Internal Quality Management System Audit Checklist (ISO 9001:2015)

Q# ISO 9001:2015 Clause Audit Question

4 Context of the Organization
4.1 Understanding the organization and its context
4.1q1 The organization shall determine external and internal issues that are relevant to its How has the organization determined external and internal issues relevant to its
purpose and its strategic direction and that affect its ability to achieve the intended purpose and strategic direction?
result(s) of its quality management system. How do these affect the ability to achieve the intended result of the QMS?
4.1q2 The organization shall monitor and review the information about these external and How do you monitor and review information about these internal and external
internal issues. issues?

NOTE 1 Understanding the external context can be facilitated by considering issues arising from legal, technological, competitive, market, cultural, social, and economic environments, whether
international, national, regional or local.
NOTE 2 Understanding the internal context can be facilitated by considering issues related to values, culture knowledge and performance of the organization.

4.2 Understanding the needs and expectations of interested parties

4.2q1 Due to their impact or potential impact on the organization’s ability to consistently How have you determined what interested parties are relevant to the QMS?
provide products and services that meet customer and applicable statutory and How have you determined what requirements those parties have that are relevant to
regulatory requirements, the organization shall determine: the QMS?
a) the interested parties that are relevant to the quality management system; How has impact or potential impact been determined?
b) the requirements of these interested parties that are relevant to the quality
management system.
4.2q2 The organization shall monitor and review the information about these interested How do you monitor and review the information about interested parties and their
parties and their relevant requirements. relevant requirements?
4.3 Determining the scope of the quality management system
4.3q1 The organization shall determine the boundaries and applicability of the quality How have the boundaries and applicability of the QMS been used to establish the
management system to establish its scope. scope of the organization?

4.3q2 When determining this scope, the organization shall consider: How have:
a) the external and internal issues referred to in 4.1; The external and internal issues;
b) the requirements of relevant interested parties referred to in 4.2; The requirements of relevant interested parties and;
c) the products and services of the organization. The products and services of the organization been considered when determining
the scope of the organization?
4.3q3 Where a requirement of this International Standard within the determined scope can be How has the application of the International Standard within the scope been
applied, then it shall be applied by the organization. determined, and how has it been applied by the organization?

4.3q4 If any requirement(s) of this International Standard cannot be applied, this shall not How have any requirements of the International Standard been determined as not
affect the organization’s ability or responsibility to ensure conformity of products and applicable? Show me how conformity of products and services are not affected by
services. this.
4.3q5 The scope shall be available and be maintained as documented information stating the: Where is the scope available? Where is it maintained as documented information?
- products and services covered by the quality management system; Does it state what products and services are covered by the QMS?
- justification for any instance where a requirement of this International Does it justify how instances of requirements of the QMS cannot be applied?
Standard cannot be applied.
4.4 Quality management system and its processes
4.4q1 The organization shall establish, implement, maintain and continually improve a quality How has the QMS been established? Show me how this is implemented. How is it
management system, including the processes needed and their interactions, in maintained and continually improved? How have the processes been determined
accordance with the requirements of this International Standard. and how do they interact?

Page 1
Q# ISO 9001:2015 Clause Audit Question
4.4q2 The organization shall determine the processes needed for the quality management How have the processes been determined for the QMS?
system and their application throughout the organization and shall determine: What are the inputs and outputs for those processes?
a) the inputs required and the outputs expected from these processes; What is the sequence and interaction of the processes?
b) the sequence and interaction of these processes; What are the criteria, methods, measurement and related performance indicators
c) the criteria, methods, including measurements and related performance indicators needed to operate and control those processes?
needed to ensure the effective operation, and control of these processes; What resources are needed and how are these made available?
d) the resources needed and ensure their availability; How are responsibilities and authorities assigned for those processes?
e) the assignment of the responsibilities and authorities for these processes; How are risks and opportunities considered and what plans are made to implement
f) the risks and opportunities in accordance with the requirements of 6.1, and plan and actions to address them?
implement the appropriate actions to address them; What methods are used to monitor, measure and evaluate processes and, if needed,
g) the methods for monitoring, measuring, as appropriate, and evaluation of processes what changes are made to achieve intended results?
and, if needed, the changes to processes to ensure that they achieve intended results; How are opportunities to improve the processes and the QMS determined?
h) opportunities for improvement of the processes and the quality management system.
4.4q3 The organization shall maintain documented information to the extent necessary to What documented information exists to support the operation of processes? How
support the operation of processes and retain documented information to the extent is this documented information retained? How is confidence that the processes are
necessary to have confidence that the processes are being carried out as planned. being carried out as planned determined?

5 Leadership
5.1 Leadership and commitment
5.1.1 Leadership and commitment for the quality management system
5.1.1q1 Top management shall demonstrate leadership and commitment with respect to the Show me how top management demonstrates leadership and commitment w.r.t. the
quality management system by: QMS by taking accountability of the effectiveness of the QMS.
a) taking accountability of the effectiveness of the quality management system; How is the quality policy and objectives established for the QMS and how are they
b) ensuring that the quality policy and quality objectives are established for the quality compatible with the strategic direction and the organizational context?
management system and are compatible with the strategic direction and the context of How is the quality policy communicated within the organization? Show me how this is
the organization; understood and applied.
c) ensuring that the quality policy is communicated, understood and applied within the How are the requirements of the QMS integrated into the business processes?
organization; How do you promote awareness of the process approach?
d) ensuring the integration of the quality management system requirements into the How do you ensure that resources needed for the QMS area available?
organization’s business processes; How do you communicate the importance of effective quality management?
e) promoting awareness of the process approach; How do you communicate the importance of conforming to the QMS requirements?
f) ensuring that the resources needed for the quality management system are available; How do you ensure that the QMS achieves its intended results?
g) communicating the importance of effective quality management and of conforming to How do you engage, direct and support people to contribute to the effectiveness of
the quality management system requirements; the QMS?
h) ensuring that the quality management system achieves its intended results; How do you promote continual improvement?
i) engaging, directing and supporting persons to contribute to the effectiveness of the How do you support other relevant management roles to demonstrate leadership in
quality management system; their areas of responsibility?
j) promoting continual improvement;
k) supporting other relevant management roles to demonstrate their leadership as it
applies to their areas of responsibility.
NOTE Reference to “business” in this International Standard can be interpreted broadly to mean those activities that are core to the purposes of the organization’s existence; whether the
organization is public, private, for profit or not for profit.

