A critical PLC module fails. The line is down. Your approved distributor quotes a six-week lead time. You find the part on eBay, ship it overnight, and the line runs again by morning. Then, months later, the auditor asks: "Show me how this purchase was controlled."
This is one of the most common real-world tensions in industrial maintenance, and most teams handle it the same way: buy first, worry about paperwork never. That works right up until an ISO 9001 audit — or until the part turns out to be wrong, and there's no record of the decision that was made.
Here's the good news, and it surprises people: ISO 9001 does not forbid buying from a non-approved supplier in an emergency. What it expects is that the decision was controlled and that you have evidence of that control. As one ISO consultant put it plainly: ISO doesn't expect perfection — it expects controlled decisions with evidence.
Clause 8.4 covers "control of externally provided processes, products and services." It requires you to evaluate, select, monitor and re-evaluate suppliers based on their ability to meet requirements — and to keep documented information of this.
There is no special "emergency exception" clause. But the standard is risk-based, not rigid. A one-time urgent purchase from outside your approved list is acceptable provided you can show you assessed the risk and made a deliberate, authorized decision. The problem is never the purchase. The problem is the silence around it — no note, no risk assessment, no sign-off, nothing for the auditor to see.
Add a sentence to your Purchase Control Procedure such as: "In exceptional or emergency cases, purchases may be made from non-approved suppliers subject to a documented risk assessment, incoming inspection, and management approval." This makes the exception part of your system, not a breach of it.
When an emergency purchase from a non-approved source comes up in an audit, these are the pieces of evidence that turn "you broke the rules" into "you made a controlled decision." None of them needs to be long. They need to exist.
Why the emergency happened, why the approved supplier could not supply in time, and who authorized the deviation. Two or three sentences. This is the "why" the auditor reads first.
A short note on what could go wrong with this part from this source — counterfeit risk, wrong revision, no warranty — and how you are controlling each. This is the heart of Clause 8.4: it shows you thought before you bought.
A full check when the part arrives: part number and revision match, physical condition, functional test where possible. For a part bought sight-unseen on the secondary market, this is your last line of defense before it goes into the machine.
Even for a one-time purchase, note the basic checks: did they deliver on time, was the quality acceptable, was the invoice proper. A few ticked boxes are enough to show the source was evaluated, not chosen blindly.
A sign-off from the QA Manager or Plant Head before the part goes into service. This is the single most important record — it converts an individual's panic purchase into an organizational decision.
Here's the piece most teams miss. For a part bought on eBay or a surplus marketplace, a large part of the risk lives in the listing — the seller's history, whether the photos are reused from other listings, whether the price is suspiciously far from market, whether the part number in the title actually matches the photos.
Capturing that listing evidence at the moment of purchase matters, because listings change or disappear. Three months later, when the auditor asks or a dispute starts, the listing you bought from may be gone. A record made at the time is the only thing that survives.
CT Ultramax reviews an eBay or marketplace listing for reuse, model mismatch, grey-market signals and price anomalies, and helps you produce a Supplier Exception Record that documents the decision — listing review, risk signals and a manager approval trail — before the part goes into service. The verdict is free. The record is the product.
Get a free verdict on a listing →A one-time emergency purchase from a non-approved supplier is not a non-conformity. An undocumented one is. If emergency buying becomes a pattern with no records behind it, an auditor will rightly raise a finding — not because you bought the part, but because you cannot show the decision was controlled.
The five records above are the difference. Keep them short, make them at the time of purchase, and an emergency buy becomes exactly what ISO 9001 wants to see: a controlled decision, backed by evidence.
CT Ultramax reviews marketplace listings, not the physical part, and helps document a supplier-risk decision. It does not authenticate components, certify parts, or guarantee compliance — your quality system and your auditor remain the authority on what your records must contain. This article is general information, not compliance or legal advice.