Exemplar Global QMS Lead Auditor cheat sheet

Quality Management System (ISO 9001) Auditing

• ISO 9001:2015 has 10 clauses: 1 Scope, 2 Normative references, 3 Terms and definitions, 4 Context of the organization, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement; only clauses 4-10 contain auditable requirements.

• The seven quality management principles are customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making, and relationship management; they underpin every clause of the standard.

• Clause 4 requires determining external and internal issues, interested parties and their relevant requirements, and the scope of the QMS; the scope statement must justify any non-applicability of requirements and be available as documented information.

• The process approach requires determining process inputs, outputs, sequence, interaction, criteria, resources, responsibilities, risks, and performance indicators, then evaluating and improving the processes (clause 4.4).

• Risk-based thinking is implicit and not a separate clause: clause 6.1 requires planning actions to address risks and opportunities, and clause 9.1.3 requires analysing data for conformity and customer satisfaction.

• Clause 7.5 requires documented information to be controlled for availability, protection, distribution, access, retrieval, retention, and disposition; the organization decides what documented information is needed beyond the mandatory items.

• Clause 9.2 requires internal audits at planned intervals, an audit programme, defined criteria and scope, auditor objectivity and impartiality (auditors must not audit their own work), reporting to relevant management, and corrective action without undue delay.

• Clause 10.2 corrective action requires reacting to the nonconformity, evaluating the need to eliminate causes, implementing action, reviewing effectiveness, updating risks and opportunities, and retaining documented information as evidence.

• Audit evidence must be verifiable and traceable to audit criteria; findings are classified as conformity, nonconformity (major or minor), observation or opportunity for improvement, and the audit conclusion addresses the audit objectives and scope.