Ask ten supplier quality teams how often they re-evaluate suppliers and most will say once a year. Ask why once a year, and the answers get thinner: it is what the last system did, it fits the budget cycle, it is what the auditor saw last time.

Annual is a habit rather than a rule. ISO 9001 asks for criteria to evaluate, select, monitor and re-evaluate external providers, and for controls proportionate to the impact of what those providers deliver. It does not name an interval. That silence is an opportunity, because the teams getting the most from their supply base are not evaluating everyone more often. They are evaluating far fewer suppliers on the calendar and far more of them on evidence.

This article sets out a cadence model you can defend to an auditor, explain to a supplier and actually sustain.

The mistake is having one clock

Most programmes run a single annual cycle that bundles three genuinely different activities together. Separating them is the single highest-return change available, because only one of the three costs your suppliers anything.

Clock one: signal monitoring. This runs on data you already own. On-time delivery, quality escapes, open nonconformities, invoice disputes, responsiveness to requests. No supplier has to fill in anything for you to see a trend forming. Because it is free at the supplier’s end, this clock should run continuously rather than annually. Teams making the shift from annual reviews to continuous supplier monitoring usually find the signals were sitting in their own systems the whole time.

Clock two: supplier-effort data collection. Questionnaires, certificates, self-assessments, document refreshes, audits. Every cycle spends a finite amount of supplier goodwill, and it is the only clock the supplier really feels. This is the one to ration, and the rest of this article is mostly about how.

Clock three: the relationship review. The conversation about direction, capacity, roadmap and joint improvement. This is a business rhythm rather than a compliance one, and it belongs with the suppliers where the upside justifies the time. A well-run quarterly business review drives supplier change in a way an annual form never will.

Once the clocks are separate, the question stops being “how often do we evaluate everyone” and becomes three sharper questions. What do we watch constantly? What do we ask for, and from whom? Who do we sit down with?

What regulators and accreditors already worked out

Setting inspection frequency under resource constraints is a solved problem in several industries, and the solutions converge on the same principle: frequency should be earned, not fixed.

Aerospace: intervals as a reward. In the Nadcap programme, run by the Performance Review Institute, initial accreditation runs for 12 months before a reaccreditation audit is expected. Suppliers with a strong record can then qualify for merit status, under which accreditations last 18 months, and later 24. The criteria are specific. For 18-month merit a supplier needs to be at least at its second reaccreditation in that commodity, carry no non-sustaining corrective actions from the current or previous audit, and stay within defined limits on delinquency days and nonconformance counts. The 24-month interval asks for more: two consecutive accreditations of at least 18 months each, no major nonconformances, and no more than seven cumulative days of delinquency.

The design is worth pausing on. A longer interval is not an administrative convenience granted to save the auditor time. It is a status the supplier earns, can see the criteria for, and can lose.

Food safety in the EU: frequency proportionate to risk. Regulation (EU) 2017/625 requires official controls to be performed regularly, on a risk basis and at appropriate frequency, with authorities adjusting the control effort to the risk and the level of compliance expected. The regulation is explicit that a good compliance record should mean lighter treatment, noting that operators with a good record of compliance should bear lower overall charges than non-compliant ones, as they should be subject to less frequent official controls.

Food safety in the US: risk-based frequency written into law. The FDA Food Safety Modernization Act established a mandated inspection frequency based on risk, requiring that all high-risk domestic facilities be inspected within five years of enactment and no less than every three years thereafter.

Three different regimes, three different industries, one shared conclusion. Nobody with real resource constraints inspects everything at the same interval, and nobody treats a good track record as irrelevant to how often you come back.

Your supplier programme has exactly the same constraints. It can use exactly the same logic.

A merit-based cadence model

Here is the model in one table. Treat the intervals as starting points to calibrate against your own category risk, not as universal truths.

Tier	Who belongs here	Clock two interval	How a supplier moves up	How a supplier moves down
Watch	Critical or single-source suppliers, new suppliers in their first year, suppliers with an open major nonconformance	3 to 6 months	Not applicable, this is the entry and recovery tier	Not applicable
Standard	Suppliers with real impact on conformity and a normal record	12 months	Complete two consecutive clean cycles with no major findings and no overdue CAPAs	Any major nonconformance, or two consecutive missed response deadlines
Merit	Proven suppliers with a sustained record	18 to 24 months	Two consecutive Standard cycles clean, all CAPAs closed on time, scorecard above threshold	Same triggers as above, returning to Standard or Watch depending on severity
Light touch	Low-impact, easily substituted suppliers	24 to 36 months, or on event only	Not applicable	Escalates if spend, criticality or risk exposure changes

Two design notes matter more than the numbers.

First, the tier follows impact on conformity, not spend. A low-spend supplier of a safety-critical component belongs above a high-spend supplier of office consumables. If you have not segmented yet, a risk-based supplier segmentation or a Kraljic-based split gets you most of the way in an afternoon.

Second, publish the criteria. A supplier who knows that two clean cycles earns a longer interval has a reason to respond well to the current one. A supplier who thinks the schedule is arbitrary has no such reason. This is the quiet advantage of the merit approach: it converts your evaluation cadence from a cost you impose into an incentive you offer, using nothing but information you already hold. Make the thresholds visible in your supplier scorecards, and if you are still designing the scoring model, our guide to building a weighted supplier scorecard covers how to set thresholds that hold up across categories.

Events should outrank the calendar

The strongest argument against pure calendar scheduling is that risk does not arrive in annual instalments. A re-evaluation triggered by something that actually happened is worth several triggered by a date.

