ISO 9001:2026 Quality management systems — Requirements

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of ISO document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).

ISO draws attention to the possibility that the implementation of this document may involve the use of (a) patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a) patent(s) which may be required to implement this document. However, implementers are cautioned that this may not represent the latest information, which may be obtained from the patent database available at www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO’s adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.

This document was prepared by Technical Committee ISO/TC 176, Quality management and quality assurance, Subcommittee SC 2, Quality systems, in collaboration with the European Committee for Standardization (CEN), in accordance with the Agreement on technical cooperation between ISO and CEN (Vienna Agreement).

This sixth edition cancels and replaces the fifth edition (ISO 9001:2015), which has been technically revised. It also incorporates the Amendment ISO 9001:2015/Amd 1:2024.

The main changes are as follows:

Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html.

0.1 General

Establishing and implementing a quality management system is a strategic decision for an organization that supports improved performance, enhances customer satisfaction, and provides a foundation for sustained success and sustainable development initiatives.

The potential benefits to an organization of implementing a quality management system based on the requirements in this document are:

1. a) the ability to consistently provide products and services that meet customer and applicable statutory and regulatory requirements;
2. b) facilitating opportunities to enhance customer satisfaction;
3. c) addressing risks and opportunities associated with its context and objectives;
4. d) the ability to demonstrate conformity to quality management system requirements.

This document can be used by internal and external parties.

This document does not imply the need for:

The quality management system requirements in this document are complementary to requirements for products and services.

Consistently meeting requirements and addressing future needs and expectations of customers and other relevant interested parties poses a challenge for organizations in an increasingly dynamic and complex environment. To achieve this objective, the organization can pursue continual improvement in various ways, such as incremental or breakthrough change, innovation or reorganization initiatives.

Annex A provides information and clarifications that can support understanding of the structure, terms and clauses of this document. It does not contain any additional requirements.

For guidance on the application of all clauses in this document, see ISO 9002 [1].

0.2 Quality management principles

This document is based on the quality management principles described in ISO 9000 [2]. The descriptions include a statement of each principle, a rationale of why the principle is important for the organization, some examples of benefits associated with the principle and examples of actions to improve the organization’s performance when applying the principle.

The quality management principles are:

0.3.1 General

This document promotes the adoption of a process approach when establishing, implementing and improving the effectiveness of a quality management system, to enhance customer satisfaction by meeting customer requirements. Specific requirements considered essential to the application of a process approach are included in 4.4.

Understanding and managing interrelated processes as a system contributes to the organization’s effectiveness and efficiency in achieving its intended results. This approach enables the organization to control the interrelationships and interdependencies among the processes of the system, so that the overall performance of the organization can be enhanced.

The process approach involves the systematic determination and management of processes, and their interactions, so as to achieve the intended results in accordance with the quality policy and strategic direction of the organization. Management of the processes and the system as a whole can be achieved using the Plan-Do-Check-Act (PDCA) cycle (see 0.3.2) with an overall focus on risk-based thinking (see A.6.1.2) aimed at preventing undesired results, and opportunity-based thinking (see A.6.1.3) aimed at pursuing desired results by taking advantage of opportunities.

The application of the process approach in a quality management system enables:

1. a) understanding and consistency in meeting requirements;
2. b) consideration of processes in terms of risk, opportunity and added value;
3. c) achievement of effective process performance;
4. d) improvement of processes based on the results of evaluation of data and information.

Figure 1 gives a schematic representation of any single process and shows the interaction of its elements. The monitoring and measuring check points, which are necessary for control, are specific to each process and will vary depending on the process steps and related risks.

Figure 1

0.3.2 Plan-Do-Check-Act cycle

The PDCA cycle can be briefly described as follows:

The PDCA cycle can be applied to all processes and to the quality management system as a whole. Figure 2 illustrates how Clause 4 to Clause 10 can be grouped in relation to the PDCA cycle.

Figure 2

NOTE

Numbers in brackets refer to the clauses in this document.

0.4 Relationship with other management system standards

This document applies the harmonized approach as published in the ISO/IEC Directives related to the development of management system standards. The intention is to support alignment and facilitate the integration of the requirements and recommendations of one or more management system standards into an organization’s management system.

For more information, see https://www.iso.org/management-system-standards.html.

This document provides a basis for an organization to apply the process approach, coupled with the PDCA cycle, risk-based thinking and opportunity-based thinking, in order to align or integrate its quality management system with the requirements of other management system standards.

This document relates to the following standards:

This document does not include requirements specific to other management systems, such as those for environmental management, occupational health and safety management, or asset management.

Sector-specific ISO quality management system standards based on the requirements of this document have been developed. Some of these standards specify additional quality management system requirements, while others are limited to providing guidance to the application of this document within the particular sector.

1 Scope

This document specifies requirements for a quality management system when an organization:

1. a) needs to demonstrate its ability to consistently provide products and services that meet customer and applicable statutory and regulatory requirements;
2. b) aims to enhance customer satisfaction through the effective application of the system, including processes for improvement of the system and the assurance of conformity to customer and applicable statutory and regulatory requirements.

All the requirements of this document are generic.

This document is applicable to any organization, regardless of its type or size, or the products and services it provides.

NOTE 1

In this document, the terms “product” or “service” only apply to products and services intended for, or required by, a customer.

NOTE 2

Statutory and regulatory requirements can be expressed as legal requirements.

2 Normative references

The following documents are referred to in the text in such a way that some or all of their content constitutes requirements of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

• ISO 9000 Quality management — Fundamentals and vocabulary

3 Terms and definitions

For the purposes of this document, the terms and definitions given in ISO 9000 and the following apply.

ISO and IEC maintain terminology databases for use in standardization at the following addresses:

3.1 organization

3.2 interested party

3.3 top management

3.4 management system

3.4.1 quality management system

3.5 policy

3.5.1 quality policy

3.6 objective

3.6.1 quality objective

3.7 risk

3.8 process

3.9 competence

3.10 documented information

3.11 performance

3.12 continual improvement

3.13 effectiveness

3.14 requirement

3.15 conformity

3.16 nonconformity

3.17 corrective action

3.18 audit

3.19 measurement

3.20 monitoring

4.1 Understanding the organization and its context

The organization shall determine external and internal issues that are relevant to its purpose and its strategic direction and that affect its ability to achieve the intended result(s) of its quality management system.

The organization shall determine whether climate change is a relevant issue.

The organization shall monitor and review information about these external and internal issues.

NOTE 1

Issues can include positive and negative factors or conditions for consideration.

NOTE 2

Understanding the external context can be facilitated by considering legal, technological, competitive, market, cultural, political, social, economic and environmental issues at the international, national, regional or local level.

NOTE 3

Understanding the internal context can be facilitated by considering issues related to the organization’s strategic direction, values, culture, resources, knowledge and performance.

4.2 Understanding the needs and expectations of interested parties

The organization shall determine:

1. a) the interested parties that are relevant to the quality management system;
2. b) the relevant requirements of these interested parties;
3. c) which of these requirements will be addressed through the quality management system.

The organization shall monitor and review information about these interested parties and their relevant requirements.

NOTE

Relevant interested parties can have requirements related to climate change.

4.3 Determining the scope of the quality management system

The organization shall determine the boundaries and applicability of the quality management system to establish its scope.

When determining this scope, the organization shall consider:

1. a) the external and internal issues referred to in 4.1;
2. b) the requirements referred to in 4.2;
3. c) the products and services of the organization.

