ISO 9001:2015 Clause Guide

Plain-English guide to every auditable clause (requirements paraphrased; read the standard for exact wording). scripts/clause_lookup.py reads this file: keep the ### <clause> <title> headings and - **Field:** lines.

#4.1 Understanding the organization and its context

• Intent: Know the internal and external issues that can help or hurt the QMS achieving its results.
• Requires: Determine relevant issues (market, technology, legal, culture, resources); since Amd 1:2024 decide whether climate change is relevant; monitor and review them.
• Evidence: Issue list (SWOT/PESTLE) with review date; management review minutes discussing it; climate-change decision.
• Pitfalls: Written once for certification and never reviewed; issues unrelated to risks (6.1).
• Related: 4.2, 6.1, 9.3

#4.2 Understanding the needs and expectations of interested parties

• Intent: Know who can affect or is affected by the QMS and which of their requirements you adopt.
• Requires: Determine relevant interested parties and their relevant requirements; monitor and review.
• Evidence: Interested-party register (party, requirement, how met).
• Pitfalls: Customers only; requirements not traced into operations.
• Related: 4.1, 4.3, 6.1

#4.3 Determining the scope of the quality management system

• Intent: Define the boundaries: what products/services, which sites, which requirements apply.
• Requires: Scope as documented information stating products/services; justify any requirement not applicable (only if conformity is unaffected).
• Evidence: Scope statement in the manual and on the certificate.
• Pitfalls: Excluding design while making design decisions; missing sites.
• Related: 4.1, 4.2, 8.3

#4.4 Quality management system and its processes

• Intent: Manage the business as interacting processes with owners, criteria and measures.
• Requires: Determine processes, inputs/outputs, sequence and interaction, criteria and methods, resources, responsibilities, risks, evaluation and improvement; keep supporting documents and records.
• Evidence: Process map, interaction table or turtle diagrams, process KPIs.
• Pitfalls: Org chart presented as a process map; processes without measures.
• Related: 6.1, 8.1, 9.1

#5.1 Leadership and commitment

• Intent: Top management owns the QMS; it is not delegated to the quality department.
• Requires: Accountability for effectiveness; policy and objectives fit strategy; QMS integrated into business processes; process approach and risk-based thinking promoted; resources provided; customer focus maintained (5.1.2).
• Evidence: Interview with top management; review decisions; resource approvals.
• Pitfalls: Top management cannot explain objectives or results.
• Related: 5.2, 9.3

#5.2 Quality policy

• Intent: A short statement of intent that frames objectives and commits to requirements and improvement.
• Requires: Appropriate to purpose and context; framework for objectives; commitment to satisfy applicable requirements and to continual improvement; documented, communicated, understood, available to interested parties.
• Evidence: Signed policy; staff can say what it means for their job.
• Pitfalls: Generic slogans; staff unaware.
• Related: 5.1, 6.2, 7.3

#5.3 Organizational roles, responsibilities and authorities

• Intent: Everyone knows who is responsible and authorised for QMS tasks.
• Requires: Assign, communicate and understand responsibilities for QMS conformity, process outputs, reporting performance to top management, customer focus, integrity during change.
• Evidence: Org chart, job descriptions, authority matrix (release, concession, stop production).
• Pitfalls: Nobody assigned to report QMS performance; authorities exercised informally.
• Related: 5.1, 7.2

#6.1 Actions to address risks and opportunities

• Intent: Plan proportionate action on what could prevent the QMS achieving its results, and on opportunities.
• Requires: Consider 4.1 and 4.2; determine risks and opportunities; plan actions proportionate to their impact; integrate into processes; evaluate effectiveness.
• Evidence: Risk/opportunity register with actions, owners and review; links to FMEAs or business continuity plans.
• Pitfalls: Register with no actions or reviews; risks unrelated to context.
• Related: 4.1, 4.2, 9.3, 10.2

#6.2 Quality objectives and planning to achieve them

• Intent: Measurable targets that put the policy into practice at relevant functions.
• Requires: Objectives consistent with policy, measurable, monitored, communicated, updated; plan what, resources, who, when, how evaluated; keep as documented information.
• Evidence: Objectives register with baseline, target, owner, due date, progress.
• Pitfalls: No numbers; no plan; past due without results.
• Related: 5.2, 9.1, 9.3

