Free Assessment · About Six Minutes
The Purchasing and Supplier Control Maturity Check
Score. Diagnose. Decide.
Purchasing is the process most organizations put off. It is rarely the reason anyone fails an audit, and it is frequently the reason something else does — a late delivery, a contaminated batch, a contractor injury, a shortage nobody saw coming.
This check scores your process across eight elements, plus the requirement your standard contains and the others do not. There is a genuine Controlled band that tells you to stop. A well-implemented certified system is a legitimate place to rest, and an assessment that fails everyone is not an assessment. Answer for what happens on a busy week, not for what the document says.
Which standard applies to you?
0 of 0 answered
Your Result
Purchasing and Supplier Control Maturity Check
Score. Diagnose. Decide.
0%
0 of 0 points
Your element-by-element breakdown
You have your score. The breakdown shows which of the elements is holding it down and the order to fix them in. Enter your details and it opens below — and we will email you the Maturity Framework, a scoring worksheet to bring to your next management review.
Thank you — your framework is on its way.
We could not restore your answers in this browser, so the breakdown cannot be shown on screen. The framework has been sent to the address you entered. You are welcome to take the check again below — or call 760-434-9141 and we will walk through it with you.
Element Breakdown
Where your score comes from
Priority Order
What to fix first
Improve one element at a time. Attempting to move every element at once is the most reliable way to move none of them.
Your framework worksheet is ready now.
The full ladder, all four levels of every element, and a blank scoring worksheet to take to a management review. A copy is on its way to your inbox as well.
Welcome back — your score has been restored from this session.
If You Want the Document Rather Than the Homework
The Purchasing and Supplier Control Procedure Template & Guide
Every element you were just scored on — already drafted, in editable Word.
This check was built from a complete procedure, not the other way round. The eight elements you just scored are the eight elements the template implements. Where you scored low, the template shows you what a Level 3 or Level 4 version of that element actually looks like on the page.
What is in it
- A channel-enumerated trigger, so the contractor booked by phone cannot bypass the process
- Rating criteria based on effect rather than spend, with value deliberately excluded
- The two-control determination, recorded in two columns rather than assumed
- An evaluation record built to work as the approval gate, and a provider register
- Exception and contingency paths — bounded, authorized and logged
- A desk-level work instruction and a worked example that costs almost nothing and exposes a great deal
- A fourth appendix specific to your standard
- The full maturity ladder — the one this check scores you against
$149
One purchase covers one standard. Editable Word, 39–47 pages.
Not sure yet? Read the full guide first, or call 760-434-9141.
Built by Management Systems International (MSI) — 80+ certifications supported, 200+ audits attended, 600+ professionals trained since 1998. Veteran-owned and female-owned.
Questions People Ask
Purchasing and Supplier Control Maturity Check — FAQ
Which clause covers purchasing in my standard?
It differs in every one, which is part of why this process is so unevenly implemented. ISO 9001:2015 puts it at Clause 8.4, in three parts — 8.4.1 general, 8.4.2 type and extent of control, 8.4.3 information for external providers. ISO 13485:2016 uses Clause 7.4, because it predates the harmonized ten-clause structure. ISO 45001:2018 has a dedicated procurement clause at 8.1.4, covering procurement, contractors and outsourcing separately. ISO 7101:2023 uses Clause 8.8. ISO 14001:2026 has no purchasing clause at all — the requirements are distributed across Clause 8.1, with support from 6.1.2 and the new 6.3.
What is the requirement almost nobody implements?
In ISO 9001 it is Clause 8.4.2 b), which asks you to define both the controls applied to the external provider and those applied to the resulting output. Two determinations, one clause, and most organizations record only one. It is missed structurally rather than carelessly: the approved supplier list belongs to purchasing, incoming inspection belongs to quality, and no single document asks for the pair. The equivalent gap in ISO 14001 is the influence half of "controlled or influenced"; in ISO 45001 it is worker consultation on procurement controls under Clause 5.4; in ISO 7101 it is defining disqualification criteria in advance.
Why does the check not ask about spend or contract value?
Because rating suppliers on what they cost is the commonest structural error in this process, and it is inherited from procurement, where rating on value is entirely correct. The exposure in a box of respirator cartridges, a monthly waste collection, or a donated infusion pump has no relationship to its price. Every rating question here is about effect. If your own criteria contain a value threshold, that is worth looking at directly.
I scored lower than expected. Is the check harsh?
Probably not. The options describe observable behaviour rather than intentions, and most organizations score at Level 1 or 2 on at least half the elements. A certified organization landing in the middle band is the normal result, not a bad one. The check asks what happens on a busy week, which is a different question from what the procedure says, and it is the question an auditor samples into.
Do I have to reach the top band?
No, and most organizations should not try. The Controlled band exists to say so: a well-implemented certified system operating consistently at that level is a sound system, and staying there is a business decision rather than a compliance failure. Levels beyond it cost measurement effort and sustained management attention, and they earn their keep where exposure is high, where customers are asking, or where a regulatory or disclosure regime applies. An assessment that fails everyone is not an assessment.
How long does it take, and what do I get without entering anything?
Twenty questions, about six minutes. You see your score, your band, the band guidance and the requirement your standard contains that the others do not — immediately, without entering anything. The element-by-element breakdown and the priority order open after you enter your details, along with the Maturity Framework, which contains the full ladder and a blank scoring worksheet to take to a management review.
My organization runs more than one standard. Which path should I pick?
Pick the one your purchasing process is most often audited against, then take the check again for the other. The first seventeen questions are identical across all five paths; only the last three change. Running it twice takes about eight minutes and tells you something useful on its own — whether your process is genuinely one process, or a quality process with other requirements bolted on.
If a conversation would help
If your score surprised you, or the priority order does not match what you expected, a short conversation is usually quicker than a long email. MSI has supported 80+ certifications and attended 200+ audits across 28 years. No obligation attached.