# ISO 9001:2015 Clause Guide

Plain-English guide to every auditable clause (requirements paraphrased; read the standard for exact wording).
`scripts/clause_lookup.py` reads this file: keep the `### <clause> <title>` headings and `- **Field:**` lines.

### 4.1 Understanding the organization and its context
- **Intent:** Know the internal and external issues that can help or hurt the QMS achieving its results.
- **Requires:** Determine relevant issues (market, technology, legal, culture, resources); since Amd 1:2024 decide whether climate change is relevant; monitor and review them.
- **Evidence:** Issue list (SWOT/PESTLE) with review date; management review minutes discussing it; climate-change decision.
- **Pitfalls:** Written once for certification and never reviewed; issues unrelated to risks (6.1).
- **Related:** 4.2, 6.1, 9.3

### 4.2 Understanding the needs and expectations of interested parties
- **Intent:** Know who can affect or is affected by the QMS and which of their requirements you adopt.
- **Requires:** Determine relevant interested parties and their relevant requirements; monitor and review.
- **Evidence:** Interested-party register (party, requirement, how met).
- **Pitfalls:** Customers only; requirements not traced into operations.
- **Related:** 4.1, 4.3, 6.1

### 4.3 Determining the scope of the quality management system
- **Intent:** Define the boundaries: what products/services, which sites, which requirements apply.
- **Requires:** Scope as documented information stating products/services; justify any requirement not applicable (only if conformity is unaffected).
- **Evidence:** Scope statement in the manual and on the certificate.
- **Pitfalls:** Excluding design while making design decisions; missing sites.
- **Related:** 4.1, 4.2, 8.3

### 4.4 Quality management system and its processes
- **Intent:** Manage the business as interacting processes with owners, criteria and measures.
- **Requires:** Determine processes, inputs/outputs, sequence and interaction, criteria and methods, resources, responsibilities, risks, evaluation and improvement; keep supporting documents and records.
- **Evidence:** Process map, interaction table or turtle diagrams, process KPIs.
- **Pitfalls:** Org chart presented as a process map; processes without measures.
- **Related:** 6.1, 8.1, 9.1

### 5.1 Leadership and commitment
- **Intent:** Top management owns the QMS; it is not delegated to the quality department.
- **Requires:** Accountability for effectiveness; policy and objectives fit strategy; QMS integrated into business processes; process approach and risk-based thinking promoted; resources provided; customer focus maintained (5.1.2).
- **Evidence:** Interview with top management; review decisions; resource approvals.
- **Pitfalls:** Top management cannot explain objectives or results.
- **Related:** 5.2, 9.3

### 5.2 Quality policy
- **Intent:** A short statement of intent that frames objectives and commits to requirements and improvement.
- **Requires:** Appropriate to purpose and context; framework for objectives; commitment to satisfy applicable requirements and to continual improvement; documented, communicated, understood, available to interested parties.
- **Evidence:** Signed policy; staff can say what it means for their job.
- **Pitfalls:** Generic slogans; staff unaware.
- **Related:** 5.1, 6.2, 7.3

### 5.3 Organizational roles, responsibilities and authorities
- **Intent:** Everyone knows who is responsible and authorised for QMS tasks.
- **Requires:** Assign, communicate and understand responsibilities for QMS conformity, process outputs, reporting performance to top management, customer focus, integrity during change.
- **Evidence:** Org chart, job descriptions, authority matrix (release, concession, stop production).
- **Pitfalls:** Nobody assigned to report QMS performance; authorities exercised informally.
- **Related:** 5.1, 7.2

### 6.1 Actions to address risks and opportunities
- **Intent:** Plan proportionate action on what could prevent the QMS achieving its results, and on opportunities.
- **Requires:** Consider 4.1 and 4.2; determine risks and opportunities; plan actions proportionate to their impact; integrate into processes; evaluate effectiveness.
- **Evidence:** Risk/opportunity register with actions, owners and review; links to FMEAs or business continuity plans.
- **Pitfalls:** Register with no actions or reviews; risks unrelated to context.
- **Related:** 4.1, 4.2, 9.3, 10.2

### 6.2 Quality objectives and planning to achieve them
- **Intent:** Measurable targets that put the policy into practice at relevant functions.
- **Requires:** Objectives consistent with policy, measurable, monitored, communicated, updated; plan what, resources, who, when, how evaluated; keep as documented information.
- **Evidence:** Objectives register with baseline, target, owner, due date, progress.
- **Pitfalls:** No numbers; no plan; past due without results.
- **Related:** 5.2, 9.1, 9.3

