Fundamental principles and concepts of a quality management system
Principles, process approach and PDCA
A QMS is not a shelf of documents; it is the organization's set of interrelated processes, run with adequate resources, measured, and improved to meet customer and applicable statutory/regulatory requirements and to enhance satisfaction. Seven quality management principles underpin clauses 4–10: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making, and relationship management. They are foundations, not auditable requirements - a frequent trap is a question asking which clause 'requires' a principle (e.g. that relationship management must be documented). You audit requirements, and the principles explain why they exist.
The process approach asks for inputs, activities, outputs, controls, resources, performance indicators and risks for each process. PDCA maps onto the standard: Plan (4, 5, 6), Do (7, 8), Check (9), Act (10). Risk-based thinking is woven through 4.1, 5.1, 6.1, 8.1 and 9.1; the standard does not require a risk register, a formal risk-assessment method, or a documented risk procedure - questions claiming it does are traps. Likewise, ISO 9001:2015 does not require a quality manual, a management representative, six mandatory documented procedures, or a preventive-action clause.
Rule of thumb: for any process you audit, answer four questions - what does it do (inputs/outputs), who owns it, how is performance measured, and what documented information exists? If all four can be answered and evidenced, you can test conformity; if not, you have a lead.
Trap: treating guidance (ISO 9000, ISO 9004) as requirements.