The organization shall apply all the requirements of this document if they are applicable within the determined scope of its quality management system.

The scope shall state the types of products and services covered.

The scope shall include justification for any requirement of this document that the organization determines is not applicable to its quality management system.

The scope shall be available as documented information.

Conformity to this document can only be claimed if the requirements determined as not being applicable do not affect the organization’s ability or responsibility to ensure the conformity of its products and services and the enhancement of customer satisfaction.

4.4.1

The organization shall establish, implement, maintain and continually improve a quality management system, including the processes needed and their interactions, in accordance with the requirements of this document.

The organization shall:

1. a) determine the processes needed for the quality management system and their application throughout the organization;
2. b) determine the inputs required and the outputs expected from these processes;
3. c) determine the sequence and interaction of these processes;
4. d) determine and apply the criteria and methods needed (including monitoring, measurements and related performance indicators) to ensure the effective operation and control of these processes;
5. e) determine the resources needed for these processes and ensure their availability;
6. f) assign the responsibilities and authorities for these processes;
7. g) address the risks and opportunities as determined in accordance with the requirements of 6.1;
8. h) evaluate these processes and implement any changes needed to ensure that these processes achieve their intended results;
9. i) improve the processes and the quality management system.

4.4.2

Documented information shall be available to the extent necessary:

1. a) to support the operation of the organization’s processes;
2. b) as evidence that the processes are being carried out as planned.

5.1.1 General

Top management shall demonstrate leadership and commitment with respect to the quality management system by:

1. a) ensuring that the quality policy and quality objectives are established and are compatible with the strategic direction of the organization;
2. b) ensuring the integration of the quality management system requirements into the organization’s business processes;
3. c) ensuring that the resources needed for the quality management system are available;
4. d) communicating the importance of effective quality management and of conforming to the quality management system requirements;
5. e) ensuring that the quality management system achieves its intended result(s);
6. f) directing and supporting persons to contribute to the effectiveness of the quality management system;
7. g) promoting continual improvement;
8. h) supporting other relevant roles to demonstrate their leadership, as it applies to their areas of responsibility;
9. i) promoting quality culture and ethical behaviour;
10. j) promoting the use of the process approach;
11. k) promoting risk-based thinking and opportunity-based thinking;
12. l) taking accountability for the effectiveness of the quality management system.

NOTE 1

Reference to “business” in this document can be interpreted broadly to mean those activities that are core to the purposes of the organization’s existence.

NOTE 2

An organization’s quality culture and ethical behaviour are reflected in its shared values, attitudes, practices and actions.

5.1.2 Customer focus

Top management shall demonstrate leadership and commitment with respect to customer focus by ensuring that:

1. a) customer and applicable statutory and regulatory requirements are determined, understood and consistently met;
2. b) the risks and opportunities that can affect conformity of products and services and the ability to enhance customer satisfaction are determined and addressed;
3. c) the focus on enhancing customer satisfaction is maintained.

5.2.1

Top management shall establish a quality policy that:

1. a) is appropriate to the purpose of the organization;
2. b) provides a framework for setting quality objectives;
3. c) includes a commitment to meet applicable requirements;
4. d) includes a commitment to continual improvement of the quality management system;
5. e) takes into account the context of the organization and supports its strategic direction.

5.2.2

The quality policy shall:

1. a) be available as documented information;
2. b) be communicated within the organization;
3. c) be available to interested parties, as appropriate;
4. d) be implemented, understood and applied within the organization.

5.3 Roles, responsibilities and authorities

Top management shall ensure that the responsibilities and authorities for relevant roles are assigned and communicated within the organization.

Top management shall assign the responsibility and authority for:

1. a) ensuring that the quality management system conforms to the requirements of this document;
2. b) reporting on the performance of the quality management system to top management;
3. c) ensuring that the processes are delivering their intended results;
4. d) ensuring the promotion of customer focus throughout the organization;
5. e) reporting on opportunities for improvement to top management;
6. f) ensuring that the integrity of the quality management system is maintained, including when changes to the quality management system are planned and implemented.

6.1.1 Determining risks and opportunities

When planning for the quality management system, the organization shall consider the issues referred to in 4.1 and the requirements referred to in 4.2 and determine the risks and opportunities that need to be addressed to:

1. a) give assurance that the quality management system can achieve its intended result(s);
2. b) prevent, or reduce, undesired effects;
3. c) achieve continual improvement;
4. d) enhance desired effects.

6.1.2 Actions to address risks

The organization shall determine, analyse and evaluate risks that can have an undesired effect on its ability to continually and consistently provide conforming products and services and enhance customer satisfaction.

The organization shall plan:

1. a) actions to address these risks;
2. b) how to:
   • 1) integrate and implement the actions into its quality management system processes;
   • 2) evaluate the effectiveness of these actions.

Actions taken shall be proportionate to the potential impact of the risks on the intended results of the quality management system.

NOTE 1

Determined risks can include risks related to the ability to provide conforming products and services during and after a disruption.  

NOTE 2

Actions to address risks can include avoiding risk, taking risk in order to pursue an opportunity, eliminating the risk source, changing the likelihood or consequences, sharing the risk or retaining risk by informed decision.

6.1.3 Actions to address opportunities

The organization shall determine, analyse and evaluate opportunities that can have a desired effect on its ability to continually and consistently provide conforming products and services and enhance customer satisfaction.

The organization shall plan: 

1. a) actions to address these opportunities;
2. b) how to:
   • 1) integrate and implement the actions into its quality management system processes;
   • 2) evaluate the effectiveness of these actions.

Actions taken to address opportunities shall be appropriate to the organization’s context and support the achievement of desired results.

NOTE

Actions to address opportunities can include adopting new practices, launching new products or services, creating new partnerships, leveraging emerging technologies, implementing initiatives, and other actions to address the current and changing needs and expectations of an organization’s customers and other relevant interested parties.

6.2.1

The organization shall establish quality objectives at relevant functions, levels and processes.

The quality objectives shall:

1. a) be consistent with the quality policy;
2. b) be measurable;
3. c) take into account applicable requirements;
4. d) be monitored;
5. e) be communicated;
6. f) be updated as appropriate;
7. g) be available as documented information;
8. h) be relevant to the conformity of products and services and the ability to enhance customer satisfaction.

6.2.2

When planning how to achieve its quality objectives, the organization shall determine:

1. a) what will be done;
2. b) what resources will be required;
3. c) who will be responsible;
4. d) when it will be completed;
5. e) how the results will be evaluated.

6.3 Planning of changes

When the organization determines the need for changes to the quality management system, the changes shall be carried out in a planned manner.

To ensure changes are implemented effectively to achieve intended results, the organization shall consider:

1. a) the purpose of the changes and their potential consequences;
2. b) the potential impact on the integrity of the quality management system;
3. c) the availability of resources and information;
4. d) the allocation or reallocation of responsibilities and authorities;
5. e) the communication of the changes;
6. f) how the effectiveness of the changes will be monitored and evaluated;
7. g) how the results of the changes will be reviewed.

7.1.1 General

The organization shall determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the quality management system.

The organization shall consider:

1. a) the capabilities of, and constraints on, existing internal resources;
2. b) what needs to be obtained from external providers.

7.1.2 People

The organization shall determine and provide the persons necessary for the effective implementation of its quality management system and for the operation and control of its processes.

