ISO 9001:2015

Introductory clause. Presents the adoption of a QMS as a strategic choice for the organization, sets out the benefits it can bring, and explains how the standard draws on the process approach, risk-based thinking and the Plan-Do-Check-Act cycle. Not a requirement.

• None: introductory text, not audited

• Treating introductory text as a requirement

Introductory clause. Lists the seven quality management principles on which the standard is built: focus on the customer; leadership; people's engagement; a process-based approach; improvement; decisions grounded in evidence; and managing relationships. Not a requirement.

• None: introductory text, not audited

• Treating introductory text as a requirement

Introductory clause. Introduces the process approach as the way the standard expects a quality management system to be built and run. Not a requirement.

• None: introductory text, not audited

• Treating introductory text as a requirement

Introductory clause. Describes the process approach: treating related processes as one connected system, and understanding and managing them that way, so the organization gets results that are consistent and predictable. Not a requirement.

• None: introductory text, not audited

• Treating introductory text as a requirement

Introductory clause. Describes the PDCA cycle applied to the system as a whole and to each process. Not a requirement.

• None: introductory text, not audited

• Treating introductory text as a requirement

The organization identifies the internal and external issues that bear on its purpose and on its strategic direction, and that influence whether its QMS can deliver the outcomes it is meant to deliver, and it keeps information about those issues under monitoring and review. Such issues may be favourable or unfavourable; outside the organization they may stem from law, technology, competition, markets, culture, society or the economy, and inside it from values, culture, knowledge and performance. Since Amendment 1:2024 the organization must also reach and be able to show a decision on whether climate change is one of those issues for it.

• Documented context analysis (SWOT, PESTLE or equivalent) covering external and internal issues
• Dated climate change decision (relevant or not) with the reasoning, as Amendment 1:2024 requires
• Evidence the issues are monitored and reviewed (management review input, dated updates)
• Link between issues and the system's intended results

• Context written once for certification and never reviewed
• Only external issues considered, internal capability and culture ignored
• No recorded climate change decision since the 2024 amendment, or one with no reasoning
• No traceable link from the issues to the risks and opportunities in 6.1

Since they affect, or could affect, whether the organization can reliably supply products and services that satisfy customer requirements and the laws and regulations that apply, the organization identifies which interested parties matter to its QMS and what their relevant requirements are, and keeps information about those parties and requirements under monitoring and review. Amendment 1:2024 adds a note that such parties may hold climate-related requirements, for example customer carbon or supply-continuity conditions or regulator rules.

• Interested party register with relevant requirements per party
• Register entries for climate-related requirements identified, or a recorded finding that none apply
• Evidence of monitoring and review
• Records of how requirements were determined (customer contracts, regulator communications)

• Interested parties listed without their requirements
• Regulators and end users omitted where the customer is a distributor
• Never reviewed after first issue

The organization sets the scope of its QMS by deciding where the system's boundaries lie and what it applies to, taking into account the issues from 4.1, the requirements of the relevant interested parties from 4.2, and its own products and services. Every requirement of the standard that can apply inside that scope is applied. A requirement may be treated as not applicable only with a justification, and only where leaving it out does not reduce the organization's capability or responsibility for making products and services conform and for raising customer satisfaction. The scope is kept as documented information that names the products and services it covers and justifies each requirement judged not applicable.

• Documented scope statement naming products, services and locations
• Justification for each requirement claimed not applicable
• Consistency between the scope and the certificate

• Non-applicability claimed for design and development where design is in fact performed
• Scope names sites but not the products and services
• Justification for exclusions missing

The organization sets up, operates, keeps up to date and continually improves its QMS, together with the processes the system needs and the way they interact. For each process, and for its use across the organization, it settles the inputs needed and outputs expected, the order in which processes run and how they connect, the criteria and methods (measures and performance indicators included) that make operation and control effective, the resources required, who holds responsibility and authority, which risks and opportunities are being addressed, how the process is evaluated and changed so it achieves what is intended, and how processes and the system are improved. Documented information is kept to support how processes run, and retained to give confidence they ran as planned.

• Process map showing sequence and interaction
• Process definitions with inputs, outputs, criteria, indicators, resources and owners
• Process performance indicators and results
• Records demonstrating processes carried out as planned

• Processes listed but interactions and criteria undefined
• No performance indicators at process level
• Process owners not assigned

The organization identifies and chooses opportunities to improve and carries out the actions needed to satisfy customer requirements and raise customer satisfaction. These include: improving products and services so they meet requirements and anticipate future needs and expectations; correcting, preventing or reducing unwanted effects; and making the QMS perform better and more effectively. Improvement may take the form of correction or corrective action, continual improvement, innovation, breakthrough change or reorganization.

• Improvement register with sources and selected actions
• Evidence of product and service improvements
• Evidence of system performance improvements

• Improvement means corrective action only
• Future customer needs never considered

Whenever a nonconformity arises, complaints included, the organization responds to it: as applicable it acts to control and correct it and deals with what follows from it. It then judges whether action is needed to remove the causes, so the nonconformity does not happen again or somewhere else, by reviewing and analysing it, finding its causes, and finding out whether similar nonconformities exist or could arise. It carries out any action needed, reviews whether corrective action worked, updates the risks and opportunities identified during planning where necessary, and changes the QMS where necessary. Corrective action must suit the effects of the nonconformity in question. Documented information is retained on what the nonconformities were, what was done, and what corrective action achieved.

• Nonconformity and complaint records with root cause analysis
• Corrective action records with effectiveness review
• Evidence of checks for similar nonconformities elsewhere
• Updates to the risk register and system arising from nonconformities

• Correction recorded as corrective action
• Root cause analysis superficial
• Effectiveness never reviewed

The organization keeps improving how suitable, adequate and effective its QMS is. It uses what analysis and evaluation show, together with what management review decides, to find out whether there are needs or opportunities that continual improvement should take up.

