ISO 9001:2015
Continue to control and audit the certified QMS against the applicable edition.
ISO 9001:2015 GUIDE
ISO 9001:2015 — Quality Management
Maintain a process-based quality management system that consistently meets customer and applicable requirements while improving performance and customer satisfaction.
RPG INTELLIGENCE ASSESSMENTAssess your ISO 9001:2015 readiness
Start this assessment →Open the controlled clause-based assessment, record evidence and generate a management-ready readiness result.
Overview
What this management system is designed to achieve
The established quality-management framework for controlling interconnected processes, addressing risk, evaluating performance and driving continual improvement during the transition period.
The value comes from integrating requirements into normal governance and operations—not producing documents solely for an audit.
EDITION, STATUS & CONTROL BASELINE
Use the correct published baseline
Confirm the applicable edition, amendments and transition arrangements with your certification body, then translate them into controlled implementation and assurance.
Amendment 1:2024
Determine whether climate change is a relevant issue and whether interested parties have related requirements.
Plan deliberately
Keep the 2015 system effective while changes needed for ISO 9001:2026 are evaluated and controlled.
Evidence before assertion
Use process trails, performance trends and objective evidence to test effectiveness.
The executive assurance brief
Each theme connects the standard to a leadership decision, corroborating evidence and an ISO 19011-aligned auditor challenge. Use it to test implementation, not document presence alone.
01
Process approach
- What to address
- The QMS is a connected system of processes, not a collection of clause documents.
- Leadership decision
- Define process ownership, sequence, interaction, criteria, resources, risks and expected results.
- Evidence to corroborate
- Process architecture, measures, responsibilities, operating criteria, interactions and management action.
- Auditor challenge
- Trace one customer requirement across process boundaries to verified delivery.
02
Customer focus
- What to address
- Customer and applicable requirements must shape leadership decisions and operational control.
- Leadership decision
- Set reliable methods for determining, reviewing and meeting requirements while addressing risks to satisfaction.
- Evidence to corroborate
- Contract review, customer communication, changes, performance, complaints and improvement decisions.
- Auditor challenge
- Where did customer evidence change a process, resource or priority?
03
Risk-based thinking
- What to address
- Risk and opportunity are integrated into planning and process control rather than treated as a separate exercise.
- Leadership decision
- Apply proportionate action to uncertainty affecting intended results and customer conformity.
- Evidence to corroborate
- Context, process risks, objectives, operational controls, change reviews and effectiveness evaluation.
- Auditor challenge
- Show how a material risk altered the design or control of a process.
04
Leadership accountability
- What to address
- Top management remains accountable for QMS effectiveness even where responsibilities are delegated.
- Leadership decision
- Integrate quality into business governance, provide resources and hold process owners accountable for results.
- Evidence to corroborate
- Decisions, objectives, resources, reviews, policy deployment, assigned authorities and follow-up.
- Auditor challenge
- What recent leadership decision improved QMS effectiveness?
05
Evidence-led performance
- What to address
- Monitoring, audit and management review must support conclusions and decisions, not merely report activity.
- Leadership decision
- Select measures and samples that reveal process capability, conformity, customer perception and emerging weakness.
- Evidence to corroborate
- Defined metrics, validated data, trends, audit trails, management-review outputs and action records.
- Auditor challenge
- Which measure predicts failure before it reaches the customer?
06
Climate relevance
- What to address
- Amendment 1:2024 explicitly adds climate-change consideration to context and interested-party review.
- Leadership decision
- Record a reasoned relevance conclusion and reflect material effects in risks, requirements, resources or controls.
- Evidence to corroborate
- Context review, interested-party needs, rationale, risk assessment, operational response and periodic review.
- Auditor challenge
- What evidence supports the organisation's climate relevance conclusion?
BOARD & MANAGEMENT REVIEW
Eight questions that expose readiness
Answers should be supported by current evidence, named accountability and a decision—not assurance language alone.
- 01Which customer and applicable requirements define QMS success?
- 02Where could process interaction or external provision undermine conformity?
- 03Which QMS risks require leadership attention or resources?
- 04How was climate-change relevance determined and recorded?
- 05Which quality objective is not achieving its intended result?
- 06What does current customer-perception evidence require management to change?
- 07Which internal-audit conclusion exposes a systemic weakness?
- 08How is corrective-action effectiveness verified after implementation?
ISO 19011-ALIGNED AUDIT TRAILS
Test the system end to end
Use risk-based sampling, interviews, observation, records and performance trends to corroborate whether controls operate as an interconnected management system.
Customer to deliveryTrace a sampled requirement through review, design where applicable, external provision, production or service, release and feedback.
Context to controlFollow a relevant issue or interested-party requirement into risk, objectives, process criteria and management review.
Supplier to conformitySample approval, requirements, monitoring, received output, performance evaluation and response to failure.
Nonconformity to effectivenessFollow containment, extent, cause, corrective action, system change and evidence of sustained effectiveness.
Key clauses explained
Open each clause for its requirement map, practical application, evidence and sampling prompts, auditor questions, weaknesses and required management output.
Clause 4Context of the organisationDefine the context, relevant parties, QMS boundary and interacting processes needed to achieve intended results.