5.1.2 Customer focus

Page 2
Q# ISO 9001:2015 Clause Audit Question
5.1.2q1 Top management shall demonstrate leadership and commitment with respect to Show me how top management demonstrates leadership and commitment w.r.t.
customer focus by ensuring that: customer focus ensuring requirements and applicable statutory and regulatory
a) customer requirements and applicable statutory and regulatory requirements are requirements are determined and met.
determined and met; How are risks and opportunities that can affect conformity of products and services
b) the risks and opportunities that can affect conformity of products and services and determined?
the ability to enhance customer satisfaction are determined and addressed; How is the ability to enhance customer satisfaction determined and addressed?
c) the focus on consistently providing products and services that meet customer and How is the focus on consistently providing products and services that meet customer
applicable statutory and regulatory requirements is maintained; and applicable statutory and regulatory requirements maintained?
d) the focus on enhancing customer satisfaction is maintained.
How is customer satisfaction maintained?
5.2 Quality policy
5.2.1
5.2.1q1 Top management shall establish, review and maintain a quality policy that: How does top management establish, review and maintain a quality policy?
a) is appropriate to the purpose and context of the organization; How is it determined to be appropriate to the purpose and context of the
b) provides a framework for setting and reviewing quality objectives; organization?
c) includes a commitment to satisfy applicable requirements; Does it provide a framework for setting and reviewing quality objectives?
d) includes a commitment to continual improvement of the quality management system. Does it contain a commitment to satisfy applicable requirements?
Does it include a commitment to continual improvement of the QMS?
5.2.2
5.2.2q1 The quality policy shall: Where is the quality policy available as documented information?
a) be available as documented information; How is it communicated?
b) be communicated, understood and applied within the organization; Show me how it is understood and applied within the organization.
c) be available to relevant interested parties, as appropriate. How have you made it available to relevant interested parties?
5.3 Organizational roles, responsibility and authorities
5.3q1 Top management shall ensure that the responsibilities and authorities for relevant roles How does top management ensure that responsibilities and authorities for relevant
are assigned, communicated and understood within the organization. roles are assigned, communicated and understood within the organization?

5.3q2 Top management shall assign the responsibility and authority for: How does top management assign the responsibility and authority for:
a) ensuring that the quality management system conforms to the requirements of this Ensuring that the QMS conforms to the International standard?
International Standard; Ensuring processes are delivering their intended outputs?
b) ensuring that the processes are delivering their intended outputs; How is the performance of the QMS, opportunities for improvement and the need for
c) reporting on the performance of the quality management system, on opportunities for change or innovation reported to top management?
improvement and on the need for change or innovation, and especially for reporting to How is customer focus promoted within the organization?
top management; How is the integrity of the QMS maintained when changes to the QMS are planned
d) ensuring the promotion of customer focus throughout the organization; and implemented?
e) ensuring that the integrity of the quality management system is maintained when
changes to the quality management system are planned and implemented.
6 Planning for the quality management system
6.1 Actions to address risks and opportunities
6.1.1

Page 3
Q# ISO 9001:2015 Clause Audit Question
6.1.1q1 When planning for the quality management system, the organization shall consider the How are the internal and external issues and interested parties considered when
issues referred to in 4.1 and the requirements referred to in 4.2 and determine the risks planning for the QMS?
and opportunities that How are risks and opportunities determined and addressed so that the QMS can::
need to be addressed to: a) achieve its intended results;
a) give assurance that the quality management system can achieve its intended b) Prevent or reduce undesired effects;
result(s); c) Achieve continual improvement?
b) prevent, or reduce, undesired effects;
c) achieve continual improvement.
6.1.2
6.1.2q1 The organization shall plan: How are actions planned to address risks and opportunities?
a) actions to address these risks and opportunities; How are actions integrated and implemented into the QMS processes?
b) how to: How do you evaluate the effectiveness of the actions?
1) integrate and implement the actions into its quality management system processes
(see 4.4);
2) evaluate the effectiveness of these actions.
6.1.2q2 Actions taken to address risks and opportunities shall be proportionate to the potential How are actions taken to address risks and opportunities determined as being
impact on the conformity of products and services. appropriate to the potential impact on the conformity of products and services?

6.2.2.1 Product design skills

6.2.2.1q The organization shall ensure that personnel with product design responsibility are How do you determine that personnel with product design responsibility are
1 competent to achieve design requirements and are skilled in applicable tools and competent to achieve design requirements? How do you determine skills required in
techniques. applicable tools and techniques? How do you identify applicable tools and
Applicable tools and techniques shall be identified by the organization. techniques?
NOTE Options to address risks and opportunities can include: avoiding risk, taking risk in order to pursue an opportunity, eliminating the risk source, changing the likelihood or consequences,
sharing the risk, or retaining risk by informed decision.
6.2 Quality objectives and planning to achieve them
6.2.1
6.2.1q1 The organization shall establish quality objectives at relevant functions, levels and Where are the quality objectives and are these at all relevant functions, levels and
processes. processes?
The quality objectives shall: Are they consistent with the quality policy?
a) be consistent with the quality policy, Are they measureable?
b) be measurable; Do they consider applicable requirements?
c) take into account applicable requirements; Are they relevant to the conformity of products and services and do they enhance
d) be relevant to conformity of products and services and the enhancement of customer customer satisfaction?
satisfaction; Are they monitored? How? How often?
e) be monitored; How are they communicated?
f) be communicated; How are they updated?
g) be updated as appropriate. Where is the documented information on the quality objectives?
The organization shall retain documented information on the quality objectives.
6.2.2
6.2.2q1 When planning how to achieve its quality objectives, the organization shall determine: How does the organization determine what will be done, with what resources, when
a) what will be done; completed and how will results be evaluated for quality objectives?
b) what resources will be required;
c) who will be responsible;
d) when it will be completed;
e) how the results will be evaluated.
6.3 Planning of changes
Page 4
Q# ISO 9001:2015 Clause Audit Question
6.3q1 Where the organization determines the need for change to the quality management How are changes to the QMS planned systematically?
system (see 4.4) the change shall be carried out in a planned and systematic manner. Demonstrate the purpose and potential consequences of changes;
The organization shall consider: Demonstrate the integrity of the QMS;
a) the purpose of the change and any of its potential consequences; Demonstrate how resources are made available?
b) the integrity of the quality management system; Demonstrate how responsibility and authority is allocated or reallocated.
c) the availability of resources;
d) the allocation or reallocation of responsibilities and authorities.

