The risk-based model for supplier management is what I would recommend. Depending on the risk to product, process or QMS should define the level of effort that should be exhorted. For example a high risk supplier that makes a part that goes into a mission critical assembly would be far more than the supplier of office supplies.
Check out some examples in this book that @John Freije and I co-authored. If you have any other questions please reach out to me.
<oembed url="https://asq.org/quality-press/display-item?item=H1509" />