Open audit guide
Define the context, relevant parties, QMS boundary and interacting processes needed to achieve intended results.
Requirement map
- 4.1 - relevant internal and external issues, including climate relevance
- 4.2 - relevant interested parties and their requirements, including climate-related requirements where applicable
- 4.3 - controlled QMS scope and justified applicability
- 4.4 - QMS processes, interactions, criteria, resources, responsibilities, risks and evaluation
Practical application
Review strategic, operational, regulatory, market, technology, supplier and climate-related conditions. Determine which interested-party needs affect the QMS, define a defensible boundary and make process ownership and interaction visible.
Objective evidence and sampling
Context and interested-party reviews; climate relevance rationale; scope; process maps; criteria; measures; responsibilities; risk and interaction records.
Auditor challenge questions
- Which changed issue affected the QMS most?
- Which interested-party requirement became an operating control?
- How are outsourced processes represented in the QMS?
Weakness and escalation indicators
Static SWOT analysis; no climate relevance decision; unsupported exclusions; scope avoiding difficult activity; process map without criteria or ownership.
Required management output
A controlled QMS scope and process architecture that drive planning, operation and assurance.
Assurance focus
Context relevance, Amendment 1:2024, interested-party needs, scope integrity and process interaction.
RPG control pathway
Assess the requirement, attach evidence and assign an accountable company user. A gap can create a controlled Finding and, where appropriate, escalate into CAPA-8D with cause analysis, due dates and effectiveness verification.
Discuss Clause 4 support →Clause 5LeadershipMake top management accountable for QMS effectiveness, customer focus, policy and clear organisational authority.
Open audit guide
Make top management accountable for QMS effectiveness, customer focus, policy and clear organisational authority.
Requirement map
- 5.1 - leadership commitment, process approach and customer focus
- 5.2 - establish, communicate and maintain the quality policy
- 5.3 - assign and communicate responsibilities and authorities
Practical application
Integrate QMS requirements into normal governance, align policy with direction, resource the system, appoint capable process owners and maintain focus on customer and applicable requirements.
Objective evidence and sampling
Leadership decisions; objectives; resources; policy deployment; customer-risk decisions; owner appointments; communications and review action.
Auditor challenge questions
- What accountability has top management retained?
- How does policy influence operational decisions?
- What evidence shows customer focus changed a decision?
Weakness and escalation indicators
QMS delegated to a coordinator; generic policy; nominal owners without authority; weak escalation; customer issues treated only after complaint.
Required management output
Visible leadership, customer-focused governance and accountable process ownership.
Assurance focus
Leadership behaviour, integration, customer confidence, resources and clear decision rights.
RPG control pathway
Assess the requirement, attach evidence and assign an accountable company user. A gap can create a controlled Finding and, where appropriate, escalate into CAPA-8D with cause analysis, due dates and effectiveness verification.
Discuss Clause 5 support →Clause 6PlanningConvert risk, opportunity and strategic intent into proportionate objectives, actions and controlled change.
Open audit guide
Convert risk, opportunity and strategic intent into proportionate objectives, actions and controlled change.
Requirement map
- 6.1 - determine and address risks and opportunities
- 6.2 - establish measurable quality objectives and plans
- 6.3 - plan QMS changes in a controlled manner
Practical application
Use context and process evidence to prioritise uncertainty, choose proportionate action, set objectives with measures and owners, and assess purpose, consequences, resources and responsibilities before change.
Objective evidence and sampling
Risk and opportunity records; rationale; objectives; baselines; action plans; resources; change assessments; approvals and evaluation results.
Auditor challenge questions
- Which risk was accepted and why?
- How will each objective be evaluated?
- What unintended effect was considered before change?
Weakness and escalation indicators
Generic risk register; objectives without measures or owners; opportunity recorded without action; change implemented without impact review.
Required management output
Prioritised, resourced and measurable plans connected to business and process performance.
Assurance focus
Proportionality, measurable objectives, planned change and evaluation of results.
RPG control pathway
Assess the requirement, attach evidence and assign an accountable company user. A gap can create a controlled Finding and, where appropriate, escalate into CAPA-8D with cause analysis, due dates and effectiveness verification.
Discuss Clause 6 support →Clause 7SupportProvide competent people, infrastructure, knowledge, communication and controlled information for reliable operation.
Open audit guide
Provide competent people, infrastructure, knowledge, communication and controlled information for reliable operation.
Requirement map
- 7.1 - resources, people, infrastructure, environment, monitoring resources and organisational knowledge
- 7.2 and 7.3 - competence and awareness
- 7.4 - internal and external communication
- 7.5 - creation and control of documented information
Practical application
Determine resources and competence before work begins, verify capability, preserve critical knowledge, assure monitoring validity, define communication and control information through approval, access, change, retention and disposition.
Objective evidence and sampling
Resource and capacity reviews; maintenance; calibration; knowledge controls; competence criteria and verification; communications; document approval, revision, access and retention.
Auditor challenge questions
- How is competence verified beyond attendance?
- What knowledge is vulnerable to loss?
- How is obsolete information prevented from use?