7 Support
7.1 Resources
7.1.1 General
7.1.1q1 The organization shall determine and provide the resources needed for the Demonstrate how resources are determined for the establishment, implementation,
establishment, implementation, maintenance and continual improvement of the quality maintenance and continual improvement of the QMS.
management system. Show me how the capabilities and constraints on internal resources are considered.
The organization shall consider: Show me how needs from external providers are considered.
a) the capabilities of, and constraints on, existing internal resources;
b) what needs to be obtained from external providers.
7.1.2 People
7.1.2q1 To ensure that the organization can consistently meet customer and applicable How do you provide persons necessary to consistently meet customer, applicable
statutory and regulatory requirements, the organization shall provide the persons statutory and regulatory requirements for the QMS including the necessary
necessary for the effective processes?
operation of the quality management system, including the processes needed.
7.1.3 Infrastructure
7.1.3q1 The organization shall determine, provide and maintain the infrastructure for the How do you determine, provide and maintain the infrastructure for the operation of
operation of its processes to achieve conformity of products and services. processes to achieve products and service conformity?
NOTE 1 Any product realization change affecting customer requirements requires notification to, and agreement from, the customer.
7.1.4 Environment for the operation of processes
7.1.4q1 The organization shall determine, provide and maintain the environment necessary for How do you determine, provide and maintain the environment for the operation of
the operation of its processes and to achieve conformity of products and services. processes to achieve products and service conformity?

NOTE Environment for the operation of processes can include physical, social, psychological, environmental and other factors (such as temperature, humidity, ergonomics and cleanliness).
7.1.5 Monitoring and measuring resources
7.1.5q1 Where monitoring or measuring is used for evidence of conformity of products and How are the resources determined for ensuring valid and reliable monitoring and
services to specified requirements the organization shall determine the resources measuring results, where used?
needed to ensure valid and reliable monitoring and measuring results.
7.1.5q2 The organization shall ensure that the resources provided: How do you ensure that resources provided are suitable for the specific monitoring
a) are suitable for the specific type of monitoring and measurement activities being and measurement activities and are maintained to ensure continued fitness for
undertaken; purpose?
b) are maintained to ensure their continued fitness for their purpose.
7.1.5q3 The organization shall retain appropriate documented information as evidence of Show me the documented information which is evidence of fitness for purpose of
fitness for purpose of monitoring and measurement resources. monitoring and measurement resources.

Page 5
Q# ISO 9001:2015 Clause Audit Question
7.1.5q4 Where measurement traceability is: a statutory or regulatory requirement; a customer Where applicable, show me how measurement instruments are:
or relevant interested party expectation; or considered by the organization to be an Verified or calibrated at specified intervals against national or international
essential part of providing confidence in the validity of measurement results; measuring measurement standards;
instruments shall be: If there are no standards, show me the documented information which is used as
-verified or calibrated at specified intervals or prior to use against measurement the basis used for calibration or verification.
standards traceable to international or national measurement standards. Where no Show me how measurement instruments are identified to determine their calibration
such standards exist, the basis used for calibration or verification shall be retained as status.
documented information; Show me how they are safeguarded from adjustments.
-identified in order to determine their calibration status; Show me how they are safeguarded from damage and deterioration.
-safeguarded from adjustments, damage or deterioration that would invalidate the
calibration status and subsequent measurement results.
7.1.5q5 The organization shall determine if the validity of previous measurement results has How do you determine the validity of previous measurements if you find an
been adversely affected when an instrument is found to be defective during its planned instrument to be defective during verification or calibration?
verification or calibration, or during its use, and take appropriate corrective action as What appropriate actions can you take?
necessary.
7.1.6 Organizational knowledge
7.1.6q1 The organization shall determine the knowledge necessary for the operation of its How do you determine necessary knowledge for the operation of processes? How do
processes and to achieve conformity of products and services. you determine necessary knowledge to achieve conformity of products and services?

7.1.6q2 This knowledge shall be maintained, and made available to the extent necessary. How do you maintain this knowledge and how do you make it available to the extent
necessary?
7.1.6q3 When addressing changing needs and trends, the organization shall consider its How do you consider current knowledge and how do you acquire additional
current knowledge and determine how to acquire or access the necessary additional knowledge when addressing changing needs and trends?
knowledge.
NOTE 1 Organizational knowledge can include information such as intellectual property and lessons learned.
NOTE 2 To obtain the knowledge required, the organization can consider:
a) internal sources (e.g. learning from failures and successful projects, capturing undocumented knowledge and experience of topical experts within the organization);
b) external sources (e.g. standards, academia, conferences, gathering knowledge with customers or
providers).

7.2 Competence
7..2q1 The organization shall: Show me how:
a) determine the necessary competence of person(s) doing work under its control that You determine the necessary competence of people doing work under your control
affects its quality performance; that affects quality performance;
b) ensure that these persons are competent on the basis of appropriate education, How do you determine competence on the basis of appropriate education, training or
training, or experience; experience?
c) where applicable, take actions to acquire the necessary competence, and evaluate How do you take actions to acquire necessary competence where applicable and
the effectiveness of the actions taken; how do you evaluate the effectiveness of those actions?
d) retain appropriate documented information as evidence of competence. Show me documented information where appropriate of competence.
NOTE Applicable actions can include, for example, the provision of training to, the mentoring of, or the re-assignment of currently employed persons; or the hiring or contracting of competent
persons.
7.3 Awareness
7.3q1 Persons doing work under the organization’s control shall be aware of: How are people aware of:
a) the quality policy; The quality policy?
b) relevant quality objectives; Relevant quality objectives?
c) their contribution to the effectiveness of the quality management system, including Their contribution to the effectiveness of the QMS?
The benefits of improved performance?
the benefits of improved quality performance; The implications of not conforming with the QMS requirements?
d) the implications of not conforming with the quality management system
requirements.