7.1.3 Infrastructure

The organization shall determine, provide and maintain the infrastructure necessary for the operation of its processes and to achieve conformity of products and services.

NOTE

For all types of work (e.g. on site, remote or a combination thereof) infrastructure can include:

1. a) buildings and associated utilities;
2. b) equipment, including hardware and software;
3. c) transportation resources;
4. d) information and communication technology.

7.1.4 Environment for the operation of processes

The organization shall determine, provide and maintain the environment necessary for the operation of its processes and to achieve conformity of products and services.

NOTE

A suitable environment can include a combination of factors, which can differ depending on the products and services provided. Relevant factors can include:

1. a) social (e.g. non-discriminatory, calm, non-confrontational);
2. b) psychological (e.g. stress-reducing, burnout prevention, emotionally protective);
3. c) physical (e.g. temperature, heat, humidity, light, airflow, hygiene, noise).

Some factors can be influenced by the organizational quality culture and ethical behaviour.

7.1.5.1 General

The organization shall determine and provide the resources needed to ensure valid and reliable results when monitoring or measuring is used to verify the conformity of products and services to requirements.

The organization shall ensure that the resources provided:

1. a) are suitable for the specific type of monitoring and measurement activities being undertaken;
2. b) are maintained to ensure their continuing fitness for their purpose.

Appropriate documented information shall be available as evidence of fitness for purpose of the monitoring and measurement resources.

7.1.5.2 Traceability of measurement results

When traceability of measurement results is a requirement, or is considered by the organization to be an essential part of providing confidence in the validity of measurement results, measuring equipment shall be:

1. a) calibrated or verified, or both, at specified intervals, or prior to use, against measurement standards traceable to international or national measurement standards; when no such measurement standards exist, the basis used for calibration or verification shall be available as documented information;
2. b) identified in order to determine its calibration or verification status;
3. c) safeguarded from adjustments, damage or deterioration that can invalidate measurement results.

When measuring equipment is found to be unfit for its intended purpose, the organization shall determine whether the validity of previous measurement results has been adversely affected and shall take appropriate action as necessary.

7.1.6 Organizational knowledge

The organization shall determine the knowledge necessary for the operation of its processes and to achieve the intended results of its quality management system.

This knowledge shall be retained, applied and shared to the extent necessary.

When addressing changing needs and trends, the organization shall consider its current knowledge and determine how to acquire or access any necessary additional knowledge and required updates.

NOTE

Organizational knowledge can take different forms, such as:

7.2 Competence

The organization shall:

1. a) determine the necessary competence of person(s) doing work under its control that affects its quality management system performance;
2. b) ensure that these persons are competent on the basis of appropriate education, training or experience;
3. c) where applicable, take actions to acquire the necessary competence, and evaluate the effectiveness of the actions taken.

Appropriate documented information shall be available as evidence of competence.

NOTE

Applicable actions can include, for example: the provision of training to, the mentoring of or the re-assignment of currently employed persons; or the hiring or contracting of competent persons.

7.3 Awareness

The organization shall ensure that persons doing work under the organization’s control are aware of:

1. a) the quality policy;
2. b) their contribution to the effectiveness of the quality management system, including the benefits of improved performance;
3. c) the implications of not conforming to the quality management system requirements;
4. d) relevant quality objectives;
5. e) the organizational quality culture and ethical behaviour.

7.4 Communication

The organization shall determine the internal and external communications relevant to the quality management system, including:

1. a) on what it will communicate;
2. b) when to communicate;
3. c) with whom to communicate;
4. d) how to communicate;
5. e) who communicates.

7.5.1 General

The organization’s quality management system shall include:

1. a) documented information required by this document;
2. b) documented information determined by the organization as being necessary for the effectiveness of the quality management system.

NOTE

The extent of documented information for a quality management system can differ from one organization to another due to:

7.5.2 Creating and updating documented information

When creating and updating documented information, the organization shall ensure appropriate:

1. a) identification and description (e.g. a title, date, author, reference number);
2. b) format (e.g. language, software version, graphics) and media (e.g. paper, electronic);
3. c) review and approval for suitability and adequacy.

7.5.3.1

Documented information required by the quality management system and by this document shall be controlled to ensure:

1. a) it is available and suitable for use, where and when it is needed;
2. b) it is adequately protected (e.g. from loss of confidentiality, improper use or loss of integrity).

7.5.3.2

For the control of documented information, the organization shall address the following activities, as applicable:

1. a) distribution, access, retrieval and use;
2. b) storage and preservation, including preservation of legibility;
3. c) control of changes (e.g. version control);
4. d) retention and disposition.

Documented information of external origin determined by the organization to be necessary for the planning and operation of the quality management system shall be identified as appropriate and controlled.

Documented information available as evidence of conformity shall be protected from unintended alterations.

NOTE

Access can imply a decision regarding the permission to view the documented information only, or the permission and authority to view and change the documented information.

8.1 Operational planning and control

The organization shall plan, implement and control the processes needed to meet requirements for the provision of products and services, and to implement the actions determined in Clause 6, by:

1. a) determining the requirements for products and services (see 8.2);
2. b) establishing criteria for the acceptance of products and services;
3. c) establishing criteria for the processes;
4. d) implementing control of the processes in accordance with the criteria;
5. e) determining the resources needed to achieve conformity to the product and service requirements.

Documented information shall be available to the extent necessary to have confidence that the processes have been carried out as planned.

The organization shall control planned changes and review the consequences of unintended changes, taking action to mitigate any adverse effects, as necessary.

The organization shall ensure that externally provided processes, products or services that are relevant to the quality management system are controlled (see 8.4).

Documented information shall be available to the extent necessary as evidence of the conformity of products and services.

8.2.1 Customer communication

Communication with customers shall include:

1. a) providing information relating to products and services;
2. b) handling enquiries, contracts or orders, including changes;
3. c) obtaining customer feedback relating to products and services, including customer complaints;
4. d) handling or controlling customer property;
5. e) providing information related to contingency actions, when relevant, including any related to disruptions to the provision of products or services.

NOTE

Customer communication can include direct contacts through meetings, emails and document exchange or indirectly through website content, publications, social media, responses to frequently asked questions and training.

8.2.2 Determining requirements for products and services

When determining the requirements for the products and services to be offered to customers, the organization shall ensure that:

1. a) the requirements for the products and services are defined, including:
   • 1) any applicable statutory and regulatory requirements;
   • 2) those considered necessary by the organization;
2. b) it can meet the claims for the products and services it offers.

8.2.3.1

The organization shall ensure that it has the ability to meet the requirements for the products and services to be offered to customers. Before committing to supply products and services to a customer, the organization shall conduct a review that includes:

1. a) requirements defined by the customer, including requirements for delivery and post-delivery activities when applicable;
2. b) requirements not defined by the customer, but necessary for the specified or intended use, when known;
3. c) requirements specified by the organization;
4. d) statutory and regulatory requirements applicable to the products and services;
5. e) contract or order requirements differing from those previously expressed.

The organization shall ensure that contract or order requirements differing from those previously defined are resolved.

When the customer does not provide a documented statement of their requirements, the organization shall confirm the customer requirements before acceptance.

NOTE

In some situations, such as internet sales, a formal review is impractical for each order. Instead, the review can cover relevant product or service information, such as websites or catalogues.

8.2.3.2

Documented information shall be available, as applicable, as evidence of:

1. a) the results of the review;
2. b) any new or changed requirements for the products and services.

