ISO 9001 LA key terms

A fundamental, widely accepted rule or belief that guides how an organization directs and controls its activities to improve quality; ISO 9001 is built on seven such principles, including customer focus and leadership.

Managing activities as a set of interrelated processes that turn inputs into outputs, so that the links and interactions between processes are understood, controlled and improved rather than managed in isolation.

Considering uncertainty and its possible effects when planning and running processes and the management system, so that opportunities are pursued and adverse effects are prevented or reduced.

A repeating four-step cycle - plan, do, check, act - used to plan processes, carry them out, review results against requirements, and improve performance based on what was learned.

The combination of internal and external issues, and interested parties with their relevant requirements, that can affect how an organization's quality management system is designed and how well it works.

A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity - for example customers, suppliers, employees, regulators or owners.

A measurable result to be achieved that relates to quality; objectives are set at relevant functions and levels, are consistent with the quality policy, and are monitored and updated.

Recurring activity to enhance performance - not simply fixing problems, but systematically looking for better ways to work and raising the level of results achieved over time.

The person or group who directs the organization at the highest level and has authority to commit resources; ISO 9001 requires them to show leadership and accountability for the system's effectiveness.

Information the organization must control and maintain, together with the medium on which it is held; it covers both documents that give direction, such as procedures, and records that provide evidence of results.

A statement of the boundaries and applicability of the quality management system, identifying the activities, locations and products or services covered and justifying any exclusion of a requirement.

A process that the organization needs for its quality management system but that is performed by an external provider; the organization must still control it and keeps responsibility for conformity.

Failure to meet a requirement - of a product or service, a process, or the management system itself; the requirement may come from ISO 9001, the organization's own documentation, or the customer.

Action taken to eliminate a detected nonconformity and put things right - for example reworking a defective item or replacing a document; it does not by itself address the underlying cause.

Action taken to eliminate the cause of a nonconformity so that it does not recur or appear elsewhere; it usually follows an analysis of why the problem happened.

The demonstrated ability to apply knowledge and skills to achieve intended results; for people whose work affects quality, ISO 9001 requires determining needed competence, ensuring it, and keeping evidence.

A systematic, independent and documented process for obtaining objective evidence and evaluating it against agreed criteria to determine the extent to which requirements are fulfilled.

The set of requirements used as a reference against which audit evidence is compared - for example ISO 9001, the organization's own procedures, contracts, or legal requirements.

Records, statements of fact or other verifiable information relevant to the audit criteria; it is obtained by sampling and must be capable of being checked.

The result of evaluating collected audit evidence against the audit criteria; findings may show conformity or nonconformity and are the raw material from which the audit conclusion is drawn.

The auditor's professional judgement, based on the audit findings and objectives, about how well the audited area fulfils the audit criteria and what that means for the organization.

The organization or person who requested the audit and who receives the audit report; the client may be the auditee or a separate body such as a certification body.

The organization, part of it, or person being audited; the auditee provides access, information and personnel and is expected to respond to the findings raised.

A person qualified and competent to conduct audits; they plan and carry out the audit, gather and evaluate evidence, and report findings objectively.

Freedom from conditions that could bias the outcome of an audit, including avoiding auditing one's own work or holding conflicting responsibilities; it underpins the credibility of audit results.

A description of the extent and boundaries of a specific audit - the sites, organizational units, processes, activities and time period to be covered.

A written description of the activities and arrangements for a specific audit, covering objectives, criteria, scope, dates, locations, team assignments, sampling approach and expected reporting.

A pre-audit examination of the auditee's documented information to understand the system and check its completeness and consistency with the criteria, used to focus the on-site investigation.

A certification approach in which stage 1 reviews documentation and readiness, and stage 2 verifies implementation and effectiveness on site; the first stage informs the planning of the second.

Papers and tools the audit team uses during the audit - checklists, forms, notes and schedules - which support the investigation and keep the audit on track; they are not themselves evidence.

A short formal meeting at the start of an on-site audit to confirm scope, criteria, objectives, schedule and communication arrangements, and to give the auditee the chance to ask questions.

Selecting less than the whole population of available information or activities in order to draw conclusions about the whole; samples should be representative and sufficient to support findings.

A documented path that lets auditors trace a topic from one source to another - for example from a customer requirement to a work instruction to a record - to check consistency and implementation.

A written record of a failure to meet audit criteria, stating the requirement, the evidence found, the location and the significance, so that the auditee can understand and correct it.

A meeting at the end of the audit at which the audit team presents findings, conclusions and nonconformities, explains the basis for them and agrees what happens next.

A formal written record of the audit covering objectives, scope, criteria, evidence gathered, findings, conclusions and, where relevant, recommendations for the audit client.

A later check, often limited in scope, to verify that corrective actions have been implemented and are effective after nonconformities were raised.

A set of planned audits arranged over a period and managed as one activity, designed to achieve a specific purpose, cover the management system effectively, and use defined resources and schedules.

The person responsible for establishing, monitoring and improving the audit programme, including allocating resources, approving audit plans and reviewing whether the programme meets its objectives.

A timetable setting out when individual audits within the programme take place, covering dates and areas in a sequence that reflects risk, importance and previous audit results.