Quality management system requirements (ISO 9001:2015, clauses 4–10)
Clause map and what is actually required
Clause 4 establishes context (4.1), interested parties (4.2), scope (4.3) and the QMS processes (4.4). Clause 5 covers leadership, the quality policy and roles, responsibilities and authorities. Clause 6 covers risks and opportunities, quality objectives and planning of changes. Clause 7 covers resources, competence, awareness, communication and documented information. Clause 8 covers operational planning, requirements for products and services, design and development, external providers, production and service provision, release, and nonconforming outputs. Clause 9 covers monitoring and measurement, internal audit, and management review. Clause 10 covers nonconformity and corrective action, and continual improvement.
Note the vocabulary: 'documented information' replaced 'documents and records', with maintained (procedures, policy) and retained (evidence) as the two verbs. Only a small number of items are explicitly required - for example the scope, quality policy, quality objectives, and retained evidence such as competence records, audit results and management review outputs. Exclusions are permitted only for clause 8 requirements that do not affect conformity or the ability to enhance customer satisfaction; nothing in clauses 4–7 can be excluded.
Traps: looking for 'preventive action' (it is absorbed into risk-based thinking); expecting design requirements to apply to every organization (8.3 can be not applicable); forgetting that management review has defined inputs and outputs (decisions on improvement, QMS changes, resource needs); assuming internal audit outputs are optional records.
Worked example: an auditee says 'we excluded 7.1.5 because our lab is calibrated by our supplier'. That is not an exclusion - calibration is a purchased service under 8.4. Exclusions only exist within clause 8.