ISO 9001 LI cheat sheet

ISO 9001:2015 contains auditable requirements in clauses 4-10; ISO 9000:2015 provides fundamentals and vocabulary, and ISO 9004 gives guidance for sustained success.

Seven QMS principles: customer focus; leadership; engagement of people; process approach; improvement; evidence-based decision making; relationship management.

The process approach manages interrelated processes as a system; each process has inputs, activities, outputs, controls, resources, and performance indicators.

PDCA mapping: Plan = clauses 4-6; Do = clauses 7-8; Check = clause 9; Act = clause 10.

Risk-based thinking is not a separate clause; risk and opportunity are addressed in 4.1, 5.1, 6.1, 8.1, 9.3, and 10.2.

Only clause 8.3 (design and development) may be declared not applicable; justification must be maintained as documented information.

Documented information uses 'maintain' for documents and 'retain' for records; both require control under clause 7.5.

Certification is third-party conformity attestation; accreditation is recognition of the certification body, so an accreditation body does not issue the ISO 9001 certificate.

Initiation decision inputs: top-management commitment, customer and regulatory drivers, resource availability, expected benefits, and tolerance for change.

Gap analysis output lists clause-level conformities, gaps, evidence needs, priorities, owners, and target dates against ISO 9001 clauses 4-10.

QMS scope must state products/services, sites, processes, boundaries, and applicability; exclusions are limited to clause 8.3 with justification.

Context analysis under 4.1 identifies external and internal issues relevant to purpose and strategic direction, including SWOT/PESTLE factors.

Interested parties under 4.2 are determined by relevance; their relevant requirements feed scope, compliance obligations, and process design.

A project charter records scope, objectives, governance, roles, milestones, budget, risks, dependencies, and success criteria.

Baseline metrics commonly include complaint rate, on-time delivery, process yield, scrap/rework, audit findings, and customer satisfaction.

Early certification-body contact establishes accreditation, scope, sector competence, audit duration, lead time, and fee structure.

Clause 6.1 requires determining risks and opportunities, planning actions, integrating them into QMS processes, and evaluating their effectiveness.

Quality objectives must be measurable, consistent with policy, relevant to functions and levels, monitored, communicated, and updated; documented information is maintained.

Quality policy must be appropriate to purpose and context, provide a framework for objectives, include commitments to requirements and improvement, and be communicated.

Clause 6.3 change planning considers purpose, potential consequences, QMS integrity, resources, responsibility, and authority.

Process planning defines inputs, outputs, sequence, interactions, criteria, methods, resources, competence, authority, risks, and improvement.

Clause 5.3 assigns and communicates responsibilities and authorities for QMS conformity, process performance, and customer focus.

Documented information planning identifies what the standard requires plus what the organization determines necessary for QMS effectiveness.

Implementation planning phases typically include mobilization, gap closure, documentation, training, process rollout, internal audit, and management review.

Clause 8.1 controls operational processes by establishing criteria, resources, controls, documented information, change control, and external provider control.

Clause 8.2 requires determining, reviewing, and communicating customer requirements, including changes, before committing to supply.

Clause 8.3 design controls cover planning, inputs, outputs, verification, validation, changes, and retained documented information.

Clause 8.4 controls external providers through evaluation, selection, monitoring, re-evaluation, and defined information and control based on impact.

Clause 8.5 controlled conditions include identification, traceability, customer property, preservation, post-delivery activities, and change control.

Clause 8.6 release requires planned arrangements completed and acceptance criteria met; release authority and traceability are defined.

Clause 8.7 controls nonconforming outputs by identification, segregation, containment, correction, and retained records.

Clauses 7.2 and 7.3 require competence determination and awareness of policy, objectives, contribution, and implications of nonconformity.

Clause 9.1 requires determining what to monitor and measure, methods, timing, responsibility, and analysis and evaluation of results.

Customer satisfaction monitoring uses methods such as surveys, complaints, returns, repeat business, and social media; results are analyzed.

Clause 9.1.3 analysis and evaluation covers conformity, satisfaction, process performance, product/service conformity, risks, external providers, and improvement.

Internal audit programme considers process importance, changes, and prior results; auditors must be objective and impartial.

Management review inputs include action status, context changes, satisfaction, objectives, process and product performance, nonconformities, audits, providers, resources, risk actions, and improvement.

Management review outputs include improvement opportunities, QMS changes, and resource needs; documented information is retained.

Measuring equipment requires identification, calibration or verification at specified intervals, safeguarding, and validity assessment of prior results if found unfit.

A complete process KPI includes formula, data source, frequency, target, owner, and trend; leading and lagging measures are balanced.

Clause 10.1 selects and implements improvement opportunities to meet requirements and enhance customer satisfaction.

Clause 10.2 sequence: react and control, correct, evaluate need for action, determine causes, implement action, review effectiveness, update risks, change QMS if needed.

Correction fixes a detected nonconformity; corrective action removes its cause to prevent recurrence.

Cause analysis methods include 5 Whys, fishbone, fault tree, Pareto, and process mapping; cause is verified before action.

Effectiveness review uses before and after metrics, recurrence checks, follow-up audit, and process performance data.

Improvement inputs include audits, complaints, KPIs, management review, risk and opportunity, process performance, employee ideas, and benchmarks.

Clause 7.1.6 requires determining necessary knowledge, maintaining it, and making it available; lessons learned support improvement.

Changes from corrective action update documented information and may alter risks, opportunities, and process controls.

An ISO 9001 certificate has a maximum validity of three years, subject to surveillance audits and recertification.

Stage 1 assesses documentation, scope, context, readiness, internal audit completion, and management review; it is not full conformity verification.

Stage 2 evaluates implementation and effectiveness through process sampling, interviews, observations, and records.

Readiness criteria: internal audit completed, management review held, corrective actions closed or planned, KPIs available, scope defined, documented information controlled.

A major nonconformity significantly affects QMS capability or product conformity; certification is normally withheld until correction and verification.

A minor nonconformity is an isolated lapse not systemic; closure may be accepted through evidence or an action plan before or after certification.

First surveillance typically occurs within 12 months of the certification decision; recertification occurs at least every three years.

Audit conduct includes opening meeting, audit plan, guides, availability of evidence, sampling, finding classification, closing meeting, and report.