### 6.3 Planning of changes
- **Intent:** Change the QMS deliberately, not by accident.
- **Requires:** Consider purpose and consequences, QMS integrity, resources, allocation of responsibilities.
- **Evidence:** Change plans for reorganisations, new sites, new ERP systems.
- **Pitfalls:** Reorganisation leaves processes without owners.
- **Related:** 8.5.6, 9.3

### 7.1.1 Resources - general
- **Intent:** Provide what the QMS needs.
- **Requires:** Determine and provide resources considering internal capability and external providers.
- **Evidence:** Budget and capacity decisions in management review.
- **Pitfalls:** Resource gaps known but never addressed.
- **Related:** 7.1.2, 9.3

### 7.1.2 People
- **Intent:** Enough people to run and control the processes.
- **Requires:** Determine and provide the persons needed.
- **Evidence:** Staffing plans, shift coverage.
- **Pitfalls:** Key roles uncovered on night shift.
- **Related:** 7.2

### 7.1.3 Infrastructure
- **Intent:** Buildings, equipment, software and transport fit for purpose.
- **Requires:** Determine, provide and maintain infrastructure.
- **Evidence:** Preventive maintenance plan and records; IT backups.
- **Pitfalls:** Breakdown-only maintenance with no records.
- **Related:** 7.1.4, 8.5.1

### 7.1.4 Environment for the operation of processes
- **Intent:** The working conditions needed for conforming output.
- **Requires:** Determine, provide, maintain social, psychological and physical conditions (temperature, humidity, cleanliness, ESD, stress).
- **Evidence:** Environmental monitoring records where conditions affect product.
- **Pitfalls:** Temperature-sensitive measurement done in an uncontrolled area.
- **Related:** 7.1.3, 7.1.5

### 7.1.5 Monitoring and measuring resources
- **Intent:** Measurements used to prove conformity are valid and traceable.
- **Requires:** Suitable, maintained resources; when traceability is required, calibrate or verify at intervals against traceable standards, identify status, safeguard from adjustment and damage, assess previous results when found unfit.
- **Evidence:** Calibration register, certificates, status labels, out-of-tolerance investigations.
- **Pitfalls:** Personal gauges uncontrolled; no impact assessment after a failed calibration.
- **Related:** 7.1.6, 8.5.1, 8.6

### 7.1.6 Organizational knowledge
- **Intent:** Keep the know-how the processes depend on.
- **Requires:** Determine, maintain and make available necessary knowledge; plan how to gain new knowledge.
- **Evidence:** Lessons learned, technical files, succession and cross-training plans.
- **Pitfalls:** Critical knowledge held by one person.
- **Related:** 7.2

### 7.2 Competence
- **Intent:** People doing work that affects quality are competent.
- **Requires:** Determine required competence; ensure competence by education, training or experience; act to close gaps and evaluate effectiveness; retain evidence.
- **Evidence:** Competence matrix, training records, effectiveness checks (observation, test, results).
- **Pitfalls:** Attendance sheets only; no competence criteria.
- **Related:** 7.3, 7.1.6

### 7.3 Awareness
- **Intent:** People know the policy, their objectives, their contribution and the consequences of not conforming.
- **Requires:** Ensure awareness of policy, relevant objectives, contribution to effectiveness, implications of nonconformity.
- **Evidence:** Interviews; induction content; shop-floor boards.
- **Pitfalls:** Operators cannot say how their work affects the customer.
- **Related:** 5.2, 6.2, 7.2

### 7.4 Communication
- **Intent:** Planned internal and external communication.
- **Requires:** Determine what, when, with whom, how and who communicates.
- **Evidence:** Communication matrix, meeting schedule.
- **Pitfalls:** Customer complaints not reaching production.
- **Related:** 8.2.1

### 7.5 Documented information
- **Intent:** Control documents and records so the right version is used and evidence survives.
- **Requires:** Include required and needed documented information; identify, format, review and approve; control distribution, access, storage, preservation, changes, retention and disposition, including external documents.
- **Evidence:** Document register, approval records, obsolete control, retention schedule.
- **Pitfalls:** Uncontrolled copies on the floor; customer drawings not revision controlled.
- **Related:** 4.4, 8.5.1

### 8.1 Operational planning and control
- **Intent:** Plan production and service delivery before doing it.
- **Requires:** Determine requirements, criteria, resources, documented information; control planned changes; control outsourced processes.
- **Evidence:** Production plans, routings, control plans, contingency plans.
- **Pitfalls:** Outsourced processes not planned or controlled.
- **Related:** 4.4, 6.1, 8.4

