An old quality manual, a checklist from somewhere else

Not nonconformities in themselves

• "Management representative": the 2015 standard requires responsibility and authority for the QMS to be assigned and communicated (5.3); it does not require that title. The operations director's job description does this. No NC - but verify the assignment is understood, not just written.
• "Master list" and 2009-era language: a quality manual is not required documented information. Retaining one is a choice; dated wording is not a breach.
• External calibration: using an external laboratory satisfies 7.1.5 perfectly well. The clause cannot be excluded where measuring is used to prove conformity, but if the activity is actually performed, there is no gap in the activity.

Nonconformities

• 8.3 (design and development): bespoke fixtures are designed for ~30% of orders. The exclusion is not justified, and there are no review, verification or validation records. That is a substantive system failure, and a candidate for major.
• 4.3 (scope): the documented scope and exclusions do not describe what the organisation actually does. The manual says design is excluded while design is a routine activity.

The point to carry: obsolete terminology is cosmetic; a false claim about scope is a control failure. Auditing the document's wording instead of the organisation's activity gets this exactly backwards.

The checklist is a memory aid, never the criteria. It came from another organisation, which means it encodes another organisation's risks and another standard revision. Used as a script it will produce two kinds of error: findings against requirements that no longer exist, and silence on requirements that do.

The criteria, in order of authority

1. ISO 9001:2015 - the requirements themselves.
2. The organisation's own documented information - QP-07, the manual, job descriptions, procedures. These are criteria because the organisation has committed to them, and they can be stricter than the standard.
3. Contractual and statutory/regulatory requirements applying to the products and the shop.

Note what is not on the list: best practice, another client's system, the auditor's preferred software, or last year's checklist.

Practical use: convert the checklist into coverage prompts tied to the shop's processes - quoting, fixture design, machining, inspection, calibration, complaints - and keep the clause list only as a final sweep to confirm nothing was missed. Before the closing meeting, ask of each checklist item: "which criterion does this come from?" If there is no answer, drop it.

Agree with the first half, correct the second.

• Yes: ISO 9001:2015 does not require a quality manual. There is no nonconformity for failing to have one, and none for having an old one.
• But the standard does require documented information to be appropriate and adequate for the organisation's activities (7.5.2), and the organisation's own documents are among the audit criteria. A manual that states design is excluded, when a third of orders involve bespoke design, is evidence about scope and about the adequacy of the documented information - both relevant to 4.3 and 7.5.
• The manual is not the finding. The finding is that the organisation's description of its own system does not match its activities. That stands whether the description sits in a manual, a wiki or a signed poster.

What I would write

• Nonconformities against 8.3 and 4.3, evidenced by the fixture orders, the CAD files and the absent design records.
• An observation that the manual is out of date and misdescribes the system, with the note that no manual is required - so the auditee's options include retiring it, not only updating it.

Tone matters: the client hears "you're auditing my paperwork". Show that the audit is about the fixtures that ship without design review, and the manual point becomes what it is - a symptom, not the disease.