#6.3 Planning of changes

• Intent: Change the QMS deliberately, not by accident.
• Requires: Consider purpose and consequences, QMS integrity, resources, allocation of responsibilities.
• Evidence: Change plans for reorganisations, new sites, new ERP systems.
• Pitfalls: Reorganisation leaves processes without owners.
• Related: 8.5.6, 9.3

#7.1.1 Resources - general

• Intent: Provide what the QMS needs.
• Requires: Determine and provide resources considering internal capability and external providers.
• Evidence: Budget and capacity decisions in management review.
• Pitfalls: Resource gaps known but never addressed.
• Related: 7.1.2, 9.3

#7.1.2 People

• Intent: Enough people to run and control the processes.
• Requires: Determine and provide the persons needed.
• Evidence: Staffing plans, shift coverage.
• Pitfalls: Key roles uncovered on night shift.
• Related: 7.2

#7.1.3 Infrastructure

• Intent: Buildings, equipment, software and transport fit for purpose.
• Requires: Determine, provide and maintain infrastructure.
• Evidence: Preventive maintenance plan and records; IT backups.
• Pitfalls: Breakdown-only maintenance with no records.
• Related: 7.1.4, 8.5.1

#7.1.4 Environment for the operation of processes

• Intent: The working conditions needed for conforming output.
• Requires: Determine, provide, maintain social, psychological and physical conditions (temperature, humidity, cleanliness, ESD, stress).
• Evidence: Environmental monitoring records where conditions affect product.
• Pitfalls: Temperature-sensitive measurement done in an uncontrolled area.
• Related: 7.1.3, 7.1.5

#7.1.5 Monitoring and measuring resources

• Intent: Measurements used to prove conformity are valid and traceable.
• Requires: Suitable, maintained resources; when traceability is required, calibrate or verify at intervals against traceable standards, identify status, safeguard from adjustment and damage, assess previous results when found unfit.
• Evidence: Calibration register, certificates, status labels, out-of-tolerance investigations.
• Pitfalls: Personal gauges uncontrolled; no impact assessment after a failed calibration.
• Related: 7.1.6, 8.5.1, 8.6

#7.1.6 Organizational knowledge

• Intent: Keep the know-how the processes depend on.
• Requires: Determine, maintain and make available necessary knowledge; plan how to gain new knowledge.
• Evidence: Lessons learned, technical files, succession and cross-training plans.
• Pitfalls: Critical knowledge held by one person.
• Related: 7.2

#7.2 Competence

• Intent: People doing work that affects quality are competent.
• Requires: Determine required competence; ensure competence by education, training or experience; act to close gaps and evaluate effectiveness; retain evidence.
• Evidence: Competence matrix, training records, effectiveness checks (observation, test, results).
• Pitfalls: Attendance sheets only; no competence criteria.
• Related: 7.3, 7.1.6

#7.3 Awareness

• Intent: People know the policy, their objectives, their contribution and the consequences of not conforming.
• Requires: Ensure awareness of policy, relevant objectives, contribution to effectiveness, implications of nonconformity.
• Evidence: Interviews; induction content; shop-floor boards.
• Pitfalls: Operators cannot say how their work affects the customer.
• Related: 5.2, 6.2, 7.2

#7.4 Communication

• Intent: Planned internal and external communication.
• Requires: Determine what, when, with whom, how and who communicates.
• Evidence: Communication matrix, meeting schedule.
• Pitfalls: Customer complaints not reaching production.
• Related: 8.2.1

#7.5 Documented information

• Intent: Control documents and records so the right version is used and evidence survives.
• Requires: Include required and needed documented information; identify, format, review and approve; control distribution, access, storage, preservation, changes, retention and disposition, including external documents.
• Evidence: Document register, approval records, obsolete control, retention schedule.
• Pitfalls: Uncontrolled copies on the floor; customer drawings not revision controlled.
• Related: 4.4, 8.5.1

#8.1 Operational planning and control

• Intent: Plan production and service delivery before doing it.
• Requires: Determine requirements, criteria, resources, documented information; control planned changes; control outsourced processes.
• Evidence: Production plans, routings, control plans, contingency plans.
• Pitfalls: Outsourced processes not planned or controlled.
• Related: 4.4, 6.1, 8.4