• Improvement actions traced to analysis results and management review outputs
• Performance trends demonstrating improvement
• Records of improvement projects and their results

• Improvement actions not linked to any analysis
• No evidence the system itself has improved over the cycle

Top management shows leadership and commitment in two areas: towards the QMS as a whole (5.1.1) and towards customer focus (5.1.2).

• See the sub-clauses beneath this heading

• Treating the heading as a requirement separate from its sub-clauses

Top management shows leadership and commitment towards the QMS by: being accountable for how effective the system is; making sure the quality policy and objectives are set and fit the organization's context and strategic direction; embedding what the system requires in the way the business actually runs; encouraging risk-based thinking and working by processes; making sure resources are there; explaining why effective quality management matters and why the system's requirements must be met; making sure the system delivers what it is meant to; engaging, directing and supporting people so they add to its effectiveness; promoting improvement; and helping other managers in relevant roles show leadership where they are responsible.

• Management review minutes with top management participation
• Business planning showing quality objectives integrated
• Resource decisions traceable to system needs
• Communications from top management on quality

• Leadership delegated entirely to a quality manager
• Quality objectives disconnected from business objectives
• Process approach and risk-based thinking not visible in management decisions

Top management shows leadership and commitment on customer focus by making sure that: customer requirements, and the laws and regulations that apply, are identified, understood and met every time; the risks and opportunities that could affect whether products and services conform, or whether customer satisfaction can be raised, are identified and dealt with; and the organization keeps its attention on raising customer satisfaction.

• Evidence customer and regulatory requirements are captured and met (contract review, compliance records)
• Risks and opportunities affecting product conformity and customer satisfaction identified
• Customer satisfaction data reviewed by top management

• Customer requirements captured by sales but not visible to top management
• Regulatory requirements for the product not determined
• Customer satisfaction measured but not acted on

Top management establishes a quality policy (5.2.1) and communicates it (5.2.2).

• See the sub-clauses beneath this heading

• Treating the heading as a requirement separate from its sub-clauses

Top management sets, puts into effect and keeps up to date a quality policy that fits the organization's purpose and context and backs its strategic direction; that gives a basis on which quality objectives can be set; that commits the organization to meeting the requirements that apply to it; and that commits it to improving the QMS continually.

• Approved quality policy carrying both commitments
• Evidence of alignment with strategic direction
• Review and re-approval records

• Generic policy that could belong to any organization
• Commitment to satisfy applicable requirements missing
• Policy not reviewed since issue

The quality policy is kept as documented information and maintained; it is made known inside the organization so that people understand it and act on it, and it is made available to relevant interested parties where appropriate.

• Controlled policy document
• Communication records (induction, noticeboards, intranet)
• Interview evidence that staff understand and apply it
• Availability to interested parties where relevant

• Policy displayed but staff cannot relate it to their work
• Not available to customers or suppliers who ask for it

Top management makes sure that the responsibilities and authorities of relevant roles are allocated, made known and understood across the organization. This includes allocating who is responsible and has authority for: keeping the QMS in conformity with the standard; making sure processes produce the outputs intended for them; reporting to top management on how the system performs and where it could improve; promoting customer focus throughout the organization; and keeping the system intact while changes to it are planned and made.

• Organization chart and responsibility matrix
• Job descriptions with quality responsibilities
• Named authority for system conformity and performance reporting
• Evidence responsibilities are understood (interviews, sign-off)

• Responsibilities assigned but not communicated or understood
• No one accountable for system integrity during change
• Reporting to top management undefined

The organization plans, carries out and controls the processes required to meet the requirements for supplying its products and services and to put into effect the actions from clause 6. It does so by identifying the requirements for those products and services; setting criteria both for the processes and for accepting the products and services; identifying the resources required to make them conform; controlling the processes against the criteria; and identifying, keeping and retaining the documented information needed to show conformity and to give confidence the processes ran as planned. The planning output must suit how the organization operates. Planned changes are controlled, the consequences of unplanned changes are reviewed, and outsourced processes are kept under control.

• Quality plans or process control plans with criteria and acceptance criteria
• Records demonstrating processes carried out as planned
• Change control records for operational changes
• Evidence of control over outsourced processes

• Acceptance criteria undefined
• Operational changes made without review of consequences
• Outsourced processes treated as out of scope

Heading for customer communication (8.2.1), setting what products and services must satisfy (8.2.2), reviewing those requirements (8.2.3) and controlling changes to them (8.2.4).

• See the sub-clauses beneath this heading

• Treating the heading as a requirement separate from its sub-clauses

The organization's communication with customers covers: giving information about its products and services; dealing with enquiries, contracts and orders, including changes to them; collecting customer feedback on its products and services, complaints included; handling or controlling property that belongs to customers; and, where relevant, agreeing specific requirements for contingency actions.

• Product information provided to customers (catalogues, specifications)
• Enquiry, order and change handling records
• Complaint and feedback handling records
• Contingency arrangements agreed with customers where relevant

• Complaints handled informally with no record
• Customer property arrangements not communicated
• Contingency actions never discussed with customers

In setting what is required of the products and services it will offer customers, the organization makes sure those requirements are defined, covering the laws and regulations that apply and anything it considers necessary itself, and that it is able to back up the claims it makes about what it offers.

