GPPQE cheat sheet

ISO 9001:2015 is built on seven quality management principles: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making, and relationship management.

The process approach requires identifying process inputs, outputs, sequence, interaction, criteria, methods, resources, responsibilities, and risks; the PDCA cycle and risk-based thinking are applied at every process level.

Documented information is controlled for creation, update, distribution, access, retrieval, retention, and disposition; obsolete documents must be prevented from unintended use.

Top management must demonstrate leadership by establishing quality policy and objectives, integrating QMS requirements into business processes, ensuring resources, and promoting improvement.

Quality objectives must be measurable, monitored, communicated, and updated; they must be consistent with the quality policy and relevant to conformity and customer satisfaction.

Management review inputs include audit results, customer feedback, process performance, nonconformities, corrective actions, monitoring results, and resource adequacy; outputs include improvement opportunities and resource needs.

A quality policy is a formal statement of top management's commitment to quality; it must be appropriate to the organization's purpose, include a commitment to satisfy applicable requirements, and commit to continual improvement.

Organizational roles, responsibilities, and authorities must be assigned, communicated, and understood; the QMS representative ensures the QMS conforms and reports on performance and improvement.

Risk-based thinking in ISO 9001:2015 replaces explicit preventive action clauses; organizations determine risks and opportunities that need to be addressed to give assurance the QMS can achieve intended results.

ISO 19011:2018 audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach.

An audit is a systematic, independent, and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled.

Audit types: first-party (internal), second-party (external provider/supplier), and third-party (certification/registration or accreditation); each has different independence and purpose.

Audit program management includes establishing objectives, risk-based planning, scheduling, resourcing, competence of auditors, monitoring, and review of the program.

Audit criteria are the set of policies, procedures, standards, or requirements used as a reference; audit evidence consists of records, statements, or other verifiable information.

Audit findings are classified as conformities or nonconformities; nonconformities may be graded (e.g., major, minor, observation) according to the audit program's defined criteria.

An audit plan includes audit objectives, scope, criteria, dates, locations, expected time and duration, roles and responsibilities, and allocation of resources.

Auditor competence includes knowledge of audit principles, standards, and the auditee's technical area, plus skills in communication, interviewing, note-taking, and report writing.

Opening meeting confirms the audit plan, scope, criteria, communication channels, and availability of resources; closing meeting presents findings, conclusions, and any required follow-up.

PDCA (Plan-Do-Check-Act) is the core improvement cycle: Plan establishes objectives and processes; Do implements; Check monitors and measures; Act takes action to improve.

The seven basic quality tools: flow chart, check sheet, histogram, Pareto chart, cause-and-effect (fishbone) diagram, scatter diagram, and control chart.

Pareto principle: roughly 80% of effects come from 20% of causes; a Pareto chart ranks causes by frequency or impact to prioritize improvement efforts.

A cause-and-effect diagram organizes potential causes into categories (often 6M: man, machine, material, method, measurement, environment) without asserting causation.

A flowchart maps process steps, decision points, inputs, and outputs; it identifies handoffs, delays, rework loops, and non-value-added steps.

Five Whys is a root cause analysis technique that repeatedly asks 'why' until the fundamental cause is identified; it must be evidence-based, not speculative.

A control chart distinguishes common-cause variation (inherent, stable) from special-cause variation (assignable, unstable); control limits are typically set at ±3 sigma from the center line.

DMAIC (Define, Measure, Analyze, Improve, Control) is the Six Sigma improvement methodology; DMADV (Define, Measure, Analyze, Design, Verify) is used for new process or product design.

A check sheet is a structured, prepared form for collecting and analyzing data; it standardizes data collection and supports frequency or location analysis.

Risk is the effect of uncertainty on objectives; it is characterized by likelihood of occurrence and severity of consequence, often assessed as a risk score = likelihood × severity.

Risk treatment options: avoid, reduce (mitigate), transfer (share), or accept; residual risk must be evaluated against risk acceptance criteria.

A nonconformity is non-fulfilment of a requirement; correction is action to eliminate the detected nonconformity, while corrective action eliminates the cause to prevent recurrence.

Corrective action process: react to the nonconformity, evaluate the need to eliminate causes, implement action, review effectiveness, and update risks determined during planning.

Root cause analysis must distinguish root causes from contributing factors and direct causes; corrective action must address systemic causes, not just symptoms.

Containment (immediate correction) protects the customer from the effect of the nonconformity while the root cause analysis and corrective action are completed.

Effectiveness verification of corrective action requires objective evidence that the nonconformity does not recur; it is performed after an appropriate interval.