Page 6
Q# ISO 9001:2015 Clause Audit Question
7.4 Communication
7.4q1 The organization shall determine the internal and external communications relevant to How do you determine internal and external communications relevant to the QMS?
the quality management system including: How do you determine:
a) on what it will communicate; What?
b) when to communicate; When?
With Whom?
c) with whom to communicate; How?
d) how to communicate.
7.5 Documented information
7.5.1 General
7.5.1q1 The organization’s quality management system shall include: What documented information do you have as required by this standard?
a) documented information required by this International Standard; What documented information do you have as being necessary for the
b) documented information determined by the organization as being necessary for the effectiveness of your QMS?
effectiveness of the quality management system.
NOTE The extent of documented information for a quality management system can differ from one
organization to another due to:
a) the size of organization and its type of activities, processes, products and services;
b) the complexity of processes and their interactions;
c) the competence of persons.
7.5.2 Creating and updating
7.5.2q1 When creating and updating documented information the organization shall ensure Show me that your documented information contains:
appropriate: Identification;
a) identification and description (e.g. a title, date, author, or reference number); Description;
b) format (e.g. language, software version, graphics) and media (e.g. paper, electronic); In what media format?
c) review and approval for suitability and adequacy. Show me how the documented information is reviewed and approved for suitability
and adequacy.
7.5.3 Control of documented information
7.5.3.1
7.5.3.1q Documented information required by the quality management system and by this Show me how you control documented information.
1 International Standard shall be controlled to ensure: Show me how you make it available and suitable for use.
a) it is available and suitable for use, where and when it is needed; How do you protect your documented information?
b) it is adequately protected (e.g. from loss of confidentiality, improper use, or loss of
integrity).
7.5.3.2
7.5.3.2q For the control of documented information, the organization shall address the following When controlling documented information, how do you address:
1 activities, as applicable: Distribution;
a) distribution, access, retrieval and use; Access;
b) storage and preservation, including preservation of legibility; Retrieval;
c) control of changes (e.g. version control); Use;
d) retention and disposition. Storage and preservation;
Legibility;
Control of changes;
Retention and disposition.
7.5.3.2q Documented information of external origin determined by the organization to be How do you identify as appropriate and control documented information of external
2 necessary for the planning and operation of the quality management system shall be origin which you have determined as necessary for the QMS
identified as appropriate, and controlled.
NOTE Access can imply a decision regarding the permission to view the documented information only, or the permission and authority to view and change the documented information.

Page 7
Q# ISO 9001:2015 Clause Audit Question
8 Operation
8.1 Operational planning and control
8.1q1 The organization shall plan, implement and control the processes, as outlined in 4.4, How are processes needed to meet requirements for provision of products and
needed to meet requirements for the provision of products and services and to services planned, implemented and controlled?
implement the actions determined in 6.1, by: How are requirements for products and services determined?
a) determining requirements for the product and services; How is criteria for processes and acceptance for products and services determined?
b) establishing criteria for the processes and for the acceptance of products and How are resources determined?
services; How is process control implemented?
c) determining the resources needed to achieve conformity to product and service Show me the documented information that shows confidence in that the processes
requirements; have been carried out as planned and can demonstrate conformity of products and
d) implementing control of the processes in accordance with the criteria; services.
e) retaining documented information to the extent necessary to have confidence that
the processes have been carried out as planned and to demonstrate conformity of
products and services to requirements.
8.1q2 The output of this planning shall be suitable for the organization's operations. How have you determined that the output from the planning process is suitable for
your operations?

8.1q3 The organization shall control planned changes and review the consequences of How do you control planned changes? How do you review the consequences of
unintended changes, taking action to mitigate any adverse effects, as necessary. unintended changes? What action is taken to mitigate any adverse effects?

8.1q4 The organization shall ensure that outsourced processes are controlled in accordance How do you control outsourced processes?
with 8.4.

8.2 Determination of requirements for products and services

8.2.1 Customer communication
8.2.1q1 The organization shall establish the processes for communicating with customers in What are your processes for communicating with customers? How do you
relation to: communicate information relating to:
a) information relating to products and services; Products;
b) enquiries, contracts or order handling, including changes; Services;
c) obtaining customer views and perceptions, including customer complaints; Enquiries;
d) the handling or treatment of customer property, if applicable; Contracts;
e) specific requirements for contingency actions, when relevant. Order handling;
Customer views, perceptions and complaints;
Handling or treatment of customer property;
Specific requirements for contingency actions?
8.2.2 Determination of requirements related to products and services
8.2.2q1 The organization shall establish, implement and maintain a process to determine the What is your process to determine the requirements for products and services to be
requirements for the products and services to be offered to potential customers. offered to potential customers? How do you establish, implement and maintain this
process?
8.2.2q2 The organization shall ensure that: How do you define product and service requirements including statutory and
a) product and service requirements (including those considered necessary by the regulatory requirements?
organization), and applicable statutory and regulatory requirements, are defined; How do you ensure that you have the ability to meet the defined requirements and
b) it has the ability to meet the defined requirements and substantiate the claims for the substantiate any claims for your products and services?
products and services it offers.
8.2.3 Review of requirements related to products and services
Page 8
Q# ISO 9001:2015 Clause Audit Question
8.2.3q1 The organization shall review, as applicable: How do you review:
a) requirements specified by the customer, including the requirements for delivery and Customer requirements for delivery and post-delivery?
post-delivery activities; Requirements necessary for customers’ specified or intended use, where known;
b) requirements not stated by the customer, but necessary for the customers' specified Additional statutory and regulatory requirements applicable to products and services;
or intended use, when known; Any other contract or order requirements.
c) additional statutory and regulatory requirements applicable to the products and
services;
d) contract or order requirements differing from those previously expressed.
NOTE Requirements can also include those arising from relevant interested parties.
8.2.3q2 This review shall be conducted prior to the organization’s commitment to supply Show me that the review is conducted prior to your commitment to supply products
products and services to the customer and shall ensure contract or order requirements and services to your customers. How do you resolve contract or order requirements
differing from those previously defined are resolved. which differ from those previously defined?
8.2.3q3 Where the customer does not provide a documented statement of their requirements, How do you confirm customer requirements where the customer does not provide a
the customer requirements shall be confirmed by the organization before acceptance. documented statement?
8.2.3q4 Documented information describing the results of the review, including any new or Show me where you retain documented information which describes results of the
changed requirements for the products and services, shall be retained. review including any new or changed requirements.

8.2.3q5 Where requirements for products and services are changed, the organization shall Show me the documented information containing changes to products and
ensure that relevant documented information is amended and that relevant personnel services. How do you ensure that relevant personnel are made aware of those
are made aware of the changed requirements. changes?