8.2.4 Changes to requirements for products and services

When requirements for products and services are changed, the organization shall ensure that the relevant documented information is updated and communicated to the relevant interested parties.

8.3.1 General

The organization shall establish, implement and maintain a design and development process that is appropriate to ensure the subsequent provision of products and services.

NOTE

The design and development process can include cycles of review, verification, validation and feedback, allowing for an iterative approach throughout the design and development stages.

8.3.2 Design and development planning

In determining the stages and controls for design and development, the organization shall consider:

1. a) the nature, duration and complexity of the design and development activities;
2. b) the required process stages, including applicable design and development reviews;
3. c) the required design and development verification and validation activities;
4. d) the responsibilities and authorities involved in the design and development process;
5. e) the internal and external resource needs for the design and development of products and services;
6. f) the need to control interfaces between persons involved in the design and development process;
7. g) the need for involvement of customers and other relevant interested parties in the design and development process;
8. h) the requirements for the subsequent provision of products and services;
9. i) the level of control expected for the design and development process by customers and other relevant interested parties;
10. j) the documented information needed as evidence that design and development requirements have been met.

8.3.3 Design and development inputs

The organization shall determine the requirements essential for the specific types of products and services to be designed and developed. The organization shall consider:

1. a) functional and performance requirements;
2. b) information derived from previous similar design and development activities;
3. c) statutory and regulatory requirements;
4. d) standards or codes of practice that it has committed to implement;
5. e) the potential consequences of failure due to the nature of the products and services.

Inputs shall be complete, unambiguous and adequate for design and development purposes.

Conflicting design and development inputs shall be resolved.

Documented information shall be available as evidence of design and development inputs.

NOTE

Design and development inputs are not always fully defined or known initially. Instead, they can evolve as the design progresses, through repeated cycles of development activity.

8.3.4 Design and development controls

The organization shall apply controls to the design and development process to ensure that:

1. a) the results to be achieved are defined;
2. b) reviews are conducted to evaluate the ability of the results of design and development to meet requirements;
3. c) verification activities are conducted to ensure that the design and development outputs meet the input requirements;
4. d) validation activities are conducted to ensure that the resulting products and services meet the requirements for the specified application or intended use;
5. e) necessary actions are taken to address problems determined during the reviews, or verification and validation activities;
6. f) documented information is available as evidence of these activities.

NOTE

Design and development reviews, verification and validation have distinct purposes. They can be conducted separately or in any combination, as is suitable for the products and services of the organization.

8.3.5 Design and development outputs

The organization shall ensure that design and development outputs:

1. a) meet the input requirements;
2. b) are adequate for the subsequent processes for the provision of products and services;
3. c) include or reference monitoring and measuring requirements, as appropriate, and acceptance criteria;
4. d) specify the characteristics of the products and services, and the information on the products and services, that are essential for their intended purpose including their safe and proper provision.

Documented information shall be available as evidence of design and development outputs.

8.3.6 Design and development changes

The organization shall determine, review and control changes made during, or subsequent to, the design and development of products and services, to the extent necessary to ensure that there is no adverse impact on conformity to requirements.

Documented information shall be available as evidence of:

1. a) design and development changes;
2. b) results of reviews;
3. c) authorization of the changes;
4. d) actions taken to prevent adverse impacts.

8.4.1 General

The organization shall ensure that externally provided processes, products and services conform to requirements.

The organization shall determine the controls to be applied to externally provided processes, products and services when:

1. a) products and services from external providers are intended for incorporation into the organization’s own products and services;
2. b) products and services are provided directly to customers by external providers on behalf of the organization;
3. c) a process, or part of a process, is provided by an external provider.

The organization shall determine and apply criteria for the evaluation, selection, monitoring of performance, and re-evaluation of external providers, based on their ability to provide processes, products or services in accordance with requirements.

Documented information shall be available as evidence of these activities and any necessary actions arising from the evaluations.

8.4.2 Type and extent of control

The organization shall ensure that externally provided processes, products and services do not adversely affect the organization’s ability to consistently deliver conforming products and services to its customers.

The organization shall:

1. a) ensure that externally provided processes are within the control of its quality management system;
2. b) define both the controls that it intends to apply to an external provider and those it intends to apply to the resulting output;
3. c) take into account:
   • 1) the potential impact of the externally provided processes, products and services on the organization’s ability to consistently meet customer and applicable statutory and regulatory requirements;
   • 2) the effectiveness of the controls applied by the external provider;
4. d) determine the verification, or other activities, necessary to ensure that the externally provided processes, products and services meet the requirements.

8.4.3 Information for external providers

The organization shall ensure the adequacy of requirements prior to their communication to the external provider.

The organization shall communicate its requirements to external providers, as appropriate, for:

1. a) the processes, products and services to be provided;
2. b) the approval of:
   • 1) products and services;
   • 2) methods, processes and equipment;
   • 3) the release of products and services;
3. c) competence, including any required qualifications;
4. d) the external providers’ interactions with the organization and, as applicable, its customers and other relevant interested parties;
5. e) the control and monitoring it applies to the performance of its external providers;
6. f) verification or validation activities that the organization, or its customer, intends to perform at the external providers’ premises or other location.

8.5.1 Control of production and service provision

The organization shall implement production and service provision under controlled conditions.

The controlled conditions shall include, as applicable:

1. a) the availability and use of documented information that defines:
   • 1) the characteristics of the products or services;
   • 2) the activities to be performed;
   • 3) the results to be achieved;
2. b) the availability and use of suitable monitoring and measuring resources;
3. c) the implementation of monitoring and measurement activities at appropriate stages to verify that criteria for control of processes or their outputs, and acceptance criteria for products and services, have been met;
4. d) the use of suitable infrastructure and environment for the operation of processes;
5. e) the appointment of competent persons, including any required qualifications;
6. f) the validation, and periodic revalidation, of the ability to achieve planned results of the processes for production and service provision, where the resulting output cannot be verified by subsequent monitoring or measurement;
7. g) the implementation of actions to prevent human error;
8. h) the implementation of release, delivery and post-delivery activities.

8.5.2 Identification and traceability

The organization shall:

1. a) use suitable means to identify outputs when it is necessary to ensure the conformity of products and services;
2. b) identify the status of outputs with respect to monitoring and measurement requirements throughout production and service provision;
3. c) control the unique identification of the outputs when traceability is a requirement;
4. d) ensure that documented information necessary to enable traceability is available as evidence.

8.5.3 Property belonging to customers or external providers

The organization shall exercise care with property belonging to customers or external providers while it is under the organization’s control or being used by the organization.

The organization shall identify, verify, protect and safeguard property belonging to customers or external providers that is provided for use or incorporation into the products and services.

When the property belonging to a customer or external provider is lost, damaged or otherwise found to be unsuitable for use, the organization shall report this to the customer or external provider. Documented information shall be available as evidence of what has occurred.

NOTE

Property belonging to a customer or external provider can include materials, components, tools and equipment, premises, intellectual property and personal data.

8.5.4 Preservation

The organization shall preserve the outputs during production and service provision, to the extent necessary to ensure conformity to requirements.

NOTE

Preservation can include identification, handling, contamination control, packaging, storage, transmission or transportation, and protection.

8.5.5 Post-delivery activities

The organization shall meet the requirements for post-delivery activities associated with the products and services.