#8.2.1 Customer communication

• Intent: Clear communication with customers throughout.
• Requires: Product information, enquiries, contracts and changes, feedback and complaints, customer property, contingency actions.
• Evidence: Complaint log, customer correspondence.
• Pitfalls: Complaints handled informally by sales.
• Related: 9.1.2, 10.2

#8.2.2 Determining the requirements for products and services

• Intent: Know what you are promising.
• Requires: Define requirements including statutory and regulatory and those the organization considers necessary; be able to meet claims.
• Evidence: Specifications, regulatory requirement lists.
• Pitfalls: Regulatory requirements (RoHS, REACH, CE) not identified.
• Related: 8.2.3

#8.2.3 Review of the requirements for products and services

• Intent: Confirm you can deliver before you commit.
• Requires: Review stated, unstated but necessary, organization-defined, statutory requirements and differences before accepting; retain results and new requirements.
• Evidence: Contract/order review checklists, sign-offs.
• Pitfalls: Orders accepted without capacity or special requirement review.
• Related: 8.2.4, 8.1

#8.2.4 Changes to requirements for products and services

• Intent: Changes reach everyone affected.
• Requires: Amend documented information and make people aware of changed requirements.
• Evidence: Amended orders, revision notices to production.
• Pitfalls: Drawing revision changed but traveller still references the old one.
• Related: 7.5, 8.5.6

#8.3 Design and development of products and services

• Intent: A controlled path from inputs to validated outputs.
• Requires: Plan stages, reviews, verification and validation (8.3.2); determine inputs (8.3.3); apply controls (8.3.4); outputs that meet inputs (8.3.5); control changes (8.3.6); retain records.
• Evidence: Design plan, input list, review minutes, verification and validation reports, change records.
• Pitfalls: Validation skipped; changes made without review.
• Related: 4.3, 8.2

#8.4 Control of externally provided processes, products and services

• Intent: What you buy or outsource meets requirements.
• Requires: Criteria for evaluation, selection, performance monitoring and re-evaluation; controls proportionate to impact; verification; communicate requirements (approval, competence, controls, verification, inspection at supplier).
• Evidence: Approved supplier list, evaluations, scorecards, purchase orders with quality clauses, receiving inspection.
• Pitfalls: Re-evaluation never done; POs without drawing revision or quality requirements.
• Related: 8.1, 8.6, 9.1.3

#8.5.1 Control of production and service provision

• Intent: Production runs under controlled conditions.
• Requires: Documented characteristics and results to achieve; suitable measuring resources; monitoring at appropriate stages; suitable infrastructure and environment; competent people; validation of special processes; actions to prevent human error; release, delivery and post-delivery controls.
• Evidence: Work instructions, inspection points, special process validation, error proofing.
• Pitfalls: Special processes (welding, heat treat, coating) not validated.
• Related: 7.1.5, 7.2, 8.6

#8.5.2 Identification and traceability

• Intent: Know what each item is, its status, and where it came from when traceability is required.
• Requires: Identify outputs and their monitoring status; control unique identification and retain records when traceability is required.
• Evidence: Labels, travellers, heat/lot numbers back to material certificates.
• Pitfalls: Traceability lost at rework or mixed lots.
• Related: 8.7

#8.5.3 Property belonging to customers or external providers

• Intent: Look after what belongs to others.
• Requires: Identify, verify, protect, safeguard; report loss, damage or unsuitability to the owner and retain records. Includes material, tooling, IP and personal data.
• Evidence: Customer property log, loss reports.
• Pitfalls: Customer drawings or data not recognised as customer property.
• Related: 8.2.1

#8.5.4 Preservation

• Intent: Product stays conforming through handling, storage and delivery.
• Requires: Preserve outputs (identification, handling, contamination control, packaging, storage, transmission, transport, protection).
• Evidence: Packaging specs, storage conditions, shelf-life control, FIFO.
• Pitfalls: Damage in internal handling; expired materials used.
• Related: 8.5.2

#8.5.5 Post-delivery activities

• Intent: Meet obligations after delivery.
• Requires: Consider legal requirements, potential undesired consequences, product life, customer requirements and feedback.
• Evidence: Warranty records, service reports, recall procedure.
• Pitfalls: Warranty returns not analysed.
• Related: 8.2, 10.2

