"When the auditor says: “The organization has not defined the “type & extent of control” for purchasing. Special processes such as NDE are not controlled for sub–suppliers, there are no documented requirements for such.
Is the auditor looking for a documented procedure and a record of the type and extent of control?”
In my interpretation the auditor is not asking for documented procedures. In my interpretation the auditor is asking for a clear and systematic answer to the questions: Is there any kind of planned control for purchasing? Does your organization control all incoming materials, services and subcontracted processes the same way? For each incoming materials, services and subcontracted processes: What do you control? Who controls? What are the specifications? What are the sampling quantities? Where are results recorded? Do you need to check subcontracted processes? By whom? With what frequency? Where do you record those control activities?
As far as I remember “old” ISO 9001 vocabulary, “special processes”, now in clause 8.5.1 f), need to have some kind of process capacity control. For example, in welding we require welder professional certification, in pasteurization we require temperature and process control. Your organization should require some kind of evidence that special processes such as NDE are done correctly, with people and equipment able to deliver the right results.