The Quality System
What to master
Expect questions on structure, auditing, and the meaning of conformity. ISO 9001:2015 is organized in clauses 4–10: context of the organization, leadership, planning, support, operation, performance evaluation, and improvement. The standard rests on the process approach, PDCA, and risk-based thinking; it speaks of documented information rather than documents and records, and it folded preventive action into risk-based planning (clause 6.1).
Know the seven quality management principles (customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making, relationship management) and the sector schemes: IATF 16949 (automotive), AS9100 (aerospace), ISO 13485 (medical devices), TL 9000 (telecom), ISO 14001 (environmental), ISO 45001 (OH&S), ISO/IEC 17025 (testing labs).
Audit types: first party = internal; second party = customer auditing a supplier or a supplier auditing you; third party = independent certification body. Certification is granted to an organization; accreditation is granted to the certification body itself. Do not confuse verification (did we build it right, against requirements) with validation (did we build the right thing, against intended use).
Worked example. During an internal audit you find one traveler with a missing operator signature, but every other traveler in the sample is complete. That is a minor nonconformity - an isolated lapse. If instead no traveler in the sample carried signatures because the process never required them, the system itself is broken and it is a major nonconformity. Rule of thumb: ask whether the finding is an isolated slip or a systemic breakdown of a required process.