Fundamental concepts and principles of management systems
Fundamental concepts and principles of management systems
This domain tests your ability to explain what a management system is, how its elements interact, and why principles such as process approach, risk-based thinking and continual improvement shape audit judgments. You are expected to use ISO management-system vocabulary precisely, not recite definitions.
Core rules and concepts
- A management system is a set of interrelated or interacting elements used to establish policy and objectives and to achieve those objectives. It includes processes, resources, roles, documented information and performance evaluation.
- PDCA is a dynamic cycle: Plan sets objectives and controls; Do implements; Check monitors and measures; Act improves. It is not a rigid four-step project.
- Risk-based thinking considers uncertainty and determines controls proportionate to risk. It applies to the system and to the audit.
- The process approach examines inputs, activities, outputs, interfaces and performance rather than isolated departments.
- Documented information is maintained or retained only where needed for effective operation and evidence; a documented procedure is not automatically required.
- Continual improvement uses performance data, nonconformity, corrective action and management review to improve suitability, adequacy and effectiveness.
Worked example
An internal auditor reviews a supplier that performs calibration. Production says the supplier is “approved,” but no approval record, scope or evaluation criteria are available. The auditor should not conclude merely that a document is missing. The relevant issue is control of externally provided processes: does the organization evaluate, select, monitor and re-evaluate the supplier, and does it control the calibration activity affecting product conformity? The finding should cite the audit criterion, the objective evidence and the risk, not a preferred form number.
Traps that cost marks
Do not equate a management system with software or a document set. Do not treat PDCA as four equal sequential phases. Do not write a nonconformity for a missing procedure unless a requirement or demonstrated need exists. Do not confuse correction (fixing the issue) with corrective action (removing the cause).