• Product and service specifications including regulatory requirements
• Evidence that claims made in marketing can be met
• Regulatory requirement register per product line

• Statutory and regulatory requirements for the product not identified
• Marketing claims not verified against capability

The organization makes sure it is able to satisfy what is required of the products and services it plans to offer, and reviews them before it commits to supply. The review covers: what the customer specifies, including delivery and post-delivery activity; requirements the customer has not stated but which the specified or intended use makes necessary; the organization's own requirements; the laws and regulations that apply; and any requirement in a contract or order that differs from one expressed earlier. Any such differences are resolved, and where the customer gives no documented statement of requirements, the organization confirms them before accepting. Documented information on the review's outcome and on any new requirements is retained.

• Contract or order review records before commitment
• Resolution records for differences between quote and order
• Confirmation of verbal orders
• Review covering delivery and post-delivery requirements

• Orders accepted without review of capability
• Differences between quotation and order not resolved
• Verbal orders not confirmed

Whenever requirements for products and services change, the organization makes sure the documented information affected is updated and that the people concerned learn of the new requirements.

• Change records for customer requirement changes
• Amended specifications, orders and work instructions
• Evidence of communication to affected persons

• Changes agreed with the customer by phone and never recorded
• Production not told of a specification change

The organization establishes a design and development process (8.3.1) covering planning (8.3.2), inputs (8.3.3), controls (8.3.4), outputs (8.3.5) and changes (8.3.6).

• See the sub-clauses beneath this heading

• Treating the heading as a requirement separate from its sub-clauses

The organization sets up, operates and keeps up to date a process for design and development that is suited to making sure products and services can then be supplied.

• Documented design and development process
• Evidence the process is applied to new products and services
• Justification where design is claimed not applicable

• Design performed informally outside any process
• Non-applicability claimed while product specifications are in fact developed

When deciding the stages of design and development and how they are controlled, the organization takes into account: what the design work involves, how long it will take and how complex it is; which process stages are needed, reviews included; what verification and validation are needed; who holds responsibility and authority; the internal and external resources required; how to control the interfaces between the people taking part; whether customers and users need to be involved; what later supply of the products and services will require; how much control customers and other interested parties expect over the design process; and what documented information is needed to show the design requirements were met.

• Design and development plans with stages, reviews, verification and validation points
• Responsibility assignments and interface controls
• Evidence of customer and user involvement where planned
• Resource plans for design

• Plans without verification and validation stages
• Interfaces between design groups uncontrolled
• Customer involvement not planned

For each kind of product or service being designed and developed, the organization identifies the requirements that are essential, taking into account: functional and performance requirements; what was learned from earlier, comparable design work; the laws and regulations that apply; the standards or codes of practice it has committed to implement; and what could go wrong, given the nature of the product or service, if it failed. The inputs must be adequate for design, complete and free of ambiguity; any inputs that conflict are resolved, and documented information on the inputs is retained.

• Design input records covering functional, performance, regulatory and standards requirements
• Evidence of lessons from previous designs considered
• Resolution of conflicting inputs
• Consideration of failure consequences (risk analysis)

• Inputs limited to the customer brief
• Regulatory and standards requirements not captured at input
• Conflicts between inputs discovered late

The organization controls its design and development process so that: the results sought are defined; reviews are held to judge whether the results can satisfy requirements; verification is done to confirm the outputs satisfy the input requirements; validation is done to confirm the products and services that result are fit for their specified application or intended use; the problems that reviews, verification and validation reveal are acted on; and documented information on all of this is retained.

• Design review records with participants and decisions
• Verification records (outputs against inputs)
• Validation records (product against intended use)
• Actions on problems found and their closure

• Verification and validation conflated
• Problems from reviews not tracked to closure
• Validation performed after release to the customer

The organization makes sure that what design and development produces satisfies the input requirements; is sufficient for the later processes that supply the products and services; contains or refers to acceptance criteria and, where appropriate, monitoring and measuring requirements; and states which characteristics of the products and services are essential to their purpose and to supplying them safely and properly. Documented information on the outputs is retained.

• Design output documents (drawings, specifications, formulations, service designs)
• Traceability from outputs to inputs
• Acceptance criteria and monitoring requirements included
• Essential characteristics for safe and proper provision identified

• Outputs not traceable to inputs
• Acceptance criteria missing from specifications
• Characteristics critical to safety not flagged

The organization identifies, reviews and controls changes made to products and services while they are being designed and developed or afterwards, as far as needed to keep conformity to requirements from being harmed. It retains documented information on each change, on what the reviews found, on who authorized the change, and on the actions taken to avoid harm to conformity.

• Design change records with review, authorization and impact assessment
• Evidence of actions to prevent adverse impact
• Configuration or revision control on design documents

• Changes made after release without review
• Authorization of changes not recorded
• Impact on products already delivered not assessed

The organization makes sure that what external providers supply (processes, products and services) meets requirements (8.4.1), decides what kind of control to apply and how much (8.4.2), and tells external providers what it requires of them (8.4.3).

• See the sub-clauses beneath this heading

• Treating the heading as a requirement separate from its sub-clauses

The organization makes sure that what external providers supply (processes, products and services) meets requirements. It decides what controls to apply in three cases: where an external provider's products and services will be built into the organization's own; where an external provider supplies products and services straight to customers on the organization's behalf; and where the organization has decided to have an external provider perform a process. It sets and uses criteria for evaluating, selecting, monitoring the performance of and re-evaluating external providers, according to how well they can supply what is required, and it retains documented information on this work and on any resulting actions.

• Supplier evaluation and selection criteria
• Approved supplier list with evaluation records
• Supplier performance monitoring and re-evaluation records
• Actions arising from supplier evaluation

• Suppliers selected on price only
• Performance monitored but never re-evaluated
• Outsourced processes not treated as external provision

The organization makes sure that what external providers supply (processes, products and services) does not undermine its capacity to deliver conforming products and services to customers reliably. To that end it keeps outsourced processes under the control of its QMS; defines both the controls it will apply to the provider and those it will apply to what the provider delivers; takes into account how the external supply could affect its ability to meet customer, legal and regulatory requirements reliably, and how effective the provider's own controls are; and decides what verification or other activity is needed to confirm that what is supplied meets requirements.

