, add materials, and extend the list to processes and services. That is a revised heading, not proof that the obligation changed, and the draft text is sold by ISO and not held here.
Source: public contents and foreword at 7.1.6, retrieved 2026-10-19.
Why this clause matters
Supply chains are where a site’s food safety is most exposed to things it does not control. The clause asks for criteria and records, not necessarily audits of every supplier. The common weakness is a supplier list with approval dates but no evidence of what was checked or what happens when performance drops.
Suggested evidence to discuss with your auditor
For 7.1.6, these are the artefacts we suggest discussing with your auditor. The standard publishes no evidence list, so this is our reading, not a requirement.
- Approved supplier list with the criteria, the evidence and the approval date
- Monitoring of supplier performance, such as rejections, complaints and late changes
- Re-evaluation records and the action taken when a supplier fails
Where systems usually fall short
- Approval based on a certificate alone
- No consequence when a supplier repeatedly fails
How to prepare
Pick the three suppliers that could cause the most serious incident and show the file for each: what you checked, what you require, how performance is watched and what you would do if it failed. That is the clause in practice.
Dates
Cross-references
Source
Clause 7.1.6. Current edition: ISO 22000:2018. Draft: ISO/DIS 22000:2026. Retrieved 2026-10-19. The full DIS text for 7.1.6 is sold by ISO and not held here; the sources page lists what is.
Not legal advice; does not certify; our words, not the standard's, and the planning date is an estimate.