8.3 Design and development of products and services

8.3.1 General
8.3.1q1 Where the detailed requirements of the organization’s products and services are not How do you establish, implement and maintain a design and development process
already established or not defined by the customer or by other interested parties, such (where detailed requirements of your products and services are not already
that they are adequate for subsequent production or service provision, the organization established or defined by the customer or other parties).
shall establish, implement and maintain a design and development process.
NOTE 1 The organization can also apply the requirements given in 8.5 to the development of processes for production and services provision.
NOTE 2 For services, design and development planning can address the whole service delivery process. The organization can therefore choose to consider the requirements of clauses 8.3 and 8.5
together.
8.3.2 Design and development planning
8.3.2q1 In determining the stages and controls for design and development, the organization When determining the stages and control for design and development, show me how
shall consider: you consider:
a) the nature, duration and complexity of the design and development activities; The nature, duration and complexity of the activities;
b) requirements that specify particular process stages, including applicable design and Requirements that specify particular process stages including applicable reviews;
development reviews; Required verification and validation;
c) the required design and development verification and validation; Responsibilities and authorities;
d) the responsibilities and authorities involved in the design and development process; How interfaces are controlled between individuals and parties;
e) the need to control interfaces between individuals and parties involved in the design The need for involvement of customer and user groups.
and development process; Show me documented information that confirms design and development
f) the need for involvement of customer and user groups in the design and development requirements have been met.
process;
g) the necessary documented information to confirm that design and development
requirements have been met.

8.3.3 Design and development inputs

Page 9
Q# ISO 9001:2015 Clause Audit Question
8.3.3q1 The organization shall determine: Can you show me how you determine:
a) requirements essential for the specific type of products and services being designed Requirements essential for the type of products and services being designed and
and developed, including, as applicable, functional and performance requirements; developed, including as applicable:
b) applicable statutory and regulatory requirements; Functional & performance requirements;
c) standards or codes of practice that the organization has committed to implement; Statutory and regulatory requirements;
d) internal and external resource needs for the design and development of products Standards or codes of practice where there is a commitment to implement;
and services; Internal and external resources needed for the design and development of products
e) the potential consequences of failure due to the nature of the products and services; and services;
f) the level of control expected of the design and development process by customers Potential consequences of failure;
and other relevant interested parties. Level of control expected of the design and development process by customers and
other relevant parties.
8.3.3q2 Inputs shall be adequate for design and development purposes, complete, and How do you determine that inputs are adequate, complete and unambiguous for
unambiguous. Conflicts among inputs shall be resolved. design and development? How do you resolve conflicts among inputs?
8.3.4 Design and development controls
8.3.4q1 The controls applied to the design and development process shall ensure that: How do controls that are applied to the design and development process ensure:
a) the results to be achieved by the design and development activities are clearly Results achieved by design and development activities are clearly defined?
defined; Design and development reviews are conducted as planned?
b) design and development reviews are conducted as planned; Outputs meet the input requirements by verification/
c) verification is conducted to ensure that the design and development outputs have Validation is conducted to ensure that the resulting products and services are
met the design and development input requirements; capable of meeting the requirements for the specified application or intended use
d) validation is conducted to ensure that the resulting products and services are (when known)?
capable of meeting the requirements for the specified application or intended use
(when known).
8.3.5 Design and development outputs
8.3.5q1 The organization shall ensure that design and development outputs: How do you ensure that design and development outputs:
a) meet the input requirements for design and development; Meet the input requirements for design and development?
b) are adequate for the subsequent processes for the provision of products and Are adequate for the subsequent processes for the provision of products and
services; services?
c) include or reference monitoring and measuring requirements, and acceptance Include or reference monitoring and measuring requirements, and acceptance
criteria, as applicable; criteria, as applicable?
d) ensure products to be produced, or services to be provided, are fit for intended Ensure products to be produced, or services to be provided, are fit for intended
purpose and their safe and proper use. purpose and their safe and proper use?
8.3.5q2 The organization shall retain the documented information resulting from the design and Show me the documented information which results from the design and
development process. development process.
8.3.6 Design and development changes
8.3.6q1 The organization shall review, control and identify changes made to design inputs and How do you review, control and identify changes made to the design inputs and
design outputs during the design and development of products and services or outputs during design and development of products and services ensuring no impact
subsequently, to the extent that there is no adverse impact on conformity to on conformity to requirements?
requirements.
8.3.6q2 Documented information on design and development changes shall be retained. Show me the documented information for design and development changes.
8.4 Control of externally provided products and services
8.4.1 General
8.4.1q1 The organization shall ensure that externally provided processes, products, and How do you ensure externally provided processes, products and services conform to
services conform to specified requirements. specified requirements?

Page 10
Q# ISO 9001:2015 Clause Audit Question
8.4.1q2 The organization shall apply the specified requirements for the control of externally Show me how you apply specified requirements for the control of externally provided
provided products and services when: products and services when:
a) products and services are provided by external providers for incorporation into the Products and services are provided by external providers for incorporation into your
organization’s own products and services; own products and services;
b) products and services are provided directly to the customer(s) by external providers You provide products and services directly to customers by external providers on
on behalf of the organization; your behalf;
c) a process or part of a process is provided by an external provider as a result of a A process or part-process is provided by an external provider as a result of a
decision by the organization to outsource a process or function. decision to outsource a process or function.
8.4.1q3 The organization shall establish and apply criteria for the evaluation, selection, Show me how you establish and apply criteria for evaluation, selection, monitoring of
monitoring of performance and re-evaluation of external providers based on their ability performance and re-evaluation of external providers. How do you assess their ability
to provide processes or products and services in accordance with specified to provide processes or products and services in accordance with specified
requirements. requirements?
8.4.1q4 The organization shall retain appropriate documented information of the results of the What documented information do you have of the results of evaluations,
evaluations, monitoring of the performance and re-evaluations of the external providers. monitoring of performance and re-evaluations of external providers?