• Defined controls per supplier or category (inspection, certificates, audits)
• Risk-based rationale for the extent of control
• Receiving inspection or verification records
• Supplier audit records where applied

• Same control applied to every supplier regardless of impact
• Certificates of conformity accepted without any verification
• Effectiveness of the supplier's own controls not assessed

Before it passes requirements to an external provider, the organization makes sure they are adequate. It tells the provider its requirements on: what processes, products and services are to be supplied; how products and services, methods, processes and equipment are approved, and how products and services are released; competence, including any qualification staff need; how the provider will interact with the organization; how the organization will control and monitor the provider's performance; and any verification or validation that the organization, or its customer, plans to carry out on the provider's premises.

• Purchase orders, specifications and contracts stating requirements
• Approval and release requirements communicated
• Competence requirements for supplier personnel where relevant
• Notification of monitoring and verification activities

• Purchase orders carry a part number and nothing else
• Approval and release requirements not communicated
• Supplier not told of planned verification at its premises

Heading for the organization's control of: production and service provision (8.5.1); identification and traceability (8.5.2); property owned by customers or external providers (8.5.3); preservation (8.5.4); post-delivery activities (8.5.5); and changes (8.5.6).

• See the sub-clauses beneath this heading

• Treating the heading as a requirement separate from its sub-clauses

Production and service provision are carried out under conditions the organization keeps controlled. Where they apply, these include: documented information that defines the characteristics of the products, services or activities and the results to be reached; monitoring and measuring resources that are suitable, available and used; monitoring and measurement at the right stages to confirm that criteria are met; suitable infrastructure and a suitable working environment; competent people, holding any qualification required; validating, and revalidating at intervals, any process whose output cannot be checked afterwards by monitoring or measurement, to confirm it can reach planned results; measures that guard against human error; and carrying out release, delivery and post-delivery activities.

• Work instructions and specifications at the point of use
• In-process monitoring and measurement records
• Validation records for special processes (welding, sterilisation, software deployment)
• Human error prevention measures (poka-yoke, checklists)

• Special processes not validated
• Monitoring stages undefined
• No measures against human error

Where needed to make products and services conform, the organization uses suitable means to identify its outputs. Throughout production and service provision it marks where each output stands against the monitoring and measurement requirements. Where traceability is required, it controls the unique identification of outputs and retains the documented information that makes tracing possible.

• Identification methods (labels, batch numbers, job numbers)
• Inspection status indication
• Traceability records where required (batch to material, serial to component)
• Traceability exercise results

• Inspection status not visible on the shop floor
• Traceability required by the customer but not achievable in practice

The organization takes care of property owned by customers or external providers while that property is in its control or in use by it. It identifies, verifies, protects and safeguards property supplied for its use or for building into products and services. If such property is lost or damaged, or turns out to be unsuitable, the organization tells the owner (the customer or the external provider) and retains documented information on what happened. Such property may be materials or components, premises, tools and equipment, personal data, or intellectual property.

• Register of customer and supplier property including intellectual property and personal data
• Verification on receipt and protection arrangements
• Reports to owners of loss or damage with records

• Personal data and intellectual property not recognised as customer property
• Loss or damage handled without notifying the owner

While production and service provision are under way, the organization protects its outputs as far as needed to keep them conforming. Preservation may cover identification, handling, control of contamination, packaging, storage, transmission or transport, and protection.

• Handling, storage and packaging requirements per product
• Storage condition monitoring where relevant (temperature, humidity, shelf life)
• Shelf-life and stock rotation controls
• Transport and transmission protections

• Shelf-life items used past expiry
• Storage conditions not monitored
• Data outputs not protected in transmission

The organization fulfils what is required of it after delivery of its products and services. In deciding how far those post-delivery activities go, it takes into account the laws and regulations that apply, any unwanted consequences its products and services could have, what they are, how they are used and how long they are meant to last, what customers require, and customer feedback. Examples of post-delivery activity are warranty commitments, contractual duties such as maintenance, and extra services such as recycling or end-of-life disposal.

• Warranty, maintenance and support arrangements
• Post-delivery obligations identified per product or contract
• Customer feedback used to shape post-delivery activities
• Recall or field action procedures where consequences warrant

• Post-delivery obligations not identified at contract review
• No recall capability for products with safety consequences

The organization reviews and controls changes to production or service provision as far as needed to keep conformity to requirements intact. It retains documented information recording what the review of each change found, who authorized the change, and any actions the review showed to be needed.

• Production and service change records with review, authorization and actions
• Evidence of impact assessment before implementation
• Communication of changes to affected persons

• Process changes made by operators without review
• Authorization not recorded
• Actions arising from the review not tracked

At suitable stages the organization carries out the arrangements it has planned for checking that products and services meet their requirements. Products and services are released to the customer only once those arrangements are satisfactorily complete, unless a relevant authority, and the customer where applicable, approves otherwise. Documented information on release is retained, showing that the acceptance criteria were met and identifying who authorized the release.

• Final inspection and test records against acceptance criteria
• Release authorization with named person
• Concession or waiver records where release proceeded before completion
• Traceability from release record to authorizer

• Release records without reference to acceptance criteria
• Authorizer not identifiable
• Early release without documented approval

The organization makes sure that any output failing to meet its requirements is identified and controlled so that it is not used or delivered by mistake. It acts on the nonconformity in proportion to what the nonconformity is and how it affects whether products and services conform, and this applies also to outputs found to be nonconforming after delivery. Possible actions include: correcting the output; segregating or containing it; returning it or suspending supply; informing the customer; and getting authorization to accept it under concession. When a nonconforming output is corrected, its conformity is verified again. Documented information is retained that describes the nonconformity, what was done about it, any concession obtained, and who decided the action.