### 8.2.1 Customer communication
- **Intent:** Clear communication with customers throughout.
- **Requires:** Product information, enquiries, contracts and changes, feedback and complaints, customer property, contingency actions.
- **Evidence:** Complaint log, customer correspondence.
- **Pitfalls:** Complaints handled informally by sales.
- **Related:** 9.1.2, 10.2

### 8.2.2 Determining the requirements for products and services
- **Intent:** Know what you are promising.
- **Requires:** Define requirements including statutory and regulatory and those the organization considers necessary; be able to meet claims.
- **Evidence:** Specifications, regulatory requirement lists.
- **Pitfalls:** Regulatory requirements (RoHS, REACH, CE) not identified.
- **Related:** 8.2.3

### 8.2.3 Review of the requirements for products and services
- **Intent:** Confirm you can deliver before you commit.
- **Requires:** Review stated, unstated but necessary, organization-defined, statutory requirements and differences before accepting; retain results and new requirements.
- **Evidence:** Contract/order review checklists, sign-offs.
- **Pitfalls:** Orders accepted without capacity or special requirement review.
- **Related:** 8.2.4, 8.1

### 8.2.4 Changes to requirements for products and services
- **Intent:** Changes reach everyone affected.
- **Requires:** Amend documented information and make people aware of changed requirements.
- **Evidence:** Amended orders, revision notices to production.
- **Pitfalls:** Drawing revision changed but traveller still references the old one.
- **Related:** 7.5, 8.5.6

### 8.3 Design and development of products and services
- **Intent:** A controlled path from inputs to validated outputs.
- **Requires:** Plan stages, reviews, verification and validation (8.3.2); determine inputs (8.3.3); apply controls (8.3.4); outputs that meet inputs (8.3.5); control changes (8.3.6); retain records.
- **Evidence:** Design plan, input list, review minutes, verification and validation reports, change records.
- **Pitfalls:** Validation skipped; changes made without review.
- **Related:** 4.3, 8.2

### 8.4 Control of externally provided processes, products and services
- **Intent:** What you buy or outsource meets requirements.
- **Requires:** Criteria for evaluation, selection, performance monitoring and re-evaluation; controls proportionate to impact; verification; communicate requirements (approval, competence, controls, verification, inspection at supplier).
- **Evidence:** Approved supplier list, evaluations, scorecards, purchase orders with quality clauses, receiving inspection.
- **Pitfalls:** Re-evaluation never done; POs without drawing revision or quality requirements.
- **Related:** 8.1, 8.6, 9.1.3

### 8.5.1 Control of production and service provision
- **Intent:** Production runs under controlled conditions.
- **Requires:** Documented characteristics and results to achieve; suitable measuring resources; monitoring at appropriate stages; suitable infrastructure and environment; competent people; validation of special processes; actions to prevent human error; release, delivery and post-delivery controls.
- **Evidence:** Work instructions, inspection points, special process validation, error proofing.
- **Pitfalls:** Special processes (welding, heat treat, coating) not validated.
- **Related:** 7.1.5, 7.2, 8.6

### 8.5.2 Identification and traceability
- **Intent:** Know what each item is, its status, and where it came from when traceability is required.
- **Requires:** Identify outputs and their monitoring status; control unique identification and retain records when traceability is required.
- **Evidence:** Labels, travellers, heat/lot numbers back to material certificates.
- **Pitfalls:** Traceability lost at rework or mixed lots.
- **Related:** 8.7

### 8.5.3 Property belonging to customers or external providers
- **Intent:** Look after what belongs to others.
- **Requires:** Identify, verify, protect, safeguard; report loss, damage or unsuitability to the owner and retain records. Includes material, tooling, IP and personal data.
- **Evidence:** Customer property log, loss reports.
- **Pitfalls:** Customer drawings or data not recognised as customer property.
- **Related:** 8.2.1

### 8.5.4 Preservation
- **Intent:** Product stays conforming through handling, storage and delivery.
- **Requires:** Preserve outputs (identification, handling, contamination control, packaging, storage, transmission, transport, protection).
- **Evidence:** Packaging specs, storage conditions, shelf-life control, FIFO.
- **Pitfalls:** Damage in internal handling; expired materials used.
- **Related:** 8.5.2

### 8.5.5 Post-delivery activities
- **Intent:** Meet obligations after delivery.
- **Requires:** Consider legal requirements, potential undesired consequences, product life, customer requirements and feedback.
- **Evidence:** Warranty records, service reports, recall procedure.
- **Pitfalls:** Warranty returns not analysed.
- **Related:** 8.2, 10.2