#8.5.6 Control of changes

• Intent: Production changes are reviewed before they are made.
• Requires: Review and control changes for production or service provision; retain records of the review, the authoriser and actions.
• Evidence: Change requests, approvals, trial results.
• Pitfalls: Machine, material or method changed on the floor without review.
• Related: 6.3, 8.3.6

#8.6 Release of products and services

• Intent: Nothing ships until planned verification shows it conforms.
• Requires: Implement planned arrangements to verify requirements are met; no release until complete unless approved by authority (and customer where applicable); retain evidence of conformity and traceability to the releasing person.
• Evidence: Final inspection records, CoCs, release signatures.
• Pitfalls: Release stamp not traceable to a person; shipping before inspection.
• Related: 8.5.1, 8.7

#8.7 Control of nonconforming outputs

• Intent: Nonconforming product is caught and not used by mistake.
• Requires: Identify and control nonconforming outputs; correct, segregate, contain, return, suspend, inform the customer, or obtain concession; verify conformity after correction; retain records of the nonconformity, actions, concessions and the authority deciding.
• Evidence: NCR log, quarantine area, disposition records, concessions.
• Pitfalls: Use-as-is without authority; nonconforming parts not segregated.
• Related: 8.6, 10.2

#9.1.1 Monitoring, measurement, analysis and evaluation - general

• Intent: Measure what matters and use it.
• Requires: Determine what to monitor, methods, when to monitor and to analyse; evaluate performance and effectiveness; retain results.
• Evidence: KPI dashboard, measurement plan.
• Pitfalls: Data collected, never analysed.
• Related: 4.4, 6.2, 9.1.3

#9.1.2 Customer satisfaction

• Intent: Know how customers perceive you.
• Requires: Monitor perception of how needs and expectations are met; determine methods.
• Evidence: Surveys, customer scorecards, complaints, returns, delivery performance.
• Pitfalls: Annual survey with 3 responses as the only input.
• Related: 8.2.1, 9.3

#9.1.3 Analysis and evaluation

• Intent: Turn data into decisions.
• Requires: Analyse conformity, satisfaction, QMS performance, planning, risk actions, external providers, improvement needs.
• Evidence: Trend charts, Pareto analyses, management review inputs.
• Pitfalls: Charts without conclusions.
• Related: 9.3, 10.1

#9.2 Internal audit

• Intent: Independent check that the QMS conforms and works.
• Requires: Audit programme at planned intervals considering importance, changes and previous results; criteria and scope per audit; objective auditors; report to management; correction and corrective action without undue delay; retain evidence.
• Evidence: Audit programme, plans, checklists, reports, follow-up.
• Pitfalls: Not every process audited in the cycle; auditors audit their own work.
• Related: 9.3, 10.2

#9.3 Management review

• Intent: Top management reviews the QMS and decides.
• Requires: Planned intervals; inputs: previous actions, context changes, performance (satisfaction, objectives, process performance, nonconformities, monitoring, audits, suppliers), resources, risk action effectiveness, improvement opportunities; outputs: improvement, changes, resources; retain records.
• Evidence: Minutes covering every input, decisions with owners and dates.
• Pitfalls: Inputs missing; no decisions recorded; top management absent.
• Related: 5.1, 6.1, 9.1, 10.3

#10.1 Improvement - general

• Intent: Look for improvement deliberately.
• Requires: Determine and select opportunities; improve products and services, correct and prevent undesired effects, improve QMS performance.
• Evidence: Improvement projects and results.
• Pitfalls: Improvement claimed without data.
• Related: 10.3

#10.2 Nonconformity and corrective action

• Intent: Fix the problem and its cause so it does not recur.
• Requires: React (control and correct, deal with consequences); evaluate need to eliminate causes (review, determine causes, check for similar nonconformities); implement action; review effectiveness; update risks and the QMS; retain records.
• Evidence: CAPA records with root cause, actions, effectiveness review.
• Pitfalls: "Operator retrained" as root cause; no effectiveness check.
• Related: 8.7, 6.1

#10.3 Continual improvement

• Intent: The QMS gets better over time.
• Requires: Continually improve suitability, adequacy and effectiveness using analysis and management review outputs.
• Evidence: KPI trends improving; improvement decisions from management review.
• Pitfalls: Flat or worsening trends with no response.
• Related: 9.3, 10.1