• Nonconformity records with description, disposition, concession and deciding authority
• Segregation and identification of nonconforming product
• Re-verification records after correction
• Handling of nonconformities found after delivery

• Nonconforming product not segregated
• Concessions granted without customer authorization where required
• Re-verification after rework not recorded

The organization determines what to monitor and measure and evaluates the system (9.1.1), monitors customer satisfaction (9.1.2) and analyses and evaluates data (9.1.3).

• See the sub-clauses beneath this heading

• Treating the heading as a requirement separate from its sub-clauses

The organization decides what it will monitor and measure; which methods of monitoring, measurement, analysis and evaluation it will use so the results can be relied on; when monitoring and measurement take place; and when the results are analysed and evaluated. It evaluates how the QMS is performing and how effective it is, and retains suitable documented information showing those results.

• Monitoring and measurement plan with methods and frequencies
• Performance results at process and system level
• Records of analysis and evaluation
• Evidence of system effectiveness evaluation

• Measurement limited to final inspection
• Methods undefined so results are not comparable
• System effectiveness never evaluated

The organization monitors how customers perceive the extent to which their needs and expectations are being met, and decides how that information is gathered, monitored and reviewed. Possible sources include surveys and meetings with customers, feedback on products and services delivered, analysis of market share, compliments, warranty claims and reports from dealers.

• Defined method for monitoring customer perception
• Survey, feedback and complaint data
• Review records and actions taken
• Trend analysis over time

• Complaints counted as the only satisfaction measure
• Data collected but never reviewed or acted on

The organization analyses and evaluates the relevant data and information that monitoring and measurement produce, and uses what it learns to judge: whether products and services conform; how satisfied customers are; how the QMS is performing and how effective it is; whether planning was put into effect well; how effective the actions on risks and opportunities have been; how external providers are performing; and whether the system needs improving. Statistical techniques are among the methods that may be used.

• Analysis reports covering each required topic
• Statistical or trend analysis where appropriate
• Evidence results feed management review and improvement

• Data collected but not analysed
• Supplier performance and risk-action effectiveness missing from the analysis

At planned intervals the organization carries out internal audits that tell it whether its QMS meets both its own requirements and those of the standard, and whether the system is effectively implemented and maintained. It plans, sets up, runs and maintains an audit programme that fixes how often audits happen, the methods and responsibilities, what planning must cover, and how results are reported, weighted by how important each process is, by changes that affect the organization and by what earlier audits found. For each audit it sets criteria and scope; it chooses auditors and runs audits so that they are objective and impartial; it makes sure results reach the relevant managers; it takes suitable correction and corrective action promptly; and it retains documented information showing the programme was carried out and what it found.

• Audit programme weighted by process importance, change and previous results
• Audit plans with criteria and scope
• Audit reports and findings
• Auditor independence and competence records
• Corrective actions from audit findings and their timeliness

• Same audit programme every year regardless of results
• Auditors auditing their own work
• Findings open for months without action

Top management reviews the quality management system at planned intervals (9.3.1) using defined inputs (9.3.2) and producing defined outputs (9.3.3).

• See the sub-clauses beneath this heading

• Treating the heading as a requirement separate from its sub-clauses

At planned intervals top management reviews the QMS to confirm that it remains suitable, adequate and effective and that it stays aligned with where the organization is heading strategically.

• Management review schedule and records of reviews held
• Attendance showing top management participation
• Evidence of alignment with strategic direction considered

• Review held only when the certification audit is due
• Top management absent, review delegated to the quality function

Management review is planned and held with attention to: how actions from earlier reviews stand; changes in the internal and external issues that bear on the system; information on how the system is performing and how effective it is, including trends in customer satisfaction and in feedback from relevant interested parties, how far the quality objectives have been achieved, how processes are performing and whether products and services conform, nonconformities and corrective actions, results of monitoring and measurement, audit results, and how external providers are performing; whether resources are adequate; how effective the actions on risks and opportunities have been; and where improvement is possible.

• Management review agenda covering every required input
• Input data pack (performance trends, audit results, supplier performance, risk action effectiveness)
• Status of previous actions

• Inputs missing (typically supplier performance, risk action effectiveness or resource adequacy)
• Data presented without trends

Management review produces decisions and actions on opportunities to improve, on whether the QMS needs changing, and on the resources required. Documented information is retained as evidence of what each review concluded.

• Minutes recording decisions and actions with owners and dates
• Resource decisions
• Evidence outputs are tracked to completion

• Minutes record discussion but no decisions
• Actions without owners or dates
• Resource needs raised but no decision recorded

When it plans its QMS, the organization takes into account the issues from 4.1 and the requirements from 4.2 and identifies the risks and opportunities it needs to address so that it can be confident the system will achieve what it is meant to, strengthen wanted effects, prevent or lessen unwanted ones, and bring about improvement. It plans the actions it will take on those risks and opportunities, how it will build them into and carry them out through the system's processes, and how it will judge whether they worked. The actions must be in proportion to how much the risk or opportunity could affect whether products and services conform.

• Risk and opportunity register with planned actions and owners
• Evidence of integration into processes
• Effectiveness evaluation of actions taken
• Proportionality of actions to product impact

• Risks listed with no actions
• Opportunities never identified
• Effectiveness of actions not evaluated

The organization sets quality objectives for the functions, levels and processes of its QMS where they are relevant. The objectives must fit the quality policy, be measurable, take the applicable requirements into account, bear on product and service conformity and on raising customer satisfaction, be monitored, be communicated, be updated where appropriate, and be kept as documented information. In planning how to reach them, the organization decides what is to be done, what resources it will take, who is responsible, the completion date, and how the results will be evaluated.

