ISO 9001 LA cheat sheet

Quality management system (QMS) = interrelated or interacting processes and resources needed to achieve quality objectives.

Seven QMS principles: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making, relationship management.

PDCA: Plan = set objectives and processes; Do = implement; Check = monitor and measure against requirements; Act = improve performance.

Process approach: achieve consistent and predictable results by managing interrelated processes as a coherent system, including inputs, outputs, and interfaces.

Risk-based thinking: determine risks and opportunities that can affect conformity and customer satisfaction; ISO 9001:2015 has no separate preventive action clause.

Documented information decision rule: maintain documents (policies, procedures, work instructions) to control processes; retain records as evidence of results.

Scope decision rule: a requirement may be determined not applicable only if it does not affect the organization's ability to ensure product/service conformity and enhance customer satisfaction.

Quality = degree to which a set of inherent characteristics of an object fulfills requirements.

ISO 9001:2015 requirements are in clauses 4-10: context, leadership, planning, support, operation, performance evaluation, improvement.

Clause 4 outputs: internal/external issues, interested party requirements, QMS scope, and QMS processes with inputs, outputs, sequence, interaction, criteria, resources, responsibilities, risks, and improvement.

Clause 5: top management demonstrates leadership and commitment, establishes quality policy, and ensures responsibilities and authorities are assigned.

Clause 6: address risks and opportunities, establish measurable quality objectives, and plan changes to the QMS in a controlled manner.

Clause 7: provide resources, ensure competence and awareness, manage communication, and control documented information.

Clause 8: control operational planning, product/service requirements, design and development, externally provided processes, production/service provision, release, and nonconforming outputs.

Clause 9: monitor and measure, evaluate customer satisfaction, analyze and evaluate data, conduct internal audits, and perform management review.

Clause 10: react to nonconformity, evaluate need for corrective action, implement action, review effectiveness, and continually improve.

Documented information required by ISO 9001:2015 includes QMS scope, quality policy, quality objectives, and records/evidence specified throughout the standard; a quality manual is not required.

Audit = systematic, independent, documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled.

Audit criteria = policies, procedures, requirements, or standards used as a reference; audit evidence = verifiable records, statements, or facts.

Audit findings = results of evaluating evidence against criteria; audit conclusions = outcome of an audit after considering findings and objectives.

Audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach.

Independence decision rule: an auditor should not audit their own work or have a conflict of interest that affects objectivity.

Evidence-based approach: conclusions are based on verifiable samples; auditors record sampling limitations and do not generalize beyond evidence.

First-party audit = internal; second-party = customer or interested party; third-party = independent certification or accreditation body.

Audit scope, objectives, and criteria are established by the audit client and communicated to the audit team and auditee.

Competence = ability to apply knowledge and skills to achieve intended results; audit team competence is matched to audit scope and criteria.

Preparation inputs: audit objectives, scope, criteria, client/auditee interfaces, audit team competence, and applicable requirements.

Feasibility check: confirm sufficient time, information, resources, and access to conduct the audit before finalizing the plan.

Document review: examine QMS documented information to understand processes, identify gaps for evidence collection, and avoid auditing documents alone.

Audit plan contents: audit objectives, scope, criteria, schedule, locations, activities, team roles, and audit methods.

Work documents: checklists, sampling plans, and forms support the audit; they do not replace auditor judgment or evidence collection.

Sampling plan: define population, sample size, selection method, and rationale; sample enough to provide confidence in findings.

Audit team roles: team leader manages audit and communication; auditors collect evidence and report findings; technical experts advise without auditing beyond competence.

Two-stage initial certification: Stage 1 reviews readiness and documentation; Stage 2 evaluates implementation and effectiveness of the QMS.

Opening meeting: confirm objectives, scope, criteria, plan, communication, confidentiality, and availability of resources; confirm auditee understands the audit.

Evidence collection methods: interviews, observation of activities, review of documents and records, and examination of data; verify evidence before using it.

Audit trail: link requirement to evidence to finding; record location, person, and sample so the finding can be traced and verified.

Process approach in auditing: follow inputs, outputs, interfaces, controls, and performance indicators across processes rather than isolated clauses.

Interview rule: ask open questions, listen, verify with records or observation, and avoid leading questions or consulting.

Nonconformity: non-fulfilment of a requirement; record the requirement, objective evidence, location, and affected process.

Finding classification decision rule: major/minor classification follows the certification scheme; a major affects QMS capability, a minor is isolated and does not.

Daily team meeting: review progress, adjust plan, consolidate findings, and identify need for additional evidence or communication.

Closing meeting: present findings and conclusions, explain sampling limitations, allow auditee questions, and clarify follow-up.

Audit report contents: objectives, scope, criteria, audit dates, team, findings, conclusions, and any limitations or unresolved issues.

Audit completion: occurs when planned audit activities are finished and the audit report is issued; follow-up can continue after completion.

Closing meeting: present findings and conclusions, clarify nonconformities, explain sampling limitations, and agree communication of corrective actions.

Nonconformity response sequence: immediate correction, evaluate need for corrective action, determine root cause, implement action, review effectiveness.

Follow-up decision rule: verify corrective action implementation and effectiveness; close the finding only when objective evidence shows the cause is eliminated.

Certification decision: made by the certification body independently of the audit team; auditors collect evidence but do not grant certification.

Report distribution and retention: follow client and programme requirements; protect confidential information and retain records as evidence.

Audit report should be factual, clear, and timely; it may state conformity or nonconformity but does not prescribe consulting solutions.

Audit programme = set of one or more audits planned for a specific time frame and directed toward a specific purpose.

Programme versus plan: the programme is the overall schedule and management of audits; the audit plan covers one audit.

Programme objectives: meet stakeholder needs, verify QMS effectiveness, support improvement, and satisfy certification or regulatory requirements.

Audit frequency decision: consider risk, process complexity, performance trends, changes, complaints, and previous audit results.

Programme resources: assign competent auditors, technical experts, time, and access; ensure independence and impartiality.

Programme monitoring: track audit schedules, findings, corrective actions, and performance indicators; review at planned intervals.

Programme records: retain audit plans, reports, findings, corrective action evidence, and competence records per requirements.

Reference standards: ISO 19011 provides audit programme and audit guidance; ISO/IEC 17021 applies to certification bodies.