An organization should manage its suppliers and external resources by evaluating relevant suppliers and documenting the process, as required by ISO 9001:2015. This involves controlling externally provided processes, products, and services, which are typically subcontracted or outsourced. Organizations should establish criteria to evaluate suppliers, such as price, quality, and delivery time, and use a risk-based approach to prioritize audits based on the level of risk suppliers pose to operations. Certified suppliers may require less direct auditing due to regular audits by accredited bodies, while suppliers without certification might need more direct auditing efforts. This approach helps ensure conformity with the Quality Management System (QMS) requirements.