• Documented quality objectives with measures and targets at relevant levels
• Plans per objective with actions, resources, owners, dates and evaluation method
• Monitoring results and communication records

• Objectives not measurable
• Objectives set at company level only, never at process level
• No plan for achieving them

Where the organization decides its QMS needs to change, it makes the change in a planned way, taking into account why the change is being made and what it could lead to, whether the system stays intact, whether resources are available, and how responsibilities and authorities are allocated or reallocated.

• Change plans or records for system changes showing purpose, consequences, resources and responsibilities
• Evidence system integrity was considered (impact assessment)
• Management review records of changes

• System changes made without a plan
• Consequences of change not assessed
• Responsibilities not reallocated after restructuring

Determine and select opportunities for improvement and implement necessary actions to enhance customer satisfaction.

• Improvement register
• Project records
• Benefit tracking

• No improvement pipeline
• Benefits not tracked

React to nonconformities, evaluate the need for action to eliminate causes, and review effectiveness of corrective actions.

• CAPA records
• Root cause analyses
• Effectiveness reviews

• Symptoms fixed, causes not addressed
• Effectiveness not verified

Continually improve the suitability, adequacy, and effectiveness of the QMS using analysis results and management review outputs.

• Improvement plan
• Trend analyses
• Review outputs

• Improvement plan not data-driven
• No trend over time

Determine external and internal issues relevant to the purpose of the organisation and its strategic direction, and how they affect the QMS.

• PESTLE or SWOT records
• Strategic plan extracts
• Context review minutes

• Context never refreshed
• No link to risk register

Identify interested parties relevant to the QMS, their requirements, and how these are monitored and reviewed.

• Stakeholder register
• Requirements log
• Review records

• Regulators omitted
• No periodic refresh

Determine and document the boundaries and applicability of the QMS, including any non-applicable clauses with justification.

• Scope statement
• Exclusion justifications
• Site list

• Scope too broad to be auditable
• Exclusions without justification

Establish, implement, maintain, and improve a QMS including the processes needed and their interactions.

• Process landscape
• Process descriptions
• Interaction diagrams

• No interaction view
• Process owners unnamed

Top management demonstrates leadership and commitment to the QMS and to customer focus.

• Management review minutes
• Communications from top management
• Customer focus statements

• Leadership invisible to staff
• Customer focus reduced to slogans

Establish, communicate, and maintain a quality policy appropriate to the purpose and context of the organisation.

• Approved quality policy
• Communication evidence
• Awareness training records

• Policy unsigned or undated
• Staff unaware of policy

Assign and communicate responsibilities and authorities for relevant roles within the QMS.

• Role descriptions
• Org chart
• RACI matrix

• No QMS process owners
• Authority conflicts unresolved

Plan actions to address QMS risks and opportunities, integrate them into processes, and evaluate effectiveness.

• Risk register
• Action plans
• Effectiveness reviews

• Risks listed but not actioned
• No effectiveness evaluation

Establish measurable quality objectives at relevant functions and levels, with plans to achieve them.

• Objective catalogue
• KPI definitions
• Action plans

• Objectives not measurable
• No owners or due dates

Determine and provide the resources needed for the QMS including people, infrastructure, environment, and monitoring resources.

• Resource plans
• Asset registers
• Calibration records

• Calibration overdue
• Resource gaps not escalated

Determine required competence, ensure persons are competent, and take action to acquire competence where needed.

• Competence matrix
• Training records
• Effectiveness evaluations

• Training delivered without effectiveness check
• Competence gaps unaddressed

Maintain and retain documented information required by the standard and by the QMS, with proper control.

• Document control procedure
• Master document list
• Retention schedule

• Uncontrolled copies in circulation
• Retention not enforced

Plan, implement, and control processes needed to meet product and service requirements.

• Operational plans
• Process controls
• Change records

• Outsourced processes not controlled
• Plans not updated for changes

Determine, review, and communicate requirements for products and services with customers and other parties.

• Contract reviews
• Requirements records
• Communication logs

• Verbal commitments not captured
• Changes not re-reviewed

Establish, implement, and maintain a design and development process appropriate to the products and services.

• Design plans
• Verification and validation records
• Design change records

• Verification skipped
• Design changes uncontrolled

Control external providers and the products, services, and processes they provide to ensure conformity.

• Approved supplier list
• Evaluation records
• Incoming inspection records

• Approval lapses
• No performance monitoring

Implement controlled conditions for production and service provision including identification, traceability, and preservation.

• Work instructions
• Traceability records
• Preservation procedures

• Traceability breaks at handover
• Preservation not specified

Implement planned arrangements to verify product and service requirements have been met before release.

• Release records
• Acceptance criteria
• Authorisation signatures

• Release without verification
• Authoriser not documented

Identify and control nonconforming outputs to prevent unintended use or delivery, and act on the nature of the nonconformity.

• NC register
• Disposition records
• Customer notifications

• Customer not informed
• Disposition not recorded

Monitor, measure, analyse, and evaluate the QMS, including customer satisfaction.

• KPI dashboards
• Customer satisfaction surveys
• Analysis reports

• Data collected but not analysed
• Customer voice missing

Conduct internal audits at planned intervals to determine QMS conformity and effectiveness.

• Audit programme
• Audit reports
• Auditor competence records

• Programme covers only some clauses
• Auditors not independent

Top management reviews the QMS at planned intervals to ensure its continuing suitability, adequacy, effectiveness, and alignment with strategic direction.