In determining the extent of post-delivery activities that are required, the organization shall consider:

1. a) statutory and regulatory requirements;
2. b) the potential undesired consequences associated with its products and services;
3. c) the nature, use and intended lifetime of its products and services;
4. d) customer requirements;
5. e) customer feedback.

NOTE

Post-delivery activities can include actions under warranty provisions, contractual obligations such as maintenance services, and supplementary services such as recycling or final disposal.

8.5.6 Control of changes

The organization shall review and control changes for production or service provision, to the extent necessary to ensure continuing conformity to requirements.

Documented information shall be available as evidence of the results of the review of changes, the person(s) authorizing the change and any necessary actions arising from the review.

8.6 Release of products and services

The organization shall implement planned arrangements, at appropriate stages, to verify that the product and service requirements have been met.

The release of products and services to the customer shall not proceed until the planned arrangements have been satisfactorily completed, unless otherwise approved by a relevant authority and, as applicable, by the customer.

Documented information shall be available as evidence of the release of products and services. The documented information shall include:

1. a) evidence of conformity to the acceptance criteria;
2. b) traceability to the person(s) authorizing the release.

8.7.1

The organization shall ensure that outputs that do not conform to requirements are identified and controlled to prevent their unintended use or delivery.

The organization shall take appropriate action based on the nature of the nonconformity and its effect on the conformity of products and services. This includes nonconformities detected after product delivery or during or after service provision.

The organization shall deal with nonconforming outputs in one or more of the following ways:

1. a) correction;
2. b) segregation, containment, return or suspension of provision of products and services;
3. c) informing the customer;
4. d) obtaining authorization for acceptance under concession.

When nonconforming outputs are corrected, the organization shall verify conformity to the requirements.

8.7.2

Documented information shall be available as evidence of:

1. a) the nature of the nonconformity;
2. b) the actions taken;
3. c) any concessions obtained;
4. d) the authority deciding the action in respect of the nonconformity.

9.1.1 General

The organization shall determine:

1. a) what needs to be monitored and measured;
2. b) the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results;
3. c) when the monitoring and measuring shall be performed;
4. d) when the results from monitoring and measurement shall be analysed and evaluated.

The organization shall evaluate the performance and the effectiveness of the quality management system.

Documented information shall be available as evidence of the results.

9.1.2 Customer satisfaction

The organization shall monitor customer satisfaction. The organization shall determine the methods for obtaining, monitoring and reviewing customer satisfaction information.

NOTE

Sources of information to support understanding of customer satisfaction can include customer surveys, customer feedback on delivered products and services, meetings with customers, market-share analysis, compliments, complaints, warranty claims, dealer reports or social media.

9.1.3 Analysis and evaluation

The organization shall analyse and evaluate relevant data and information arising from monitoring and measurement.

The results of analysis shall be used to evaluate:

1. a) the conformity of products and services;
2. b) customer satisfaction;
3. c) the performance and effectiveness of the quality management system;
4. d) the effectiveness of planning implementation;
5. e) the effectiveness of actions taken to address risks;
6. f) the effectiveness of actions taken to address opportunities;
7. g) the performance of external providers;
8. h) the need for improvements to the quality management system.

NOTE

Methods to analyse data can include statistical techniques.

9.2.1 General

The organization shall conduct internal audits at planned intervals to provide information on whether the quality management system:

1. a) conforms to:
   • 1) the organization’s own requirements for its quality management system;
   • 2) the requirements of this document;
2. b) is effectively implemented and maintained.

9.2.2 Internal audit programme

The organization shall plan, establish, implement and maintain (an) audit programme(s), including the frequency, methods, responsibilities, planning requirements and reporting.

When establishing the internal audit programme(s), the organization shall consider the importance of the processes concerned, the results of previous audits and changes affecting the organization.

The organization shall:

1. a) define the audit objectives, criteria and scope for each audit;
2. b) select auditors and conduct audits to ensure objectivity and the impartiality of the audit process;
3. c) ensure that the results of audits are reported to relevant managers;
4. d) take appropriate correction and corrective actions without undue delay.

Documented information shall be available as evidence of the implementation of the audit programme(s) and the audit results.

NOTE

See ISO 19011 [4] for guidance on auditing management systems.

9.3.1 General

Top management shall review the organization’s quality management system, at planned intervals, to ensure its continuing suitability, adequacy, effectiveness and alignment with the strategic direction of the organization.

9.3.2 Management review inputs

The management review shall include:

1. a) the status of actions from previous management reviews;
2. b) changes in external and internal issues that are relevant to the quality management system;
3. c) changes in needs and expectations of interested parties that are relevant to the quality management system;
4. d) information on the quality management system performance, including trends in:
   • 1) nonconformities and corrective actions;
   • 2) monitoring and measurement results;
   • 3) audit results;
   • 4) customer satisfaction and feedback from relevant interested parties;
   • 5) the extent to which quality objectives have been met;
   • 6) process performance and conformity of products and services;
   • 7) the performance of external providers;
5. e) opportunities for improvement;
6. f) the adequacy of resources;
7. g) the effectiveness of actions taken to address risks (see 6.1.2);
8. h) the effectiveness of actions taken to address opportunities (see 6.1.3).

9.3.3 Management review results

The results of the management review shall include decisions related to continual improvement opportunities and any need for changes to the quality management system and resource needs.

Documented information shall be available as evidence of the results of management reviews.

10.1 Continual improvement

The organization shall continually improve the suitability, adequacy and effectiveness of the quality management system.

The organization shall consider the results of monitoring, measurement, analysis and evaluation of data and information, and the results of management review, to determine opportunities. The organization shall address these opportunities as part of continual improvement.

Actions shall include:

1. a) improving processes, products and services;
2. b) addressing future needs and expectations;
3. c) correcting, preventing or reducing undesired effects.

NOTE

Improvement can be achieved through incremental or breakthrough change, innovation or reorganization initiatives.

10.2.1

When a nonconformity occurs, the organization shall:

1. a) react to the nonconformity, and as applicable:
   • 1) take action to control and correct it;
   • 2) deal with the consequences;
2. b) evaluate the need for action to eliminate the cause(s) of the nonconformity, in order that it does not recur or occur elsewhere, by:
   • 1) reviewing the nonconformity;
   • 2) determining the causes of the nonconformity;
   • 3) determining if similar nonconformities exist, or can potentially occur;
3. c) implement any action needed;
4. d) review the effectiveness of any corrective action taken;
5. e) update the risks and opportunities determined during planning, if necessary;
6. f) make changes to the quality management system, if necessary.

Corrective actions shall be appropriate to the effects of the nonconformities encountered.

NOTE

Customer complaints can be a source of nonconformities.

10.2.2

Documented information shall be available as evidence of:

1. a) the nature of the nonconformities and any subsequent actions taken;
2. b) the results of any corrective action.

A.1 General

This annex provides clarification to assist users in understanding the requirements in this document. This information is consistent with these requirements, and does not add to, subtract from or in any way modify them.

This annex does not provide guidance for the implementation of requirements, which is available in ISO 9002 [1], the ISO 9001 Handbook for small enterprises [6] or the other standards referenced in the notes to the relevant paragraphs of this annex.

The requirements in this document are intended to be considered from a systems perspective rather than in isolation, as there are interrelationships between the requirements in one clause with the requirements in other clauses.