Build a short, agreed list of events that pull a supplier forward regardless of when they are next due:

• A major nonconformance or a repeat of a previously closed one
• A change of ownership, site, or key sub-tier supplier
• A sustained fall in on-time delivery or responsiveness on clock one
• Entry into a new regulatory scope, a new market, or a new critical part
• A disruption affecting their region, sector or logistics route
• Loss or lapse of a certification you rely on

This is where clock one earns its place. Continuous signals are what make event triggers possible, and automated follow-up for supplier evaluation and risk turns a trigger into a request without anyone remembering to send it. Business continuity deserves a specific mention here, and it is worth telling your suppliers that continuity is a priority rather than discovering their assumptions during an incident.

Anything that triggers a re-evaluation should also close properly. A finding that leads nowhere teaches the supplier that findings lead nowhere, so each one needs a tracked supplier CAPA with an owner, a date and verification of effectiveness.

Spending the attention budget well

Think of supplier attention as a budget rather than a free resource. Every questionnaire draws on the same account, and the balance is shared across you, your colleagues in other departments and your supplier’s other customers. Cadence decisions are really allocation decisions.

Three moves free up budget without reducing coverage.

Collect once, use many times. Overlapping requests from quality, procurement and sustainability are the most common source of avoidable supplier effort. A single structured intake, through a supplier portal or a shared onboarding process, lets one submission serve several internal purposes.

Ask only for what changes. Much of a typical annual questionnaire repeats information that has not moved since last time. Pre-filling known answers and asking suppliers to confirm or correct turns a long form into a short one, which is a large part of avoiding evaluation fatigue in procurement teams and at the supplier’s end too.

Give something back each cycle. The most reliable way to keep response rates healthy over a long cadence is to return the supplier’s own scorecard with peer context and a clear view of where they stand. It costs you nothing you do not already have, and it changes the request from an obligation into an exchange. Consistency helps here, which is why reducing bias in supplier performance reviews matters as much for credibility with suppliers as for internal fairness.

Where an on-site visit would be the natural next step but the travel is hard to justify, digital supplier audits let you keep a meaningful interval without the cost that usually forces teams to stretch it.

Making the change without an argument

Changing cadence tends to raise two internal objections, and both have straightforward answers.

“Reducing frequency looks like reducing control.” It is the opposite if you say it properly. You are moving from a fixed interval applied uniformly to a risk-proportionate interval with documented criteria, continuous monitoring underneath it and event triggers on top. That is a stronger control story, and it is the same logic regulators use. Record the rationale, the tier definitions and the trigger list as documented information, and your reporting and audit trail shows an auditor a considered system rather than a habit.

“We cannot track different intervals for different suppliers.” This is a real constraint in a spreadsheet, where a single shared deadline is the only manageable option. It stops being a constraint once intervals, triggers and reminders are held in a system, which is a common reason teams replace spreadsheets for supplier management and the thing that makes differentiated cadence practical when you scale a programme past a few hundred suppliers.

In regulated sectors the tier boundaries sit tighter and the documentation bar is higher, though the structure holds. Teams working under device or pharmaceutical oversight will recognise it from supplier relationship management for medical devices and for pharma, and automotive teams from the customer-specific requirements behind a scorecard built for IATF 16949.

A sensible first step is to leave the cadence alone and split the clocks. Put continuous signals in place, agree the event trigger list, and let the evidence from the first two quarters tell you which suppliers have earned a longer interval. By the time you change the schedule, you will have the record to justify it.

If you want to see how tiered intervals, triggers and automated follow-up work in one place, you can start a supplier performance pilot or book a demo.

Frequently asked questions

How often should you evaluate suppliers?
There is no single correct interval. A practical model is 3 to 6 months for critical, new or recovering suppliers, 12 months as a standard cycle, 18 to 24 months for proven suppliers who have earned a longer interval through consecutive clean cycles, and 24 to 36 months or event-only for low-impact suppliers. Continuous monitoring of data you already hold should run underneath all tiers.

Does ISO 9001 require annual supplier evaluation?
No. ISO 9001 requires defined criteria for evaluating, selecting, monitoring and re-evaluating external providers, with controls proportionate to the impact of what they supply, and documented evidence. It does not specify a frequency. Annual review is a widespread convention rather than a requirement, so a documented risk-based cadence is fully compatible with the standard.

Is it risky to reduce supplier evaluation frequency?
It depends entirely on what replaces the removed cycles. Reducing frequency on its own reduces oversight. Reducing frequency while adding continuous signal monitoring and event-based triggers usually increases it, because you learn about problems when they happen rather than at the next scheduled date. This is the same reasoning behind risk-based inspection frequency in food safety regulation and merit-based audit intervals in aerospace accreditation.

What should trigger an off-cycle supplier re-evaluation?
Common triggers are a major or repeat nonconformance, a change of ownership, site or critical sub-tier supplier, a sustained decline in delivery or responsiveness, entry into a new regulatory scope or critical part, a disruption affecting the supplier’s region or sector, and the lapse of a certification you rely on.

How do you decide which suppliers get a longer interval?
Base it on impact on conformity rather than spend, then let performance move suppliers between tiers against published criteria. Typical criteria for extending an interval are two consecutive cycles with no major findings, all corrective actions closed on time, and a scorecard above an agreed threshold. Publishing the criteria matters, because a supplier who can see how to earn a longer interval has a reason to engage with the current cycle.

How often should supplier business reviews happen?
Relationship reviews follow a different clock from compliance data collection. Quarterly suits strategic and development suppliers where there is a genuine agenda, annual suits most others, and low-impact suppliers rarely need one at all. Keeping this separate from your data collection cycle stops the review from becoming a form-filling exercise.

---

Sources: Nadcap merit process and accreditation intervals, Thermal Processing Magazine; Performance Review Institute, frequently asked questions; Regulation (EU) 2017/625 on official controls, EUR-Lex; Background on the FDA Food Safety Modernization Act, FDA.