• Management review inputs
• Minutes
• Action register

• Reviews skipped
• Required inputs missing

Quality policy and objectives. Control from ISO 9001 framework, domain: ISO 9001: Leadership & Planning.

• Quality policy
• Quality objectives
• Risk register
• Resource plan

• Policy not communicated
• Objectives not SMART
• Risk not integrated
• Resources misaligned

Leadership commitment to quality. Control from ISO 9001 framework, domain: ISO 9001: Leadership & Planning.

• Quality policy
• Quality objectives
• Risk register
• Resource plan

• Policy not communicated
• Objectives not SMART
• Risk not integrated
• Resources misaligned

Risk-based thinking and planning. Control from ISO 9001 framework, domain: ISO 9001: Leadership & Planning.

• Quality policy
• Quality objectives
• Risk register
• Resource plan

• Policy not communicated
• Objectives not SMART
• Risk not integrated
• Resources misaligned

Resource management for quality. Control from ISO 9001 framework, domain: ISO 9001: Leadership & Planning.

• Quality policy
• Quality objectives
• Risk register
• Resource plan

• Policy not communicated
• Objectives not SMART
• Risk not integrated
• Resources misaligned

Organizational roles and responsibilities. Control from ISO 9001 framework, domain: ISO 9001: Leadership & Planning.

• Quality policy
• Quality objectives
• Risk register
• Resource plan

• Policy not communicated
• Objectives not SMART
• Risk not integrated
• Resources misaligned

Operational planning and control. Control from ISO 9001 framework, domain: ISO 9001: Operational Controls.

• Operating procedures
• Design control records
• Supplier evaluation
• Production records

• Undocumented operations
• Design changes uncontrolled
• Weak supplier oversight
• No traceability

Requirements for products and services. Control from ISO 9001 framework, domain: ISO 9001: Operational Controls.

• Operating procedures
• Design control records
• Supplier evaluation
• Production records

• Undocumented operations
• Design changes uncontrolled
• Weak supplier oversight
• No traceability

Design and development controls. Control from ISO 9001 framework, domain: ISO 9001: Operational Controls.

• Operating procedures
• Design control records
• Supplier evaluation
• Production records

• Undocumented operations
• Design changes uncontrolled
• Weak supplier oversight
• No traceability

Control of externally provided processes. Control from ISO 9001 framework, domain: ISO 9001: Operational Controls.

• Operating procedures
• Design control records
• Supplier evaluation
• Production records

• Undocumented operations
• Design changes uncontrolled
• Weak supplier oversight
• No traceability

Production and service provision controls. Control from ISO 9001 framework, domain: ISO 9001: Operational Controls.

• Operating procedures
• Design control records
• Supplier evaluation
• Production records

• Undocumented operations
• Design changes uncontrolled
• Weak supplier oversight
• No traceability

Monitoring, measurement, and analysis. Control from ISO 9001 framework, domain: ISO 9001: Performance Evaluation.

• Audit program
• Management review records
• Customer satisfaction survey
• NC report

• Audit gaps
• Reviews not actioned
• Survey results ignored
• NC not analyzed

Internal audit program. Control from ISO 9001 framework, domain: ISO 9001: Performance Evaluation.

• Audit program
• Management review records
• Customer satisfaction survey
• NC report

• Audit gaps
• Reviews not actioned
• Survey results ignored
• NC not analyzed

Management review process. Control from ISO 9001 framework, domain: ISO 9001: Performance Evaluation.

• Audit program
• Management review records
• Customer satisfaction survey
• NC report

• Audit gaps
• Reviews not actioned
• Survey results ignored
• NC not analyzed

Customer satisfaction measurement. Control from ISO 9001 framework, domain: ISO 9001: Performance Evaluation.

• Audit program
• Management review records
• Customer satisfaction survey
• NC report

• Audit gaps
• Reviews not actioned
• Survey results ignored
• NC not analyzed

Nonconformity and corrective action. Control from ISO 9001 framework, domain: ISO 9001: Performance Evaluation.

• Audit program
• Management review records
• Customer satisfaction survey
• NC report

• Audit gaps
• Reviews not actioned
• Survey results ignored
• NC not analyzed

Continual improvement methodology. Control from ISO 9001 framework, domain: ISO 9001: Improvement.

• Improvement plan
• CAPA register
• Change control records
• Lessons learned log

• Improvement reactive
• Root cause shallow
• Changes not validated
• Lessons not shared

Corrective and preventive actions. Control from ISO 9001 framework, domain: ISO 9001: Improvement.

• Improvement plan
• CAPA register
• Change control records
• Lessons learned log

• Improvement reactive
• Root cause shallow
• Changes not validated
• Lessons not shared

Innovation and change management. Control from ISO 9001 framework, domain: ISO 9001: Improvement.

• Improvement plan
• CAPA register
• Change control records
• Lessons learned log

• Improvement reactive
• Root cause shallow
• Changes not validated
• Lessons not shared

The organization identifies and provides what its QMS needs by way of resources: in general (7.1.1), people (7.1.2), infrastructure (7.1.3), the environment in which processes run (7.1.4), monitoring and measuring resources (7.1.5) and organizational knowledge (7.1.6).

• See the sub-clauses beneath this heading

• Treating the heading as a requirement separate from its sub-clauses

The organization identifies and provides the resources it needs to set up, operate, keep up to date and continually improve its QMS, taking into account what its existing internal resources can and cannot do and what it has to obtain from external providers.

• Resource planning records (budgets, headcount, capacity)
• Evidence of consideration of internal constraints and external provision
• Management review resource decisions

• Resource needs raised but decisions not recorded
• External resource needs not identified

The organization identifies and provides the people it needs to implement its QMS effectively and to run and control its processes.

