# Clause-by-Clause Evidence Guide

What a certification auditor samples for each ISO 9001:2015 clause, and the gaps that show up most often in a
first assessment. Use it to fill the `evidence` column honestly: "met" means you can show it, not that it happens.

| Clause | Evidence an auditor asks for | Common gap |
|--------|------------------------------|------------|
| 4.1 | Issues list (SWOT/PESTLE), date reviewed, climate-change relevance decision (Amd 1:2024) | Written once for certification, never reviewed; no climate statement |
| 4.2 | Interested-party register with their relevant requirements | Customers only; no regulators, owners, employees, key suppliers |
| 4.3 | Scope statement: products/services, sites, justified non-applicable clauses | Exclusion of 8.3 while the company changes customer designs; sites missing |
| 4.4 | Process map, process owners, KPIs per process, turtle diagrams or equivalent | Map is an org chart; no criteria or KPIs per process |
| 5.1 | Top management interview, review minutes, resource decisions | Delegated to the quality manager; MD cannot describe objectives |
| 5.2 | Signed policy, posted, staff can explain it in their own words | Generic policy copied from the internet; staff unaware |
| 5.3 | Org chart, job descriptions, named responsibilities for reporting QMS performance | Nobody named for reporting to top management |
| 6.1 | Risk/opportunity register linked to 4.1/4.2, actions, effectiveness review | No register, or a register with no actions or follow-up |
| 6.2 | Objectives with targets, owners, dates, resources, results tracking | Objectives without numbers or plans; not cascaded to functions |
| 6.3 | Change plan for reorganisations, new sites, new systems | Changes made without assessing QMS impact |
| 7.1.3-7.1.4 | Maintenance plan and records, environment controls (temperature, ESD, cleanliness) | Breakdown-only maintenance; no records |
| 7.1.5 | Calibration register, certificates traceable to national standards, status labels, out-of-tolerance impact assessments | Overdue gauges in use; no impact review when a gauge fails calibration |
| 7.1.6 | Lessons learned, technical files, knowledge-transfer for key people | Knowledge lives in one person's head |
| 7.2 | Competence matrix, training records, effectiveness evaluation | Attendance sheets only; no evidence the training worked |
| 7.3 | Interviews: people know the policy, their objectives, consequences of nonconformity | Operators cannot say how their work affects quality |
| 7.4 | Communication matrix (what, when, who, how) | Informal only |
| 7.5 | Document register, revision control, approval, obsolete control, record retention | Uncontrolled copies at workstations; records with no retention rule |
| 8.1 | Production plans, route cards, contingency plans | Planning in spreadsheets nobody controls |
| 8.2 | Quotation/contract review records, complaint log, customer communication | Orders accepted without review of capacity or special requirements |
| 8.3 | Design plan, inputs, reviews, verification, validation, change records | Design reviews not recorded; validation skipped |
| 8.4 | Supplier selection criteria, approved list, performance monitoring, purchase order requirements | Criteria exist but no re-evaluation; POs without quality requirements |
| 8.5.1 | Work instructions, inspection points, special process validation (welding, heat treat, plating) | Special processes not validated; instructions out of date |
| 8.5.2 | Labels, travellers, lot traceability back to material certs | Mixed lots; traceability lost at a rework step |
| 8.5.3 | Customer property log, reports of loss or damage | Customer-supplied material not identified |
| 8.5.4-8.5.5 | Packaging, storage, shelf life, warranty and service records | FIFO / shelf life not controlled |
| 8.5.6 | Change requests with review, approval, actions | Process changes made on the floor without records |
| 8.6 | Final inspection records with the releasing person's name | Release by "QC" stamp with no traceable person |
| 8.7 | NCR log, quarantine area, disposition authority, concessions | Nonconforming parts not segregated; use-as-is without authority |
| 9.1 | KPI dashboard, customer satisfaction method, data analysis | Data collected but never analysed or acted on |
| 9.2 | Audit programme covering all processes and clauses, independent auditors, reports, follow-up | No audit completed before stage 1; auditors audit their own work |
| 9.3 | Review minutes covering every required input and output | Inputs missing (risk actions, supplier performance); no decisions recorded |
| 10.2 | NCR/CAPA records: reaction, root cause, action, effectiveness review | Correction only; "operator retrained" as the root cause |
| 10.3 | Improvement projects with results | Improvement claimed but no measured results |

## Mandatory documented information

**Maintain (documents):** scope (4.3); documented information to support process operation (4.4); quality policy
(5.2); quality objectives (6.2); documented information to have confidence processes run as planned (8.1);
characteristics of products and activities and results to achieve (8.5.1).

**Retain (records):** evidence processes run as planned (4.4, 8.1); fitness of measuring resources and calibration basis
(7.1.5); competence (7.2); product/service requirement review (8.2.3); design inputs, controls, outputs and changes
(8.3.2-8.3.6); external provider evaluation (8.4.1); traceability when required (8.5.2); customer property loss
(8.5.3); production change review (8.5.6); release and conformity evidence (8.6); nonconforming output (8.7.2);
monitoring results (9.1.1); audit programme and results (9.2.2); management review results (9.3.3);
nonconformities and corrective actions (10.2.2).

Everything else (procedures, manual, flowcharts) is optional: write it only where its absence would cause errors.