A.2 Structure and terminology

The clause structure of the requirements in this document is not intended as a model for documenting an organization’s policies, objectives or processes. The structure and content of documented information related to an organization’s quality management system is more relevant to its users when it reflects the terms and processes used within the organization.

Lists within clauses are provided for clarity and ease of reference. The numbering of items in these lists is intended solely to support identification and citation. Unless expressly stated, the order of items in a list does not indicate any prescribed sequence, priority or relative importance. All listed items apply as written, regardless of their position.

To prevent misunderstanding, the meanings of the following words are clarified:

1. a) “Appropriate” and “applicable” are not interchangeable. “Appropriate” means suitable for the organization’s context and involves judgement in determining what meets the requirement. “Applicable” means that if the requirement is determined to be relevant or possible, it applies to the organization. “As applicable” means that a requirement, even if generally applicable under 4.3, can be determined as not applicable in some situations.
2. b) “Consider” means the organization thinks about the topic to determine if it will be included in decisions or actions. “Take into account” means thinking about a topic and including it in decisions or actions.
3. c) “Continual” indicates duration that occurs over a period of time, but with intervals of interruption. The term “continuous” does not appear in this document but indicates duration without interruption. This difference is a common source of misunderstanding. “Continual” is the appropriate word to use when referring to improvement in the context of quality management.
4. d) “Ensure” means that there is a responsibility for making a specified result exist or occur. It refers to accountability for the result, and not to performing every related activity directly. Actions can be delegated and carried out by persons under the organization’s control.
5. e) “Shall be available as documented information” refers to availability of information obtained, used or provided by the organization. “Documented information shall be available as evidence of” refers to the retention of objective evidence. “As evidence of” does not imply legal evidential requirements.
6. f) “Strategic direction” refers to coordinated decisions, plans and actions that guide the organization towards achieving its objectives.

NOTE 1

See ISO 10013 [7] for guidance on documented information.

NOTE 2

See the ISO 9000 Glossary [8] for further information on the terminology used in this document.

A.3 Applicability

A requirement can be determined as not applicable to the quality management system only if this does not affect the organization’s ability to ensure conformity of products and services, enhance customer satisfaction or fulfil applicable statutory and regulatory obligations. The term “not applicable” reflects that the organization has considered the requirement and determined, with justification, that it does not apply in the context of its quality management system.

See 4.3 for requirements for applicability and scope.

A.4.1 Understanding the organization and its context

External and internal issues form part of the organization’s context. They can arise from factors that influence the organization’s purpose, strategic direction or conditions under which it operates. Understanding these issues can support how the quality management system is established and maintained to consistently achieve its intended results.

External and internal issues change over time. Awareness of changes can support maintaining the effectiveness of the quality management system.

A.4.2 Understanding the needs and expectations of interested parties

Understanding the needs and expectations of interested parties involves determining which interested parties are relevant to the quality management system and determining their relevant requirements. When these requirements are considered relevant by the organization, they are included within the boundaries of the quality management system. Where externally provided processes, products and services are relevant, requirements of external providers can also apply.

Interested parties and their requirements can change over time, so awareness of these changes is part of maintaining the effectiveness of the quality management system.

Expectations relating to climate change can influence interested party requirements in areas such as regulatory compliance, customer requirements and organizational commitments. Where these expectations are relevant, they form part of the context for planning and operating the quality management system.

A.4.3 Determining the scope of the quality management system

To enable clear determination, the scope of the quality management system defines the types of activities, products and services covered and related sites where these activities are performed, noting that individual sites can have specific scopes if applicable.

The boundaries of the quality management system can be influenced by specific customer requirements.

If the organization is part of a larger entity, the organizational boundaries of the system can be defined. These boundaries can affect the quality management system.

A.4.4 Quality management system

Subclause 4.4 is linked to the quality management principle of “process approach” which incorporates the PDCA cycle, risk-based thinking and opportunity-based thinking.

The processes referred to in 4.4 include all processes necessary to form a coherent and aligned quality management system that fulfils the requirements of this document.

Each process has defined inputs, expected outputs, responsibilities and authorities. Understanding the sequence and interaction of quality management system processes can support alignment with other organizational processes.

Evaluation of processes addresses their continuing suitability, adequacy and effectiveness, which can be influenced by changes in objectives or internal and external circumstances.

Processes and their interactions can be modified in a controlled manner to maintain and improve quality management system effectiveness.

Evidence that processes operate as intended can be demonstrated through documented information, although such documentation is not always necessary to demonstrate conformity. The organization determines which processes require documented information and the level of detail.

A.5.1 Leadership and commitment

Visible support, involvement and commitment from the organization’s top management demonstrate the organization’s priority for quality and support the effective implementation of the quality management system.

Top management plays a key role in promoting quality culture and awareness of the quality management system across the organization.

Ethical behaviour can support confidence in the organization’s ability to meet the needs and expectations of relevant interested parties.

Ethical behaviour in decisions, actions and interactions can impact all aspects of quality.

Maintaining customer focus, as required in 5.1.2, means ensuring awareness and understanding of customer requirements and that the quality management system supports the organization in consistently meeting those requirements and enhancing customer satisfaction.

NOTE

See ISO 10010 [9] for guidance on quality culture.

A.5.2 Quality policy

The quality policy expresses the organization’s approach to quality and can reflect its quality culture and expectations for ethical behaviour, as appropriate to its context.

The communication, understanding and application of the quality policy by people at all levels of the organization supports awareness of the organization’s intent to consistently meet quality requirements and achieve its quality objectives and continual improvement.

Communicating the quality policy to relevant interested parties including customers and external providers helps ensure understanding of its intent.

A.5.3 Roles, responsibilities and authorities

Responsibilities and authorities are assigned to ensure that the quality management system achieves its objectives. These responsibilities and authorities can be distributed across one or more roles to reflect how the organization is structured.

Reporting on the performance of the quality management system can provide information that is useful when considering actions that preserve its effectiveness when changes occur.

When changes to the quality management system are planned or implemented, the effective assignment of responsibilities can support the identification, prevention or management of unintended consequences or inconsistencies within the system.

Where technologies are used to support the management of the quality management system, confidence in the ongoing integrity of the quality management system is supported by:

A.6.1.1 Determining risks and opportunities

In quality management, risk is frequently understood as the effect of uncertainty that can have a negative impact on the ability of the quality management system to achieve its intended results, while opportunity is understood as circumstances that make it possible to achieve beneficial effects on the performance of the quality management system.

Risk-based thinking and opportunity-based thinking are concepts that can support how the organization considers factors that influence the quality management system.

When these concepts are used in planning and decision-making, they can support consistency in the quality management system at strategic, tactical and operational levels.

Risks and opportunities are distinct; they can be determined and addressed through separate processes.

NOTE

See ISO 31000 [10] for guidance on risk management.

A.6.1.2 Actions to address risks

When planning and implementing actions to address risks, the application of risk-based thinking supports decisions on how quality management system processes are planned, implemented and controlled.

Risk-based thinking supports the organization in maintaining a quality management system that consistently achieves intended results, even during disruptive occurrences, by determining and implementing appropriate actions. Disruptive occurrences are incidents that negatively impact the planned provision of products and services.

The application of risk-based thinking does not imply the use of formal risk management approaches or a documented risk management process.

Organizations can choose to adopt more extensive risk management approaches, for example, through the application of other guidance or standards.

NOTE

See ISO 31000 [10] for guidance on risk management.