8.4.2 Type and extent of control of external provision

8.4.2q1 In determining the type and extent of controls to be applied to the external provision of How do you determine the controls applied to the external provision of processes,
processes, products and services, the organization shall take into consideration: products and services and take into consideration:
a) the potential impact of the externally provided processes, products and services on a) The potential impact of the externally provided processes, products and services
the organization’s ability to consistently meet customer and applicable statutory and on the ability to consistently meet customer and applicable statutory and regulatory
regulatory requirements; requirements?
b) the perceived effectiveness of the controls applied by the external provider. b) The perceived effectiveness of the controls applied by the external provider?
8.4.2q2 The organization shall establish and implement verification or other activities necessary What verification or other activities do you have to ensure externally provided
to ensure the externally provided processes, products and services do not adversely processes, products and services do not adversely affect your ability to consistently
affect the organization's ability to consistently deliver conforming products and services deliver conforming products and services to your customers?
to its customers.
8.4.2q3 Processes or functions of the organization which have been outsourced to an external When processes or functions have been outsourced to external providers, how do
provider remain within the scope of the organization’s quality management system; you consider a) and b) in 8.4.1 and how do you define the controls intended to be
accordingly, the organization shall consider a) and b) above and define both the applied to the external provider and to the resulting process output?
controls it intends to apply to the external provider and those it intends to apply to the
resulting process output.
8.4.3 Information for external providers
8.4.3q1 The organization shall communicate to external providers applicable requirements for Show me how you communicate to external providers, applicable requirements for:
the following: Products and services to be provided or the processes to be performed on behalf of
a) the products and services to be provided or the processes to be performed on behalf the organization;
of the organization; Approval or release of products and services, methods, processes or equipment;
b) approval or release of products and services, methods, processes or equipment; Competence of personnel, including necessary qualification;
c) competence of personnel, including necessary qualification; Their interactions with the organization's quality management system;
d) their interactions with the organization's quality management system; The control and monitoring of the external provider’s performance to be applied by
e) the control and monitoring of the external provider’s performance to be applied by the
the organization;
organization; Verification activities that the organization, or its customer, intends to perform at the
f) verification activities that the organization, or its customer, intends to perform at the external provider’s premises.
external provider’s premises.

Page 11
Q# ISO 9001:2015 Clause Audit Question
8.4.3q2 The organization shall ensure the adequacy of specified requirements prior to their Before you communicate with external providers, how do you ensure the adequacy
communication to the external provider. of specified requirements?

8.5 Production and service provision

8.5.1 Control of production and service provision
8.5.1q1 The organization shall implement controlled conditions for production and service What controlled conditions do you have for production and service provision,
provision, including delivery and post-delivery activities. including delivery and post-delivery activities?

8.5.1q2 Controlled conditions shall include, as applicable: Can you show me controlled conditions for:
a) the availability of documented information that defines the characteristics of the a) the availability of documented information defining the characteristics of the
products and services; products and services;
b) the availability of documented information that defines the activities to be performed b) the availability of documented information defining the activities to be performed
and the results to be achieved; and the results to be achieved;
c) monitoring and measurement activities at appropriate stages to verify that criteria for c) monitoring and measurement activities at appropriate stages to verify that criteria
control of processes and process outputs, and acceptance criteria for products and for control of processes and process outputs, and acceptance criteria for products
services, have been met. and services, have been met.
d) the use, and control of suitable infrastructure and process environment; d) the use, and control of suitable infrastructure and process environment;
e) the availability and use of suitable monitoring and measuring resources; e) the availability and use of suitable monitoring and measuring resources;
f) the competence and, where applicable, required qualification of persons; f) the competence and, where applicable, required qualification of persons;
g) the validation, and periodic revalidation, of the ability to achieve planned results of g) the validation, and periodic revalidation, of the ability to achieve planned results of
any process for production and service provision where the resulting output cannot be any process for production and service provision where the resulting output cannot
verified by subsequent monitoring or measurement; be verified by subsequent monitoring or measurement;
h) the implementation of products and services release, delivery and post-delivery h) the implementation of products and services release, delivery and post-delivery
activities. activities.
8.5.2 Identification and traceability
8.5.2q1 Where necessary to ensure conformity of products and services, the organization shall What means do you use to identify process outputs to ensure conformity of products
use suitable means to identify process outputs. and services?

8.5.2q2 The organization shall identify the status of process outputs with respect to monitoring How do you identify the status of process outputs?
and measurement requirements throughout production and service provision.

8.5.2q3 Where traceability is a requirement, the organization shall control the unique How do you control the unique identification of process outputs, where applicable?
identification of the process outputs, and retain any documented information necessary What documented information do you retain?
to maintain traceability.
NOTE Process outputs are the results of any activities which are ready for delivery to the organization’s customer or to an internal customer (e.g. receiver of the inputs to the next process); they
can include products, services, intermediate parts, components, etc.

8.5.3 Property belonging to customers or external providers

8.5.3q1 The organization shall exercise care with property belonging to the customer or What care do you provide for customer or external provider’s property while under
external providers while it is under the organization's control or being used by the your control?
organization. The organization shall identify, verify, protect and safeguard the How do you identify, verify, protect and safeguard that property which is provided for
customer’s or external provider’s property provided for use or incorporation into the use or incorporation into your products or services?
products and services.

Page 12
Q# ISO 9001:2015 Clause Audit Question
8.5.3q2 When property of the customer or external provider is incorrectly used, lost, damaged What means do you use to report to the customer or external provider if their
or otherwise found to be unsuitable for use, the organization shall report this to the property is incorrectly used, lost, damaged or found to be unsuitable for use?
customer or external provider.
NOTE Customer property can include material, components, tools and equipment, customer premises, intellectual property and personal data.

8.5.4 Preservation
8.5.4q1 The organization shall ensure preservation of process outputs during production and How do you ensure preservation of process outputs during production and service
service provision, to the extent necessary to maintain conformity to requirements. provision to maintain conformity to product requirements?
NOTE Preservation can include identification, handling, packaging, storage, transmission or transportation, and protection.
8.5.5 Post-delivery activities
8.5.5q1 As applicable, the organization shall meet requirements for post-delivery activities How do you meet requirements for post-delivery activities associated with products
associated with the products and services. and services?

8.5.5q2 In determining the extent of post-delivery activities that are required, the organization How do you determine:
shall consider: Risk;
a) the risks associated with the products and services; Nature, use and intended lifetime;
b) the nature, use and intended lifetime of the products and services; Customer feedback;
c) customer feedback; Statutory and Regulatory requirements, when determining the extent of post-delivery
d) statutory and regulatory requirements. activities required with products and services?
NOTE Post-delivery activities can include actions under warranty provisions, contractual obligations such as maintenance services, and supplementary services such as recycling or final disposal.

