Quality Management System Requirements (API Q1 / ISO 9001)
This domain tests whether you can locate a requirement and judge conformity against it. You must be fluent in the structure of ISO 9001's high-level clause sequence (context, leadership, planning, support, operation, performance evaluation, improvement) and in the additional, prescriptive expectations typical of API Q1-such as documented risk assessment and contingency planning, control of critical suppliers, validation of software used in product realization, and defined competence and training records.
Key concepts: documented information (documents vs. records-creation/control vs. retention as evidence), risk-based thinking, process approach, monitoring and measurement, control of external providers, nonconforming product control, and corrective action. Understand the hierarchy: policy → objectives → procedures → work instructions → records.
Traps: (1) Quoting a clause number inaccurately-questions often hinge on whether you can map an observation to the right requirement. (2) Confusing "shall" requirements with guidance or good practice. (3) Assuming a documented procedure is always required; many clauses require a process but not necessarily a written procedure. (4) Overlooking that records must demonstrate results achieved, not merely that an activity occurred. (5) Treating risk assessment as a one-time exercise rather than an ongoing, documented activity.
Rule of thumb: for any finding, state the requirement (clause), the evidence, and the gap. If you cannot cite the requirement, you may have an observation, not a nonconformity.
Worked example: a calibration record shows a gauge past due. The finding is not "gauge overdue" alone-it is nonconformity against control of monitoring and measuring resources, with evidence of the overdue date and any product measured since.