What a certification auditor samples for each ISO 9001:2015 clause, and the gaps that show up most often in a
first assessment. Use it to fill the evidence column honestly: "met" means you can show it, not that it happens.
| Clause | Evidence an auditor asks for | Common gap |
|---|---|---|
| 4.1 | Issues list (SWOT/PESTLE), date reviewed, climate-change relevance decision (Amd 1:2024) | Written once for certification, never reviewed; no climate statement |
| 4.2 | Interested-party register with their relevant requirements | Customers only; no regulators, owners, employees, key suppliers |
| 4.3 | Scope statement: products/services, sites, justified non-applicable clauses | Exclusion of 8.3 while the company changes customer designs; sites missing |
| 4.4 | Process map, process owners, KPIs per process, turtle diagrams or equivalent | Map is an org chart; no criteria or KPIs per process |
| 5.1 | Top management interview, review minutes, resource decisions | Delegated to the quality manager; MD cannot describe objectives |
| 5.2 | Signed policy, posted, staff can explain it in their own words | Generic policy copied from the internet; staff unaware |
| 5.3 | Org chart, job descriptions, named responsibilities for reporting QMS performance | Nobody named for reporting to top management |
| 6.1 | Risk/opportunity register linked to 4.1/4.2, actions, effectiveness review | No register, or a register with no actions or follow-up |
| 6.2 | Objectives with targets, owners, dates, resources, results tracking | Objectives without numbers or plans; not cascaded to functions |
| 6.3 | Change plan for reorganisations, new sites, new systems | Changes made without assessing QMS impact |
| 7.1.3-7.1.4 | Maintenance plan and records, environment controls (temperature, ESD, cleanliness) | Breakdown-only maintenance; no records |
| 7.1.5 | Calibration register, certificates traceable to national standards, status labels, out-of-tolerance impact assessments | Overdue gauges in use; no impact review when a gauge fails calibration |
| 7.1.6 | Lessons learned, technical files, knowledge-transfer for key people | Knowledge lives in one person's head |
| 7.2 | Competence matrix, training records, effectiveness evaluation | Attendance sheets only; no evidence the training worked |
| 7.3 | Interviews: people know the policy, their objectives, consequences of nonconformity | Operators cannot say how their work affects quality |
| 7.4 | Communication matrix (what, when, who, how) | Informal only |
| 7.5 | Document register, revision control, approval, obsolete control, record retention | Uncontrolled copies at workstations; records with no retention rule |
| 8.1 | Production plans, route cards, contingency plans | Planning in spreadsheets nobody controls |
| 8.2 | Quotation/contract review records, complaint log, customer communication | Orders accepted without review of capacity or special requirements |
| 8.3 | Design plan, inputs, reviews, verification, validation, change records | Design reviews not recorded; validation skipped |
| 8.4 | Supplier selection criteria, approved list, performance monitoring, purchase order requirements | Criteria exist but no re-evaluation; POs without quality requirements |
| 8.5.1 | Work instructions, inspection points, special process validation (welding, heat treat, plating) | Special processes not validated; instructions out of date |
| 8.5.2 | Labels, travellers, lot traceability back to material certs | Mixed lots; traceability lost at a rework step |
| 8.5.3 | Customer property log, reports of loss or damage | Customer-supplied material not identified |
| 8.5.4-8.5.5 | Packaging, storage, shelf life, warranty and service records | FIFO / shelf life not controlled |
| 8.5.6 | Change requests with review, approval, actions | Process changes made on the floor without records |
| 8.6 | Final inspection records with the releasing person's name | Release by "QC" stamp with no traceable person |
| 8.7 | NCR log, quarantine area, disposition authority, concessions | Nonconforming parts not segregated; use-as-is without authority |
| 9.1 | KPI dashboard, customer satisfaction method, data analysis | Data collected but never analysed or acted on |
| 9.2 | Audit programme covering all processes and clauses, independent auditors, reports, follow-up | No audit completed before stage 1; auditors audit their own work |
| 9.3 | Review minutes covering every required input and output | Inputs missing (risk actions, supplier performance); no decisions recorded |
| 10.2 | NCR/CAPA records: reaction, root cause, action, effectiveness review | Correction only; "operator retrained" as the root cause |
| 10.3 | Improvement projects with results | Improvement claimed but no measured results |
Mandatory documented information
Maintain (documents): scope (4.3); documented information to support process operation (4.4); quality policy (5.2); quality objectives (6.2); documented information to have confidence processes run as planned (8.1); characteristics of products and activities and results to achieve (8.5.1).
