The organization makes sure bought-in processes, products and services cannot harm its ability to deliver conforming products: outsourced processes stay under QMS control; controls are set both on the provider and on what it delivers; the possible impact, how effective the provider's own controls are and, under 9100, what periodic performance reviews show are all taken into account; and the verification to be performed is decided. Under 9100: verification is scaled to the risks identified and, where the risk of nonconformity (counterfeit parts included) is high, includes inspection or periodic testing; verification by the customer never relieves the organization of its responsibility; product released into production before verification is complete is identified and recorded so it can be recalled and replaced; where verification is delegated, the scope and requirements are defined, a register of delegations is kept and delegations are monitored from time to time; test reports from providers that are relied on for verification are assessed through a process that confirms the product meets requirements; and where raw material is seen as a significant risk to operations, a process checks that test reports are accurate.
This control maps to 6 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 6 it maps to, and the evidence behind each claim, over MCP and REST.