A risk register records identified risks, their assessment, treatment actions, owners, and status; it is reviewed and updated as part of the QMS.

Opportunities are favourable situations that can lead to new practice, products, or markets; ISO 9001:2015 requires addressing risks and opportunities together.

ISO 9001:2015 clause 8.4 requires control of externally provided processes, products, and services; the organization must determine controls based on the potential impact on conformity.

Supplier selection criteria include capability, quality performance, delivery, cost, financial stability, certifications, and risk; criteria must be defined and applied.

Supplier evaluation methods include audits, questionnaires, sample inspection, performance scorecards, and historical data analysis.

Supplier approval status must be monitored; approved suppliers are re-evaluated at defined intervals or when performance triggers action.

A supplier quality agreement defines quality requirements, inspection responsibilities, documentation, change notification, and nonconformity handling.

Incoming inspection plans specify sampling, acceptance criteria, and disposition; inspection may be waived based on supplier history and risk.

Supplier corrective action requests (SCARs) document nonconformities, require root cause analysis and corrective action, and track verification of effectiveness.

Flow-down of requirements ensures sub-tier suppliers meet the same quality and regulatory obligations as the primary supplier.

Supplier risk assessment considers the criticality of the supplied item, supplier financial health, geographic risk, and single-source dependency.

Verification confirms that specified requirements have been fulfilled (e.g., inspection, test, demonstration, analysis); validation confirms that requirements for a specific intended use are fulfilled.

Design verification ensures design outputs meet design inputs; design validation ensures the product meets user needs and intended use under actual or simulated conditions.

Process validation demonstrates that a process consistently produces product meeting predetermined specifications; it includes installation qualification (IQ), operational qualification (OQ), and performance qualification (PQ).

A control plan defines the product and process characteristics, controls, sampling, and reaction plans for each phase of production.

First article inspection (FAI) verifies that the first production parts meet all drawing and specification requirements before full production.

Measurement system analysis (MSA) evaluates variation from the measurement system; gauge R&R assesses repeatability and reproducibility.

Acceptance sampling plans (e.g., ANSI/ASQ Z1.4) define sample size and acceptance number based on lot size and acceptable quality level (AQL).

Traceability enables identification and recall of product; it requires records linking raw materials, components, and processes to finished goods.

Process capability indices Cp and Cpk compare process spread to specification limits; Cpk accounts for centering, Cp does not.

Descriptive statistics: mean (average), median (middle value), mode (most frequent), range (max-min), variance, and standard deviation (square root of variance).

Normal distribution: approximately 68.27% of values fall within ±1σ, 95.45% within ±2σ, and 99.73% within ±3σ of the mean.

Cp = (USL - LSL) / (6σ); Cpk = min[(USL - mean)/(3σ), (mean - LSL)/(3σ)]; Cpk > 1.33 is commonly considered capable.

Sampling error is the difference between a sample statistic and the population parameter; it decreases as sample size increases (proportional to 1/√n).

Random sampling ensures every item in the population has an equal chance of selection; stratified sampling divides the population into strata and samples each.

Attribute data (pass/fail, count) is analyzed with proportions and counts; variable data (measurements) is analyzed with mean and standard deviation.

Type I error (α) is rejecting a true null hypothesis (producer's risk); Type II error (β) is failing to reject a false null hypothesis (consumer's risk).

A p-value is the probability of observing a result at least as extreme as the sample result, assuming the null hypothesis is true; p < α leads to rejecting the null hypothesis.

Control chart rules (e.g., Western Electric rules) detect special-cause variation: one point beyond 3σ, two of three beyond 2σ, or a run of seven on one side of the center line.

ASQ Code of Ethics: hold paramount the safety, health, and welfare of the public; perform services only in areas of competence; maintain confidentiality; avoid conflicts of interest.

Professional integrity requires honesty in reporting data, findings, and conclusions; falsification or misrepresentation of results is unethical.

Confidentiality obligations extend to client information, audit findings, proprietary processes, and personal data; disclosure requires authorization or legal requirement.

Conflict of interest must be disclosed and managed; an auditor must not audit their own work or have a financial interest in the auditee.

Communication must be accurate, timely, clear, and appropriate to the audience; technical terms should be defined for non-technical stakeholders.

Audit reports present objective evidence, findings, and conclusions; they must be factual, complete, and free of personal opinion.

Ethical decision-making considers stakeholders, applicable laws and regulations, professional standards, and the long-term consequences of actions.

Whistleblowing is reporting unethical or illegal conduct through appropriate channels; it is protected when done in good faith and through proper procedures.

Continuing professional development maintains competence; professionals must stay current with standards, methods, and technologies in their field.