A.6.1.3 Actions to address opportunities

Opportunities can be determined through assessment of the organization’s external and internal context, including the needs and expectations of interested parties, organizational capability, capacity and competence, and the results of monitoring and measurement activities and related performance indicators.

Opportunity-based thinking can support consideration of factors that can positively influence the intended results of the quality management system and can help the organization recognize where opportunities exist that can have a beneficial effect on the performance of the quality management system and its intended results.

Opportunities can come from various sources such as changes in market conditions, emerging technologies or regulatory requirements. These circumstances can enable the organization to improve its quality management system performance.

A.6.2 Quality objectives and planning to achieve them

Quality objectives are part of the organization’s overall objectives and are aligned with the quality policy.

Objectives can be established at strategic, tactical and operational levels and can be expressed in quantitative or other suitable forms.

Measurable, documented objectives can aid clarity and consistency in how objectives are communicated, understood and reported.

Communication of objectives to those responsible for achieving them, and to relevant interested parties where appropriate, can help maintain awareness and understanding of the quality management system.

When objectives are linked to other management system objectives, the integration of management systems can facilitate coherence in planning and decision-making.

A.6.3 Planning of changes

Changes to the organization, including changes to its quality management system, can affect the organization in different ways, some of which can adversely impact its ability to achieve its objectives, and some of which can indicate a potential opportunity that can drive improvements.

Changes can arise from external or internal issues, decisions taken by the organization or changes in other management systems.

Once the need for changes to the quality management system is determined, planning approaches can differ depending on the reasons for change, the complexity of the changes to be made and the potential significance of resulting impacts.

NOTE

See ISO/TS 10020 [11] for guidance on how to manage change.

A.7.1.1 General

Determining and providing resources relates to what is necessary and appropriate for achieving the intended results of the quality management system. This can include consideration of interactions between resources and processes.

A.7.1.2 People

The organization determines the people needed to operate the quality management system effectively.

People can be internal or external to the organization, with a permanent or temporary relationship.

When technologies are used to support people in relevant roles, this can result in risks and opportunities relevant to the quality management system.

NOTE

See ISO 30201 [12] for information on human resources management systems.

A.7.1.3 Infrastructure

Infrastructure includes physical resources and software needed for the operation of the organization’s processes. Infrastructure interacts with other resources and processes; its suitability can affect process performance and customer satisfaction.

Infrastructure maintenance helps to ensure that conformity to requirements is consistently achieved.

Hybrid and remote work, as well as emerging technologies, can introduce risks and opportunities for infrastructure management and control.

Customers and other relevant interested parties can have specific requirements for infrastructure management, including its disposal or recycling.

Infrastructure management can require integration with other management systems, such as those for environmental management, occupational health and safety management, or asset management.

A.7.1.4 Environment for the operation of processes

The environment for the operation of processes comprises factors that influence the ability of the organization to achieve conformity to applicable statutory and regulatory requirements and enhance customer satisfaction.

This environment can evolve due to changes such as emerging technologies and working practices, and its management can become more complex when not under the organization’s direct control. It can also be critical from the customer perspective and affect the perception of satisfaction.

Requirements for the environment for the operation of processes under a quality management system can be related to those in other management systems, such as for occupational health and safety or environmental management. While the needs arising from other management systems are not addressed within the scope of the quality management system, their influence on quality management system processes can be relevant.

A.7.1.5 Monitoring and measuring resources

For many organizations, monitoring and measuring resources are essential to demonstrate conformity of their products and services or to ensure control of their processes to achieve intended results. Requirements in 7.1.5 are intended to ensure that the resources provide valid results.

Monitoring determines the status of something and can involve observing, supervising or keeping under review, especially to confirm control and the status of conformity. Measurement is a process that determines the value of a specified characteristic or parameter and can be used for a physical quantity, magnitude or dimension using measuring resources, especially equipment. It can also apply to less tangible aspects, such as customer satisfaction or process performance, using appropriate methods and resources, including information technology (IT) systems for data collection and analysis.

Monitoring and measuring resources can include non-equipment elements, such as defined criteria for evaluation or the competence of people involved in monitoring or measurement activities.

Depending on the specific circumstances, monitoring or measuring equipment can be used for indication, monitoring or measuring purposes. In some cases, the same type of equipment can be used for any or all three functions.

The level and extent of control applied to monitoring and measuring resources depend on their intended use and can vary according to the nature of processes, their outputs, products, services and related risks. Control can include activities such as verification or calibration at suitable intervals, using a risk-based approach.

Traceability of measurement results (see 7.1.5.2) typically includes calibration or verification of measuring equipment against recognized standards or reference materials when necessary. Traceability can apply to measurements performed by the organization, its external providers or by its products when they include measurement functions.

NOTE

See ISO 10012 [13] for requirements for measurement management systems.

A.7.1.6 Organizational knowledge

Organizational knowledge relates to knowledge maintained and applied to support the operation of processes and achieve the intended results of the quality management system.

Organizational knowledge is dynamic and evolves as the organization’s context changes and knowledge is updated through use and experience. Management of knowledge involves activities such as acquiring or creating new knowledge, applying knowledge appropriately, maintaining knowledge so it remains valid and relevant, and retaining knowledge to reduce risks associated with its loss.

NOTE

See ISO 30401 [14] for knowledge management system requirements.

A.7.2 Competence

Subclause 7.2 applies to all persons whose work affects the performance of the quality management system, whether they are within the organizational structure or working under the organization’s control.

Competence requirements can evolve as the organization’s context changes and recognizing this supports the achievement of intended results of the quality management system.

Competence can influence risks related to process performance and conformity of products and services.

NOTE 1

See ISO 10015 [15] for guidance on competence management and people development.

NOTE 2

See ISO 19011 [4] for further information on competence of auditors for management system standards.

A.7.3 Awareness

People are aware when they understand their responsibilities and authorities and how their actions contribute to the achievement of the organization’s quality policy and objectives.

People doing work under the organization’s control can demonstrate awareness in their day-to-day activities by recognizing whether their work meets relevant requirements, and taking appropriate action when processes, products or services do not achieve intended results.

Awareness can help people respond appropriately to nonconformities and incorporate risk-based thinking and opportunity-based thinking in their daily activities. Awareness can inform behaviours aligned with the quality policy and objectives, contributing to the organization’s quality culture and ethical behaviour.

NOTE 1

See ISO 10010 [9] for guidance on quality culture.

NOTE 2

See ISO 10018 [16] for guidance on people engagement.

A.7.4 Communication

Communication relevant to a quality management system can relate to the objectives, process inputs and outputs, responsibilities, resources and factors such as risks, opportunities and feedback from internal and external sources.

Communication can be planned and evaluated for effectiveness, considering risks and opportunities that affect intended results.

Communication can occur between people or through automated interactions between devices.

A.7.5 Documented information

The requirement for documented information applies to information required by this document, as well as information determined by the organization as necessary for the effectiveness of the quality management system.

Documented information can exist in any medium or format and can originate from internal or external sources.

Documented information can serve as evidence that processes operate as intended and that requirements have been fulfilled.

The management of documented information can include various controls to ensure it remains available, usable and suitably protected.

Documented information of external origin is included when it is relevant to the planning and operation of the quality management system.

Obsolete documented information, if retained, is subject to controls to prevent unintended use.

Documented information that serves as evidence of conformity is protected from unintended or unauthorized alteration or deletion.

