An organization should manage its suppliers and external resources by evaluating and documenting the relevant suppliers, as required by ISO 9001:2015. This involves controlling externally provided processes, products, and services, which are subcontracted or outsourced by the organization. The organization should establish criteria to evaluate suppliers, such as price, quality, and delivery time. While assessing or auditing all suppliers is not strictly mandatory, a risk-based approach can be strategic. Certified suppliers may reduce the need for additional audits, while suppliers without certification might require more direct auditing efforts. This selective approach helps maximize the impact of audits while maintaining a balanced use of resources.