8.5.6 Control of changes

8.5.6q1 The organization shall review and control unplanned changes essential for production How do you review and control unplanned changes to ensure continuing conformity
or service provision to the extent necessary to ensure continuing conformity with with specified requirements?
specified requirements.
8.5.6q2 The organization shall retain documented information describing the results of the What documented information can you show me which describes the results of
review of changes, the personnel authorizing the change, and any necessary actions. reviews of changes, the personnel authorizing change and any necessary actions?

8.6 Release of products and services

8.6q1 The organization shall implement the planned arrangements at appropriate stages to Show me how planned arrangement have been implemented at appropriate stages
verify that product and service requirements have been met. Evidence of conformity to verify product and service requirements have been met. Show me what evidence
with the acceptance criteria shall be retained. you retain.
8.6q2 The release of products and services to the customer shall not proceed until the Show me how the release of products and services is held until planned
planned arrangements for verification of conformity have been satisfactorily completed, arrangements for verification of conformity have been satisfactorily completed,
unless otherwise approved by a relevant authority and, as applicable, by the customer. unless approved by a relevant authority, or the customer if applicable. Show me
Documented information shall provide traceability to the person(s) authorizing release documented information which shows traceability to the person authorizing release
of products and services for delivery to the customer. of products and services.
8.7 Control of non-conforming process outputs, products and services
8.7q1 The organization shall ensure process outputs, products and services that do not How do you identify and control process outputs, products and services that do not
conform to requirements are identified and controlled to prevent their unintended use or conform to requirements and prevent their unintended use or delivery?
delivery.

Page 13
Q# ISO 9001:2015 Clause Audit Question
8.7q2 The organization shall take appropriate corrective action based on the nature of the What appropriate corrective actions are taken based on the nature of the
nonconformity and its impact on the conformity of products and services. This applies nonconformity and its impact on the conformity of products and services? How do
also to nonconforming products and services detected after delivery of the products or you apply this to nonconformity detected after delivery?
during the provision of the service.
8.7q3 As applicable, the organization shall deal with nonconforming process outputs, How you deal with nonconforming process outputs, products and services in terms
products and services in one or more of the following ways: of:
a) correction; Correction;
b) segregation, containment, return or suspension of provision of products and Segregation, containment, return or suspension of provision of products and
services; services?
c) informing the customer; Informing the customer?
d) obtaining authorization for: Obtaining authorization for use as-is?
- use “as-is’; Release, continuation or re-provision of the products and service?
- release, continuation or re-provision of the products and services;
Acceptance under concession?
- acceptance under concession.
8.7q4 Where nonconforming process outputs, products and services are corrected, How do you verify conformance where process outputs, products and services are
conformity to the requirements shall be verified. corrected following nonconformance?
8.7q5 The organization shall retain documented information of actions taken on What documented information do you keep following actions taken to address
nonconforming process outputs, products and services, including on any concessions nonconformities, including any concessions obtained and on the person or authority
obtained and on the person or authority that made the decision regarding dealing with that made the decision regarding dealing with the nonconformance.
the nonconformity.

9 Performance evaluation
9.1 Monitoring, measurement, analysis and evaluation
9.1.1 General
9.1.1q1 The organization shall determine: Show me how you determine:
a) what needs to be monitored and measured; What needs to be monitored and measured?
b) the methods for monitoring, measurement, analysis and evaluation, as applicable, to Methods for monitoring, measurement, analysis and evaluation to ensure valid
ensure valid results; results?
c) when the monitoring and measuring shall be performed; When to perform monitoring and measuring?
d) when the results from monitoring and measurement shall be analysed and When results shall be analysed and evaluated?
evaluated.
9.1.1q2 The organization shall ensure that monitoring and measurement activities are What documented information can you show me that monitoring and measurement
implemented in accordance with the determined requirements and shall retain activities have been implemented in accordance with determined requirements?
appropriate documented information as
evidence of the results.
9.1.1q3 The organization shall evaluate the quality performance and the effectiveness of the Show me how you evaluate the quality performance and the effectiveness of the
quality management system. QMS.

9.1.2 Customer satisfaction

9.1.2q1 The organization shall monitor customer perceptions of the degree to which How do you monitor customer perception of the degree to which requirements have
requirements have been met. been met?
9.1.2q2 The organization shall obtain information relating to customer views and opinions of the How do you obtain information relating to customer views and opinions of your
organization and its products and services. products and services?
9.1.2q3 The methods for obtaining and using this information shall be determined. What methods for obtaining and using this information do you have?

Page 14
Q# ISO 9001:2015 Clause Audit Question
NOTE Information related to customer views can include customer satisfaction or opinion surveys, customer data on delivered products or services quality, market-share analysis, compliments,
warranty claims and dealer reports.

9.1.3 Analysis and evaluation

9.1.3q1 The organization shall analyse and evaluate appropriate data and information arising So me how you analyse and evaluate data and information arising from monitoring,
from monitoring, measurement and other sources. measurement and other sources.
9.1.3q2 The output of analysis and evaluation shall be used to: Show me how the output of analysis and evaluation is used to:
a) demonstrate conformity of products and services to requirements; Demonstrate conformity of products and services to requirements?
b) assess and enhance customer satisfaction; Assess and enhance customer satisfaction?
c) ensure conformity and effectiveness of the quality management system; Ensure conformity and effectiveness of the QMS?
d) demonstrate that planning has been successfully implemented; Demonstrate that planning has been successfully implemented?
e) assess the performance of processes; Assess process performance?
f) assess the performance of external provider(s); Assess performance of external providers?
g) determine the need or opportunities for improvements within the quality management Determine the need or opportunities for improvements within the QMS?
system.
9.1.3q3 The results of analysis and evaluation shall also be used to provide inputs to Show me where the results of analysis and evaluation are used to provide inputs to
management review. management review.

