Good morning all! We were discussing what we may need to modify in regards to vendor management in order to meet ISO requirements. Currently our vendor management is very very sketchy. We have vendors, which we have used for years and years, who we rely on to provide what we order. However, we don't necessarily have any checks in place to verify that they are providing what we have ordered, to spec. Steel for example - visually, you can't just look at a piece of steel and ensure it's A36 or whatever it is that you ordered, but the steel company delivers it as so and we accept it as so. (This has yet to be a major problem for us, but at the same time feels like we are taking a serious risk relying it to be accurate. Our products could pose serious life threatening safety hazards if we were to unknowingly use an unapproved steel/metal). We currently don't have an "Approved Vendor List" per se, we have a data management system that could print a report of our vendors. In the system, we have notes on vendors that have provided defective/late/poor quality etc. product, who we wouldn't utilize again. Does that suffice as an approved vendor list? Secondly, vetting a new vendor doesn't much exist in our company. Typically what happens, is an engineer wants a certain product, finds one online/other means and advises our operations department to order X product from Y company. (Keep in mind this is just for "new" vendors). What are some suggestions of ways to vet a new vendor? What would meet the standard for vetting a vendor? We were thinking of perhaps requiring 1-2 business references for each new vendor?? In addition, attaching a "New Vendor" alert to the PO so when product arrives our receiving department is on high alert to really check the product well, perhaps even with an optional requirement of having the engineer who ordered X product to sign off on the packing slip if it's accepted. Lastly, do we need to back-track and vet the vendors who we currently know/operate as approved vendors? My gut tells me no, because that would add no value. But my concern is that if an auditor would ask "How did you vet Haskins Steel?" and our answer was "We've used them for 23 years and have a wonderful relationship with their sales rep, delivery, customer service, etc." would that be an acceptable answer?