NOTE 1

See Clause A.2 e) for terminology relevant to the term “documented information”.

NOTE 2

See ISO 10013 [7] for guidance on documented information.

A.8.1 Operational planning and control

Operational planning and controls interact with planning (see Clause 6) and support (see Clause 7) to ensure processes achieve intended results.

Controlled conditions for operational activities can be established by applying risk-based thinking and opportunity-based thinking to identify and address factors that can influence the organization’s ability to achieve intended results. Criteria in this context can refer to objective, measurable conditions used to confirm process effectiveness and conformity of products and services. Resources can include people, infrastructure and information required for process operation. Control of externally provided processes means the organization remains accountable for outputs, even when activities are outsourced. Documented information can be appropriate as evidence of conformity and demonstrate that processes operate as intended and that requirements have been fulfilled.

NOTE 1

See ISO 10005 [17] for guidance on how to prepare a quality plan.

NOTE 2

See ISO 10007 [18] for guidance on configuration management.

A.8.2 Requirements for products and services

Requirements can originate from customers, statutory and regulatory bodies, or other relevant interested parties.

Requirements for products and services can include those that are mandatory and those defined by the organization.

Communication with the customer within 8.2.1 refers to the exchange of information needed to determine requirements for products and services and their associated needs and expectations.

Customer communication can include information about the organization’s ability to fulfil agreed requirements, information related to contingency actions when relevant, and any claims made regarding product or service performance or characteristics.

NOTE 1

See ISO 10001 [19] for guidance on codes of conduct for organizations relevant to customer communication (see 8.2.1).

NOTE 2

See ISO 10002 [20] for guidance on complaints handling.

A.8.3 Design and development of products and services

Design and development of products and services are the set of activities that transform initial requirements for products and services into detailed, defined characteristics.

These characteristics can include physical, functional or other attributes relevant to meeting customer needs and expectations.

The approach to design and development can differ depending on whether the outputs are services, physical products or a combination of both.

Controls applied to the design and development process can include review, verification and validation. These controls have distinct purposes in confirming the ability of design and development to meet requirements, the conformity of design and development outputs with input requirements, and the suitability of resulting products and services for their intended use or application.

NOTE

See ISO 10007 [18] for guidance on configuration management relevant to design and development changes (see 8.3.6).

A.8.4 Control of externally provided processes, products and services

Control in 8.4 means measures applied to ensure externally provided processes, products and services conform to agreed requirements.

Externally provided processes, products and services refer to activities or outputs supplied by a provider that is not included within the scope of the organization’s quality management system. This includes purchased products or services, arrangements with an associate organization, or processes performed at the interface between the provider and the organization or customer.

Accountability for conformity remains with the organization, even when provision is outsourced.

For externally provided processes, products and services, the organization’s competence requirements can include specific qualifications, which are communicated to external providers when relevant.

NOTE

See ISO 37500 [21] for guidance on outsourcing.

A.8.5 Production and service provision

Controlled conditions for production and service provision can depend on the extent to which supporting elements of the quality management system relevant to production and service provision are already established and effective. When outputs cannot be fully verified by monitoring or measurement of the output itself, process validation can provide confidence that the output will conform to requirements. Validation can be repeated when conditions change.

Identification and traceability are closely related because traceability requires outputs to be uniquely identified when it is necessary to determine previous stages of processing or post-delivery status. Identification can show the status of control of outputs at each stage, such as whether planned checks have been completed or whether action is still required.

Traceability can be required by the organization, customers or statutory and regulatory requirements. Traceability can enable previous stages of processing or post-delivery status to be determined and communicated to relevant interested parties when required.

Provision of products or services can involve the use of property belonging to the customer or external provider such as materials, information, tools or places.

Preservation relates to maintaining conformity of products and services during production, service provision and delivery, and applies to tangible and intangible items.

Post-delivery activities can relate to requirements arising from laws, contractual arrangements or customer needs and expectations and can include activities that maintain the conformity of products or services after delivery.

Changes to planned arrangements can occur due to new circumstances, requests or identified risks and opportunities.

Documented information can enable decisions and responsibilities to be traced and can support the management of consequences.

A.8.6 Release of products and services

Controls for the release of products and services relate to confirming that the product or service meets requirements before delivery. This confirmation can take place during production or service provision as well as prior to release and can relate to the conditions under which the product or service is delivered. Confirmation can occur at different stages to enable progression to the next stage.

A.8.7 Control of nonconforming outputs

Even when processes operate as planned, outputs can still fail to meet requirements.

Nonconforming outputs can relate to the final product or provided service, as well as those found during intermediate stages of production and service provision. They can be detected during planned controls, when accidental events occur, or when reported by customers or other interested parties.

A.9.1 Monitoring, measurement, analysis and evaluation

Monitoring and measurement provide data and information that can be used for analysis and evaluation. The approach to monitoring and measurement can be influenced by changes in external and internal issues, interested party requirements and the organization’s strategic direction.

Customer satisfaction, as referenced in 9.1, relates to how customers perceive the organization’s ability to meet their needs and expectations. Information about customer satisfaction is used as input for improvement actions and supports the purpose of the quality management system.

NOTE 1

See ISO 10004 [22] for guidance on monitoring and measuring customer satisfaction.

NOTE 2

See ISO 10003 [23] for guidance on dispute resolution external to organizations.

NOTE 3

See ISO 10009 [24] for guidance for quality tools and their application.

NOTE 4

See ISO 10017 [25] for guidance on statistical techniques.

A.9.2 Internal audit

Internal audit, as referenced in 9.2, involves a programme through which the organization evaluates the status of its processes and their contribution to achieving the objectives of the quality management system. Internal audit applies to all processes within the quality management system.

The determination of audit frequency and scope is influenced by the organization’s evaluation of relevant risks and changes in external and internal issues. Internal audits can provide information about the effectiveness of the quality management system.

Internal audit can highlight aspects of the quality management system that require correction or improvement and can identify opportunities. Internal audit results are considered by top management when making decisions related to the quality management system.

NOTE 1

See ISO 19011 [4] for guidance on auditing management systems.

NOTE 2

See the ISO 9001 Auditing Practices Group [26] for guidance.

A.9.3 Management review

Management review is a process through which top management obtains information on the status of the quality management system and considers this information when making decisions.

Trends in audit results refer to all audits, including first-, second- and third-party audits of the organization’s quality management system.

The intervals between management reviews are determined by the organization and can be influenced by risks, opportunities and changes in the external and internal context.

Management review is used by top management to support evidence-based decision-making related to the quality management system, including resource needs and improvement opportunities.

A.10.1 Continual improvement

Continual improvement aims to enhance the organization’s performance and the effectiveness of its quality management system.

Improvement can result from changes in context, risks or opportunities, or the adoption of technologies.

The nature and extent of improvement can be influenced by developments such as increased reliance on data and the integration of technologies within and between organizations.

Improvement activities can involve adapting processes, knowledge and resources in response to internal and external changes.

A.10.2 Nonconformity and corrective action

The requirements for nonconformity and corrective action address how the organization responds to nonconforming outputs and other nonconformities identified within the quality management system.

The organization determines the approach to address nonconformities, including the extent of investigation and the methods used, based on its context and needs.

The organization considers risk of recurrence, potential or actual impact, and requirements of customers and other relevant interested parties when deciding if corrective action will be applied.

NOTE

See ISO 10002 [20] for guidance on complaints handling.

Bibliography