AS9100D, Section 8.4.1

Identifying and managing the risks of externally provided processes, products and services is really a function of the purchasing department, as they are the ones working with these providers to ensure that they deliver on time, give good products and services, meet the requirements, etc. In fact, your purchasing process likely already has this included in one way or another when purchasers are assessing which supplier to buy from. I would suggest this goes into your purchasing process, possibly as training for purchasers.

You can find out more on this procurement requirements in the article: Purchasing in QMS – The Process & the Information Needed to Make it Work, https://advisera.com/9001academy/blog/2014/03/18/purchasing-qms-process-information-needed-make-work/