Retain (records): evidence processes run as planned (4.4, 8.1); fitness of measuring resources and calibration basis (7.1.5); competence (7.2); product/service requirement review (8.2.3); design inputs, controls, outputs and changes (8.3.2-8.3.6); external provider evaluation (8.4.1); traceability when required (8.5.2); customer property loss (8.5.3); production change review (8.5.6); release and conformity evidence (8.6); nonconforming output (8.7.2); monitoring results (9.1.1); audit programme and results (9.2.2); management review results (9.3.3); nonconformities and corrective actions (10.2.2).
Everything else (procedures, manual, flowcharts) is optional: write it only where its absence would cause errors.
8d-problem-solving-report-writer
Write and review 8D problem-solving reports for customer complaints and serious nonconformities (automotive and aerospace practice: Ford Global 8D, VDA, GM, Stellantis formats): D0 emergency response, D1 cross-functional team and champion, D2 problem description with 5W2H and is / is-not and no cause in the statement, D3 interim containment within 24 hours with verification and clean point, D4 verified occurrence and escape (non-detection) root causes plus systemic cause, D5 permanent corrective actions for each cause verified before implementation, D6 implementation, validation with production data and removal of containment, D7 PFMEA, control plan and read-across to similar products, D8 closure and recognition. Checks an 8D discipline by discipline for missing content, human-error root causes, missing escape cause or action, late containment and dates out of order.
acceptance-sampling-plan-selector
Select and evaluate acceptance sampling plans for incoming, in-process and final inspection: ANSI/ASQ Z1.4 / ISO 2859-1 single sampling under normal inspection (code letter from lot size and inspection level I, II, III, S-1 to S-4; sample size, Ac and Re from AQL, following the table's arrows to the correct plan; 100% when n reaches the lot size; AQLs above 10 per 100 units), operating characteristic curves (Pa at any quality, producer's quality level, indifference point, LTPD, AOQ and AOQL, binomial or hypergeometric), plans designed from producer and consumer risk, and c = 0 zero-acceptance plans. Covers AQL choice by defect class, switching rules between normal, tightened and reduced inspection, when sampling is not appropriate, and random sampling.
approved-supplier-list-manager
Manage and audit an approved supplier list (ASL) / external provider register for ISO 9001 8.4.1, IATF 16949 8.4 and AS9100 8.4.1: supplier status (approved, conditional, probation, pending, disqualified), scope of approval by commodity and process, risk class, certification and expiry, re-evaluation intervals by risk, conditions with end dates, single-source contingency, approver and customer-directed sources. Audits the list for expired or expiring certificates, overdue re-evaluations, conditional or probation status past its decision date, high-risk suppliers without the required certification, single-source suppliers without backup and missing approvers, and checks purchase orders for suppliers that are off-list, disqualified or pending, or buying outside the approved scope. Covers ERP blocks, PO requirements, off-list and emergency purchases.
apqp-phase-planner
Plan and track Advanced Product Quality Planning (AIAG APQP 3rd edition, IATF 16949) for a new or changed automotive part: back-schedule the five phases (plan and define, product design, process design, product and process validation, launch and feedback) from the start-of-production date by program complexity, with overlap, PPAP lead and safe-launch period; list the deliverables and gate for each phase (DFMEA, DVP&R, feasibility, process flow, PFMEA, control plans, MSA, Ppk, run at rate, PPAP, safe launch, lessons learned); adjust for build-to-print suppliers; flag compressed timelines and late or untracked deliverables against a status list. Covers gate reviews, red/yellow/green status reporting, run at rate and safe-launch exit criteria.
as9100-gap-analyzer
Run an AS9100D / EN 9100:2018 gap analysis for aviation, space and defence suppliers on the requirements added to ISO 9001: on-time delivery and conformity focus, management representative, ethics and human-factors awareness, operational planning and operational risk management, configuration management, product safety, counterfeit-part prevention, special requirements, critical items and key characteristics, external provider register and flow-down, FOD prevention, tooling and NC program control, special process validation, first article inspection (AS9102), traceability, in-service data and nonconforming product control. Generates and scores a worksheet, grades missing core controls as major, and checks invalid n/a claims. Covers AS9101/AS9104, OASIS, AS9102 FAI forms, counterfeit standards (AS5553, AS6174, AS6081), NADCAP and the planned IA9100 transition.
audit-report-writer
Write internal, supplier and pre-certification audit reports with the content ISO 19011:2018 6.5 expects: audit objectives, scope, criteria with revisions, dates, team and auditees, method and sampling statement, specific strengths, findings table and three-part finding details (requirement, evidence, statement), conclusion on the degree of fulfilment of criteria, diverging opinions, follow-up deadlines and distribution. Builds a Markdown report from a JSON audit record, generates the conclusion from the findings (major / minor / none) and flags reports missing required content or findings without clause or evidence. Covers conclusion wording, closing meetings, response expectations and verifying corrective actions.