Weakness and escalation indicators
Attendance treated as competence; overdue calibration; tribal knowledge; uncontrolled local copies; communication with no understanding check.
Required management output
Capable people and dependable resources supported by current, available and protected information.
Assurance focus
Competence effectiveness, knowledge retention, measurement confidence and documented-information integrity.
RPG control pathway
Assess the requirement, attach evidence and assign an accountable company user. A gap can create a controlled Finding and, where appropriate, escalate into CAPA-8D with cause analysis, due dates and effectiveness verification.
Discuss Clause 7 support →Clause 8OperationControl the route from customer need to conforming product or service, including design, external provision, release and exceptions.
Open audit guide
Control the route from customer need to conforming product or service, including design, external provision, release and exceptions.
Requirement map
- 8.1 - operational planning and control
- 8.2 - determine, review and communicate product and service requirements
- 8.3 - control design and development where applicable
- 8.4 - control externally provided processes, products and services
- 8.5 to 8.7 - provision, identification, preservation, release and nonconforming outputs
Practical application
Set acceptance criteria and records, confirm requirements before commitment, control design stages, segment external providers by risk, protect traceability and customer property, authorise release and control nonconforming output and concessions.
Objective evidence and sampling
Contract reviews; specifications; plans; design inputs, reviews and validation; supplier approval and monitoring; work records; traceability; release and nonconformity decisions.
Auditor challenge questions
- Trace one requirement from enquiry to release.
- How does supplier criticality change control?
- Who may authorise release or concession?
Weakness and escalation indicators
Informal requirement changes; unjustified design exclusion; suppliers approved on price alone; release without evidence; rework hiding recurrence.
Required management output
Repeatable operational control with traceable requirements, verified release and controlled exceptions.
Assurance focus
Customer requirements, design integrity, external provision, operational change and conformity evidence.
RPG control pathway
Assess the requirement, attach evidence and assign an accountable company user. A gap can create a controlled Finding and, where appropriate, escalate into CAPA-8D with cause analysis, due dates and effectiveness verification.
Discuss Clause 8 support →Clause 9Performance evaluationDetermine whether processes and the QMS are performing, conforming and remaining suitable, adequate and effective.
Open audit guide
Determine whether processes and the QMS are performing, conforming and remaining suitable, adequate and effective.
Requirement map
- 9.1 - monitoring, measurement, analysis, evaluation and customer perception
- 9.2 - objective internal audit programme
- 9.3 - complete and decision-focused management review
Practical application
Define valid measures, methods, timing and thresholds; analyse trends; audit according to importance, change and previous results; retain management-review conclusions, decisions, resources and actions.
Objective evidence and sampling
Measure definitions; data and trends; customer feedback; audit programme, competence, reports and follow-up; management-review inputs, minutes, decisions and actions.
Auditor challenge questions
- Which indicator predicts process failure?
- How did risk and previous results shape the audit programme?
- Which review output changed the QMS?
Weakness and escalation indicators
Vanity metrics; customer survey without analysis; checklist-only audit; weak independence; management review without decisions or follow-through.
Required management output
Trusted conclusions and timely leadership decisions based on performance and assurance evidence.
Assurance focus
Data quality, customer perception, risk-based audit, reviewer competence and management action.
RPG control pathway
Assess the requirement, attach evidence and assign an accountable company user. A gap can create a controlled Finding and, where appropriate, escalate into CAPA-8D with cause analysis, due dates and effectiveness verification.
Discuss Clause 9 support →Clause 10ImprovementControl nonconformity, remove systemic causes and continually improve QMS suitability, adequacy and effectiveness.
Open audit guide
Control nonconformity, remove systemic causes and continually improve QMS suitability, adequacy and effectiveness.
Requirement map
- 10.1 - determine and select improvement opportunities
- 10.2 - react to nonconformity and implement effective corrective action
- 10.3 - continually improve the QMS
Practical application
Contain and correct the immediate issue, assess extent and recurrence, determine evidence-based causes, implement proportionate systemic action, update risks and controls and verify sustained effectiveness.
Objective evidence and sampling
Complaints and findings; correction and containment; extent review; cause evidence; CAPA-8D; updated controls; effectiveness criteria, checks, trends and lessons.
Auditor challenge questions
- How was the extent of condition established?
- Why does evidence support the root cause?
- What proves the action remained effective?
Weakness and escalation indicators
Correction labelled corrective action; default retraining; unsupported root cause; closure on task completion; repeat findings not escalated.
Required management output
Closed-loop improvement from issue through cause and action to independently verified effectiveness.
Assurance focus
Systemic cause, recurrence prevention, sustained effectiveness and organisational learning.
RPG control pathway
Assess the requirement, attach evidence and assign an accountable company user. A gap can create a controlled Finding and, where appropriate, escalate into CAPA-8D with cause analysis, due dates and effectiveness verification.
Discuss Clause 10 support →RPG EXCELLENCE SUPPORT
Discuss ISO 9001:2015 support →Move from understanding to controlled implementation.
Use RPG Excellence for gap analysis, implementation support, internal auditing, evidence control, findings, CAPA-8D and management reporting across a single or integrated system.