• Staffing plans against process needs
• Evidence of recruitment or reallocation where gaps were identified
• Capacity reviews

• Process staffing not planned, gaps discovered at audit
• Key roles held by one person with no cover

The organization identifies, provides and maintains the infrastructure its processes need to run and to make products and services conform. Infrastructure may cover buildings and utilities, equipment (hardware and software included), transport resources, and information and communication technology.

• Infrastructure inventory with maintenance requirements
• Preventive maintenance schedules and records
• IT and software maintenance and support records

• Maintenance reactive only
• Software and IT infrastructure excluded from the maintenance programme

The organization identifies, provides and maintains the environment its processes need to run and to make products and services conform. A suitable environment may combine human and physical factors: social ones (a calm, non-discriminatory, non-confrontational setting), psychological ones (reducing stress, preventing burnout, protecting people emotionally) and physical ones (for example temperature and heat, humidity, lighting, airflow, hygiene and noise).

• Determination of environmental requirements per process (cleanroom, temperature, ergonomics)
• Monitoring records where the environment affects conformity
• Evidence human factors are considered

• Only physical factors considered
• Environmental requirements for product conformity not defined
• Monitoring absent where the product is sensitive to environment

Where monitoring or measurement is used to check that products and services conform, the organization identifies and provides the resources needed for results to be valid and reliable. It makes sure those resources suit the kind of monitoring and measurement done and are maintained so they stay fit for purpose, and it retains documented information as evidence that they are. Where traceability of measurement is required, or the organization judges it essential to confidence in the results, measuring equipment is: calibrated or verified, or both, at set intervals or before use, against standards traceable to international or national ones (and where none exist, the basis used is recorded); identified so its status is known; and protected from adjustment, damage or deterioration that would make its calibration status or later results invalid. If equipment proves unfit for its purpose, the

• Register of monitoring and measuring equipment with calibration status
• Calibration certificates traceable to national standards
• Procedure for handling out-of-tolerance equipment and assessing previous results
• Identification and safeguarding of equipment

• Equipment used for acceptance not in the calibration register
• Out-of-tolerance findings not followed by an assessment of prior results
• Software used for measurement not validated

The organization identifies the knowledge its processes need to run and to make products and services conform, keeps that knowledge, and makes it available as far as needed. When needs and trends change, it looks at what it knows already and decides how it will obtain, or gain access to, the further knowledge and updates it needs. Organizational knowledge may come from inside (intellectual property, lessons learned, experience, results of improvements) or from outside (standards, academia, conferences, customers and providers).

• Identification of critical knowledge per process
• Mechanisms to capture and share knowledge (lessons learned, procedures, mentoring)
• Evidence of planning for knowledge loss (succession, retirement) and acquisition

• Critical knowledge held by individuals with no capture
• Lessons learned not recorded or shared
• Knowledge needs not reviewed when processes change

The organization decides what competence is needed by the people doing work under its control whose work affects how the QMS performs and how effective it is; makes sure those people are competent through suitable education, training or experience; where applicable, acts to help them gain the competence needed and evaluates whether those actions worked; and retains suitable documented information as evidence of competence.

• Competence requirements per role
• Training records, qualifications and competence assessments
• Effectiveness evaluations of training actions

• Competence equated with attendance
• Effectiveness of training never evaluated
• Contractors and temporary staff not covered

The organization makes sure the people doing work under its control know the quality policy and the quality objectives that concern them, understand how they contribute to an effective QMS and what better performance brings, and understand what follows if the system's requirements are not met.

• Induction and awareness material
• Interview or survey evidence of awareness at all levels
• Communication of objectives relevant to each area

• Staff cannot describe the objectives relevant to their work
• Consequences of nonconformity never explained

The organization decides which internal and external communications matter to its QMS: what it will communicate, when, to whom, by what means, and who will do the communicating.

• Communication plan or matrix (what, when, whom, how, who)
• Records of internal and external communications
• Evidence customer communication processes align with 8.2.1

• Communication needs never determined
• External communication responsibilities undefined

The quality management system includes the documented information required by the standard and determined by the organization as necessary (7.5.1), created and updated appropriately (7.5.2) and controlled (7.5.3).

• See the sub-clauses beneath this heading

• Treating the heading as a requirement separate from its sub-clauses

The QMS holds two kinds of documented information: what the standard itself requires, and whatever else the organization decides it needs for the system to be effective. How much is needed varies with the organization's size, the kind of activities, processes, products and services it has, how complex its processes are and how they interact, and how competent its people are.

• Master list of system documents and records
• Mapping of documented information to requirements
• Rationale for the extent of documentation

• Required records not identified
• Documentation copied from a template without tailoring

Whenever documented information is created or updated, the organization makes sure it is suitably identified and described (for example title, date, author or reference number), is in a suitable format (for example language, software version, graphics) and medium (paper or electronic), and is reviewed and approved as suitable and adequate.

• Document templates with identification fields
• Approval records
• Version history

• Uncontrolled drafts in use
• No approval before release

Documented information that the QMS and the standard call for is controlled so that it is on hand and fit for use wherever and whenever it is needed, and is adequately protected against loss of integrity, loss of confidentiality or misuse. The organization deals with: distribution, access, retrieval and use; storage and preservation, including keeping it legible; control of changes, including versions; and retention and disposition. Documented information from outside sources that the organization has judged necessary is identified and controlled, and documented information kept to evidence conformity is protected against unintended alteration.

• Document control procedure covering access, change, retention and disposal
• External document register (customer specifications, standards, regulations)
• Retention schedule and disposal records
• Protection of records from alteration (access controls, audit trails)

• Obsolete documents at the point of use
• External documents uncontrolled
• Records editable after the fact with no audit trail