API QUSE cheat sheet

ISO 9001 is built on seven quality management principles: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making, and relationship management.

The process approach treats interrelated activities as a system of processes; each process has defined inputs, outputs, controls, resources, and performance indicators.

PDCA (Plan-Do-Check-Act) underlies continual improvement: Plan sets objectives and processes, Do implements, Check monitors and measures, Act takes action to improve.

Risk-based thinking replaces a formal preventive-action clause in ISO 9001:2015; risks and opportunities must be addressed at the process and system level.

Documented information covers both documents (maintained) and records (retained); the standard requires only what is necessary for effective operation and control.

The quality policy must be appropriate to purpose, include commitment to satisfy applicable requirements and to continual improvement, and be communicated and available.

Quality objectives must be measurable, consistent with the quality policy, relevant to conformity and customer satisfaction, monitored, and updated as needed.

Management review inputs include audit results, nonconformities and corrective actions, performance and effectiveness, resource adequacy, and risks/opportunities; outputs include improvement and resource decisions.

A nonconformity is non-fulfilment of a requirement; correction fixes the condition, corrective action eliminates the cause, and both differ from preventive action.

An audit is a systematic, independent, and documented process for obtaining objective evidence and evaluating it objectively against audit criteria.

Three audit types by relationship: first-party (internal), second-party (by a customer or on behalf of a customer), third-party (independent certification or accreditation body).

Audit criteria are the set of policies, procedures, standards, or requirements used as a reference against which objective evidence is compared.

Audit evidence consists of records, statements of fact, or other verifiable information relevant to the audit criteria; only verifiable information is audit evidence.

Findings classify as conformity or nonconformity; nonconformities may be graded (e.g., major/critical vs. minor) by impact and system failure extent.

Independence means auditors do not audit their own work; impartiality means freedom from bias and conflicting interests that could override objectivity.

Audit scope defines the extent and boundaries (functions, sites, processes); audit criteria are the requirements; objectives state the audit's purpose.

The audit programme is the set of arrangements for a specific subject, covering multiple audits planned over time; each individual audit is a component of it.

Competence of auditors requires education, training, experience, and demonstrated audit skills, evaluated against the audit programme's needs.

Risk-based audit planning allocates audit time and depth to processes with higher risk, higher complexity, or greater impact on product and customer.

The audit plan defines objectives, scope, criteria, dates, sites, team roles, and schedule; it is communicated to the auditee and may be revised as needed.

Document review before the audit identifies procedures, records, prior findings, and performance data to focus sampling and interview questions.

A checklist or audit guide supports coverage and consistency but must not restrict the auditor from following trails revealed by evidence.

Auditor selection considers competence, independence from the audited activity, and language or technical knowledge needed for the scope.

Sampling in planning sets the intended coverage; sample size should reflect process volume, risk, and prior performance rather than convenience.

Opening meeting agenda covers purpose, scope, criteria, schedule, methods, confidentiality, and confirmation of resources and escorts.

Audit duration depends on scope, complexity, number of personnel, and process risk; it is estimated during planning and adjusted if scope changes.

The audit team leader is responsible for preparing the audit plan, managing the team, and representing the audit in communications with the auditee.

Evidence collection methods: interviews, observation of activities, and review of documents and records; triangulation across methods strengthens conclusions.

Audit trails follow a thread from a record back to the process and forward to outputs; following the trail tests process control, not just record existence.

An audit sample is a subset of available information; conclusions apply to the sample and are extrapolated with stated caution, not as certainty about the population.

Nonconformity statements contain three elements: the requirement (criterion), the evidence (objective evidence found), and the gap (how the evidence fails the requirement).

Objective evidence must be verifiable and traceable - record identifiers, dates, locations, personnel, and specific documents or samples observed.

Interview technique: ask open questions first, probe with closed questions, avoid leading questions, and confirm understanding by restating responses.

Observations that are not nonconformities are recorded as opportunities for improvement or observations, clearly distinguished from nonconformities.

Auditors verify effectiveness by checking whether controls achieve intended results, not merely whether procedures exist and are followed.

Evidence must be recorded at the time of discovery and reviewed against criteria before being reported; unverified impressions are not findings.

The audit report includes objectives, scope, criteria, dates and sites, audit team, findings, conclusions, and any limitations or divergences from the plan.

The report states whether the audit criteria were met and summarises conformity, nonconformities, and opportunities for improvement with supporting evidence.

Findings should be agreed with the auditee for factual accuracy before issue; disagreement on interpretation is recorded, not suppressed.

Report distribution is defined by the audit programme; confidentiality of audit information is protected and access limited to authorised recipients.

Corrective action includes root-cause analysis, action to eliminate the cause, and verification of effectiveness; correction alone does not close a nonconformity.

Follow-up verifies that corrective actions were implemented and effective; verification may be by document review, re-audit, or sampling of records.

A nonconformity is closed only when the implemented action is verified effective; pending actions remain open with target dates and owners.

The audit report is a factual record of the audit at the time it was performed; subsequent changes do not alter the report but are documented in follow-up.

Audit programme review uses results, trends, and follow-up status to adjust future audit frequency, scope, and focus.