PECB ISO 9001 Foundation cheat sheet

A quality management system (QMS) is a set of interrelated or interacting elements of an organization used to establish policies and objectives, and processes to achieve those objectives.

The seven quality management principles are: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making, and relationship management.

Process approach: consistent and predictable results are achieved more effectively when activities are understood and managed as interrelated processes that function as a coherent system.

PDCA (Plan-Do-Check-Act) is the iterative cycle applied to processes and to the QMS as a whole; risk-based thinking is integral to the process approach.

Risk-based thinking means considering uncertainty and its potential effect on objectives; it is not a standalone clause requiring a documented risk register.

A process needs defined inputs, outputs, sequence and interaction, criteria and methods, resources, responsibilities, and performance evaluation to be managed.

The QMS scope must state the products and services covered and justify any non-applicable requirements; exclusions are only permitted where they do not affect the ability to ensure conformity.

Documented information comprises both documents (maintained information) and records (retained information as evidence of results achieved).

Continual improvement is a recurring activity to enhance performance; it is distinct from corrective action, which reacts to a nonconformity.

The standard follows the Harmonized Structure (Annex SL) shared by ISO management system standards: clauses 4-10 covering context, leadership, planning, support, operation, performance evaluation, and improvement.

Clause 4 requires determining internal and external issues, interested parties and their relevant requirements, and defining QMS scope and processes.

Clause 5 requires top management to demonstrate leadership, establish a quality policy, and ensure responsibilities and authorities are assigned and communicated.

Clause 6 requires actions to address risks and opportunities, quality objectives that are measurable and monitored, and control of planned changes.

Clause 7 covers resources, competence, awareness, communication, and documented information; competence requires determination of necessary competence and evidence of it.

Clause 8 covers operational planning and control, requirements for products and services, design and development, control of externally provided processes, production and service provision, and release and nonconforming outputs.

Clause 9 covers monitoring, measurement, analysis and evaluation, internal audit, and management review inputs and outputs.

Clause 10 requires addressing nonconformity and corrective action, and continual improvement of the QMS's suitability, adequacy, and effectiveness.

Conformity to the standard requires documented information explicitly required by the standard plus that determined by the organization as necessary for QMS effectiveness.

Certification is a third-party conformity assessment activity; the certification body must be accredited to ISO/IEC 17021-1 to issue an accredited ISO 9001 certificate.

An audit is a systematic, independent, and documented process for obtaining objective evidence and evaluating it against audit criteria.

Objective evidence comprises records, statements of fact, or other verifiable information relevant to the audit criteria.

Nonconformity is the non-fulfilment of a requirement; a major nonconformity affects the QMS's ability to achieve intended results, a minor one does not.

The certification audit is a two-stage process: Stage 1 assesses readiness and documentation, Stage 2 evaluates implementation and effectiveness.

Surveillance audits occur at least once a year, and recertification is required before the three-year certificate cycle ends.

An organization may not claim certification before the certificate is issued, and the certificate scope must match the audited QMS scope.