ISO 9001 LI common mistakes
ISO 9001 LI · Understand the traps and how to avoid them.
Writes that the organization must establish a quality manual and the six mandatory documented procedures, and cites clause numbers such as 4.2.4 or 8.2.3 for procedures the standard supposedly requires.
Learned from older templates and ISO 9001:2008-era summaries. The 2015 revision removed the prescribed procedure set and the quality manual, replacing them with documented information the organization determines is necessary plus a short list of mandatory items.
What to do instead
Memorize the explicitly required documented information: scope (4.3), quality policy (5.2), quality objectives (6.2), and evidence that processes are performed as planned (4.4, 7.5.1). Practice separating 'what the standard requires' from 'what good practice suggests', and label a quality manual as a choice.
Describes top management discharging its QMS responsibility by appointing a management representative who owns the system, and says leadership can be delegated to the quality manager.
ISO 9001:2008 clause 5.5.2 created exactly this role, so old notes feel correct. In the current standard the representative role no longer exists and top management accountability under 5.1.1 cannot be delegated.
What to do instead
Answer with 5.1.1: top management takes accountability for QMS effectiveness, integrates requirements into business processes, promotes risk-based thinking, ensures resources, and communicates importance. A QMS coordinator may exist, but accountability stays with top management.
Defines the QMS scope as 'all departments at the head office', excludes design and development with the bare statement 'we do not design', and leaves outsourced processes outside the scope statement.
Candidates copy the organization chart or the audit plan instead of applying 4.3, which requires the scope to state the products and services covered and to justify any requirement determined not applicable. Outsource is confused with out of scope.
What to do instead
Write the scope in terms of products and services and the sites or processes that deliver them. Justify each not-applicable requirement against the nature of the products and the risks involved, and state that externally provided processes affecting conformity remain in scope under 8.4.
Produces a risk register as a one-off spreadsheet at project start, lists only threats, and never shows actions being evaluated for effectiveness or feeding into process planning.
Risk-based thinking under 6.1 is treated as a documentation deliverable rather than an input to planning, so the link to process criteria, objectives and monitoring is missing from the answer.
What to do instead
Answer with 6.1.1 and 6.1.2: identify risks and opportunities from the context and interested parties, plan actions, integrate them into processes (4.4), and evaluate effectiveness through 9.1 and 9.3. Include opportunities and show the traceability from risk to objective to control.
Writes quality objectives such as 'achieve customer satisfaction' or 'improve quality' with no measure, no baseline, no target, no owner and no timeframe.
Objectives are treated as slogans instead of 6.2.1 requirements, which make them measurable where practicable, consistent with the policy, relevant to conformity and enhancement, monitored, communicated and updated. The 6.2.2 planning elements are then omitted entirely.
What to do instead
Draft each objective as one sentence containing measure, baseline, target, timeframe, owner, resources and how results will be evaluated. Check each one against 6.2.2 and show where it is reviewed in management review.
States that all suppliers must be ISO 9001 certified and that purchasing is controlled by collecting certificates, while processes performed by outsourced providers receive no criteria, monitoring or re-evaluation.
Confusion between clause 8.4 and the certification scheme itself: the standard asks for controls proportionate to the effect on conformity, not for supplier certificates. Candidates also overlook that outsourced processes remain the organization's responsibility.
What to do instead
Answer with 8.4.1: determine controls, set criteria for selection, evaluation, monitoring and re-evaluation, define verification of purchased output, and communicate requirements to the provider. Treat certification as one possible input, never as the only criterion.
Answers 'monitoring and measurement' only in terms of final inspection and calibration, with no process indicators, no statement of what is monitored, and no route for analysing results.
The default mental model is product quality control. Clause 9.1.1 requires determining what to monitor and measure, the methods used, when, and when results are analysed and evaluated, and 4.4.1 c) requires process criteria and performance indicators.
What to do instead
For each process, name the indicator, method, frequency, owner and review forum, and show how data flows into 9.1.3 analysis and 9.3 management review. Present product inspection as one example of monitoring, not as the whole answer.
Plans internal audits as a clause-by-clause checklist where the QMS manager audits the processes they own, and treats findings as personal failings to be minimized.
Clause 9.2 requires objectivity and impartiality, so auditors must not audit their own work, and it requires the programme to consider process importance, changes and previous results. Clause coverage is mistaken for process auditing.
What to do instead
Build the programme on process importance and risk, schedule and cycle it, define criteria and scope per audit, use competent auditors independent of the activity, and route findings into correction, corrective action and management review inputs.
Records a nonconformity, retrains the operator or reworks the part, closes the record, and labels this 'corrective action' without root cause analysis, without checking for similar nonconformities, and without updating risks.
Clause 10.2 separates correction (dealing with the immediate problem) from corrective action (eliminating the cause). Candidates stop after the first step and skip 10.2.1 c) to f).
What to do instead
Narrate the full sequence: react and control the nonconformity, evaluate the need for action, determine the cause, check whether similar nonconformities exist or could occur, implement action, review effectiveness, update risks where needed, and retain documented information as evidence.
Expects the certification body to advise which documents to write and how to close gaps, and plans for a single audit followed by three years of certificate validity without further visits.
The conformity assessment role is confused with consultancy; a certification body cannot consult. Certification is also a two-stage initial audit followed by surveillance audits and a recertification audit before the three-year cycle expires.
What to do instead
Close internal audit and management review before the certification audit, run a stage 1 readiness check covering scope, documented information, internal audit and management review, and brief the team that stage 1 verifies readiness while stage 2 verifies implementation. Budget for annual surveillance and recertification.