### 8.5.6 Control of changes
- **Intent:** Production changes are reviewed before they are made.
- **Requires:** Review and control changes for production or service provision; retain records of the review, the authoriser and actions.
- **Evidence:** Change requests, approvals, trial results.
- **Pitfalls:** Machine, material or method changed on the floor without review.
- **Related:** 6.3, 8.3.6

### 8.6 Release of products and services
- **Intent:** Nothing ships until planned verification shows it conforms.
- **Requires:** Implement planned arrangements to verify requirements are met; no release until complete unless approved by authority (and customer where applicable); retain evidence of conformity and traceability to the releasing person.
- **Evidence:** Final inspection records, CoCs, release signatures.
- **Pitfalls:** Release stamp not traceable to a person; shipping before inspection.
- **Related:** 8.5.1, 8.7

### 8.7 Control of nonconforming outputs
- **Intent:** Nonconforming product is caught and not used by mistake.
- **Requires:** Identify and control nonconforming outputs; correct, segregate, contain, return, suspend, inform the customer, or obtain concession; verify conformity after correction; retain records of the nonconformity, actions, concessions and the authority deciding.
- **Evidence:** NCR log, quarantine area, disposition records, concessions.
- **Pitfalls:** Use-as-is without authority; nonconforming parts not segregated.
- **Related:** 8.6, 10.2

### 9.1.1 Monitoring, measurement, analysis and evaluation - general
- **Intent:** Measure what matters and use it.
- **Requires:** Determine what to monitor, methods, when to monitor and to analyse; evaluate performance and effectiveness; retain results.
- **Evidence:** KPI dashboard, measurement plan.
- **Pitfalls:** Data collected, never analysed.
- **Related:** 4.4, 6.2, 9.1.3

### 9.1.2 Customer satisfaction
- **Intent:** Know how customers perceive you.
- **Requires:** Monitor perception of how needs and expectations are met; determine methods.
- **Evidence:** Surveys, customer scorecards, complaints, returns, delivery performance.
- **Pitfalls:** Annual survey with 3 responses as the only input.
- **Related:** 8.2.1, 9.3

### 9.1.3 Analysis and evaluation
- **Intent:** Turn data into decisions.
- **Requires:** Analyse conformity, satisfaction, QMS performance, planning, risk actions, external providers, improvement needs.
- **Evidence:** Trend charts, Pareto analyses, management review inputs.
- **Pitfalls:** Charts without conclusions.
- **Related:** 9.3, 10.1

### 9.2 Internal audit
- **Intent:** Independent check that the QMS conforms and works.
- **Requires:** Audit programme at planned intervals considering importance, changes and previous results; criteria and scope per audit; objective auditors; report to management; correction and corrective action without undue delay; retain evidence.
- **Evidence:** Audit programme, plans, checklists, reports, follow-up.
- **Pitfalls:** Not every process audited in the cycle; auditors audit their own work.
- **Related:** 9.3, 10.2

### 9.3 Management review
- **Intent:** Top management reviews the QMS and decides.
- **Requires:** Planned intervals; inputs: previous actions, context changes, performance (satisfaction, objectives, process performance, nonconformities, monitoring, audits, suppliers), resources, risk action effectiveness, improvement opportunities; outputs: improvement, changes, resources; retain records.
- **Evidence:** Minutes covering every input, decisions with owners and dates.
- **Pitfalls:** Inputs missing; no decisions recorded; top management absent.
- **Related:** 5.1, 6.1, 9.1, 10.3

### 10.1 Improvement - general
- **Intent:** Look for improvement deliberately.
- **Requires:** Determine and select opportunities; improve products and services, correct and prevent undesired effects, improve QMS performance.
- **Evidence:** Improvement projects and results.
- **Pitfalls:** Improvement claimed without data.
- **Related:** 10.3

### 10.2 Nonconformity and corrective action
- **Intent:** Fix the problem and its cause so it does not recur.
- **Requires:** React (control and correct, deal with consequences); evaluate need to eliminate causes (review, determine causes, check for similar nonconformities); implement action; review effectiveness; update risks and the QMS; retain records.
- **Evidence:** CAPA records with root cause, actions, effectiveness review.
- **Pitfalls:** "Operator retrained" as root cause; no effectiveness check.
- **Related:** 8.7, 6.1

### 10.3 Continual improvement
- **Intent:** The QMS gets better over time.
- **Requires:** Continually improve suitability, adequacy and effectiveness using analysis and management review outputs.
- **Evidence:** KPI trends improving; improvement decisions from management review.
- **Pitfalls:** Flat or worsening trends with no response.
- **Related:** 9.3, 10.1