9.2 Internal audit

9.2.1
9.2.1q1 The organization shall conduct internal audits at planned intervals to provide Are internal audits being conducted at planned intervals? Do they determine
information on whether the quality management system; whether the QMS conforms to the requirements of ISO 9001 and to the other
a) conforms to: requirements established by Organization? (Review records to demonstrate
1) the organization’s own requirements for its quality management system; conformance)
2) the requirements of this International Standard; Do they determine whether the QMS is effectively implemented and maintained?
b) is effectively implemented and maintained. (Review records)
9.2.2
9.2.2q1 The organization shall: Can you show me audit programme(s) that takes into consideration the quality
a) plan, establish, implement and maintain an audit programme(s) including the objectives, importance of the processes, customer feedback, changes impacting the
frequency, methods, responsibilities, planning requirements and reporting, which shall organization and the results of previous audits?
take into consideration the quality objectives, the importance of the processes Where are the audit criteria and scope for each audit?
concerned, customer feedback, changes Can you demonstrate that selection of auditors and the conduct of audits are
impacting on the organization, and the results of previous audits; objective and impartial and that auditors don’t audit their own work?
b) define the audit criteria and scope for each audit; How are audit results reported to relevant management?
c) select auditors and conduct audits to ensure objectivity and the impartiality of the Can you demonstrate that necessary correction and corrective actions are taken
audit process; without undue delay?
d) ensure that the results of the audits are reported to relevant management; Can you show me documented information of the audit programme and the audit
e) take necessary correction and corrective actions without undue delay; results?
f) retain documented information as evidence of the implementation of the audit
programme and the audit results.
NOTE See ISO 19011 for guidance.
9.3 Management Review
9.3.1
9.3.1q1 Top management shall review the organization's quality management system, at What is the frequency that top management reviews the organization's QMS? How
planned intervals, to ensure its continuing suitability, adequacy, and effectiveness. is the QMS deemed suitable, adequate and effective?

Page 15
Q# ISO 9001:2015 Clause Audit Question
9.3.1q2 The management review shall be planned and carried out taking into consideration: What kinds of information are reviewed in management reviews? These must
a) the status of actions from previous management reviews; include:
b) changes in external and internal issues that are relevant to the quality management actions status of previous reviews;
system including its strategic direction; changes to internal/external issues relevant to the QMS;
c) information on the quality performance, including trends and indicators for: issues that affect strategy;
1) nonconformities and corrective actions; KPIs for nonconformities and corrective actions;
2) monitoring and measurement results; monitor and measurement of results;
3) audit results; audit results;
4) customer satisfaction; customer satisfaction;
5) issues concerning external providers and other relevant interested parties; issues concerning external providers;
6) adequacy of resources required for maintaining an effective quality management issues concerning other relevant parties;
system; adequacy of resources and effectiveness of QMS;
7) process performance and conformity of products and services; process performance;
d) the effectiveness of actions taken to address risks and opportunities (see clause conformity of products and services;
6.1); actions taken to address risks and opportunities and their effectiveness;
e) new potential opportunities for continual improvement. new potential opportunities for continual improvement.
9.3.2
9.3.2q1 The outputs of the management review shall include decisions and actions related to: Show me that management reviews include decisions and actions relating to:
a) continual improvement opportunities; Continual improvement opportunities;
b) any need for changes to the quality management system, including resource needs. The need for changes to the QMS including resource needs.
9.3.2q2 The organization shall retain documented information as evidence of the results of Show me what documented information you have as evidence of management
management reviews. reviews.
10 Improvement
10.1 General
10.1q1 The organization shall determine and select opportunities for improvement and How do you determine and select opportunities for improvement? What necessary
implement necessary actions to meet customer requirements and enhance customer actions have you implemented so that you have met customer requirements and
satisfaction. enhanced customer satisfaction?
10.1q2 This shall include, as appropriate: Show me how you have:
a) improving processes to prevent nonconformities; Improved processes to prevent nonconformities;
b) improving products and services to meet known and predicted requirements; Improved products and services to meet known and predicted requirements;
c) improving quality management system results. Improved QMS results.
NOTE Improvement can be effected reactively (e.g. corrective action), incrementally (e.g. continual improvement), by step change (e.g. breakthrough), creatively (e.g. innovation) or by re-
organization (e.g. transformation).
10.2 Nonconformity and corrective action
10.2.1
10.2.1q1 When a nonconformity occurs, including those arising from complaints, the organization When nonconformities occur, show me how;
shall: You react;
a) react to the nonconformity, and as applicable: Take action to control and correct it;
1) take action to control and correct it; Deal with the consequences;
2) deal with the consequences; Evaluate the need for action to eliminate the cause so that it does not recur or occur
b) evaluate the need for action to eliminate the cause(s) of the nonconformity, in order elsewhere by:
that it does not recur or occur elsewhere, by: Reviewing the nonconformity;
1) reviewing the nonconformity; Determining the cause of the nonconformity;
2) determining the causes of the nonconformity; Determining if similar nonconformities exist or could potentially occur;
3) determining if similar nonconformities exist, or could potentially occur; Actions needed are implemented;
c) implement any action needed; Review the effectiveness of corrective actions taken, if any;
d) review the effectiveness of any corrective action taken; Make necessary changes to the QMS.
e) make changes to the quality management system, if necessary.

Page 16
Q# ISO 9001:2015 Clause Audit Question
10.2.1q2 Corrective actions shall be appropriate to the effects of the nonconformities Show me how correction actions were appropriate to the effects of the
encountered. nonconformities encountered.
NOTE 1 In some instances, it can be impossible to eliminate the cause of a nonconformity.
NOTE 2 Corrective action can reduce the likelihood of recurrence to an acceptable level.
10.2.2
10.2.2q1 The organization shall retain documented information as evidence of: What documented information can you show me as evidence of:
a) the nature of the nonconformities and any subsequent actions taken; The nature of the nonconformities and subsequent actions taken;
b) the results of any corrective action. The results of any corrective action.
10.3 Continual improvement
10.3q1 The organization shall continually improve the suitability, adequacy, and effectiveness Demonstrate that you continually improve the suitability, adequacy and effectiveness
of the quality management system. of the QMS.
10.3q2 The organization shall consider the outputs of analysis and evaluation, and the outputs Demonstrate that outputs of analysis and evaluation and the outputs from
from management review, to confirm if there are areas of underperformance or management review are considered to confirm if there are areas of
opportunities that shall be addressed as part of continual improvement. underperformance or opportunities that shall be addressed as part of continual
improvement.
10.3q3 Where applicable, the organization shall select and utilise applicable tools and What applicable tools and methodologies for investigation of the causes of
methodologies for investigation of the causes of underperformance and for supporting underperformance and to support continual improvement are selected?
continual improvement.

Page 17