ISO_9001_2026_Checklist_EN.xlsx

ISO 9001:2026 clause

Requirement — original excerpt

Explanation, examples and evidence

Documentary evidence required?

Yes

Not
applicable

Client evidence / gap /
justification

4.1

The organization shall determine external and internal issues that are relevant to its purpose and its strategic direction and that affect its ability to achieve the intended result(s) of its quality management system.

Identify internal and external issues affecting the QMS and strategy, such as skills shortages, supplier dependency or new technology. No separate context document is expressly required. Supporting evidence: managers can explain relevant issues and show how actual decisions respond to them; a context review or meeting minutes may help.

—

4.1

The organization shall determine whether climate change is a relevant issue.

Assess whether climate change affects quality, delivery or supply continuity, for example warehouse overheating or supplier flooding. The assessment is required even if the conclusion is that it is not relevant. No separate climate report is prescribed. Supporting evidence: a reasoned explanation linked to site conditions, supply routes and operational decisions.

—

4.1

The organization shall monitor and review information about these external and internal issues.

Monitor and review changes in context. No separate review record is expressly required here. Supporting evidence: managers identify recent changes and demonstrate updated purchasing, staffing or operational decisions. An updated context analysis or meeting record is a possible aid.

—

4.2 a–c

The organization shall determine: a) the interested parties that are relevant to the quality management system; b) the relevant requirements of these interested parties; c) which of these requirements will be addressed through the quality management system.

Identify relevant interested parties, their requirements and which requirements the QMS will address. Examples include customers, regulators and employees. No mandatory stakeholder matrix is specified. Supporting evidence: process owners explain whose requirements they fulfil and demonstrate them in actual work; contracts or a stakeholder matrix can support this.

—

4.2

The organization shall monitor and review information about these interested parties and their relevant requirements.

Review changes in interested parties and requirements, including relevant climate-related expectations. No separate register is mandated. Supporting evidence: new customer requirements are understood and reflected in current work, contracts or supplier arrangements; correspondence or a revised stakeholder matrix may support the assessment.

—

4.3

The organization shall determine the boundaries and applicability of the quality management system to establish its scope.

Define the QMS boundaries and applicability, considering context, interested-party requirements, products and services. Documented scope is required by 4.3. It should clearly identify covered activities and products/services; site and organisational boundaries must be understandable. A scope statement or approved section of an existing document is sufficient.

Yes

—

4.3

The scope shall include justification for any requirement of this document that the organization determines is not applicable to its quality management system.

Include a justification for every requirement considered not applicable in the documented QMS scope. Exclusions must not undermine product/service conformity or enhanced customer satisfaction. For design, assess actual responsibility rather than whether a design department exists. Required evidence: the scope statement and reasoned applicability decisions.

Yes

—

4.3

The scope shall be available as documented information.

Keep the documented scope available and state the types of products and services covered. An approved electronic page or scope statement can meet the requirement. A separate quality manual is not required. Check that the current version is accessible and matches actual operations.

Yes

—

4.4.1 a–c

determine the sequence and interaction of these processes;

Identify QMS processes, their application, inputs, outputs, sequence and interactions. No process map is specifically mandated; necessary documentation is addressed by 4.4.2. Supporting evidence: trace an actual order across functions and ask staff to explain handovers. A process map or workflow can help.

—

4.4.1 d–g

determine and apply the criteria and methods needed (including monitoring, measurements and related performance indicators) to ensure the effective operation and control of these processes;

Define and apply process criteria, monitoring methods, indicators, resources, responsibilities and actions for risks/opportunities. No standalone process card is mandatory. Supporting evidence: owners explain control criteria and use them in daily decisions; available resources and actual process performance corroborate their account.

—

4.4.1 h–i

evaluate these processes and implement any changes needed to ensure that these processes achieve their intended results;

Evaluate processes, make needed changes and improve the QMS. No separate improvement log is required here. Supporting evidence: changed workflows, reduced delays or fewer errors following an identified problem. Process reviews and before/after performance data may support the conclusion.

—

4.4.2 a–b

Documented information shall be available to the extent necessary: a) to support the operation of the organization’s processes; b) as evidence that the processes are being carried out as planned.

Document information needed to operate processes and retain evidence that they run as planned. The extent depends on actual need, not a fixed list of procedures. Examples: instructions for complex operations, completed job records or CRM entries. One integrated system can cover several processes.

Yes

—

5.1.1 a–h, l

taking accountability for the effectiveness of the quality management system.

Top management aligns policy/objectives with strategy, integrates the QMS into business processes, provides resources, communicates priorities, supports people and improvement, and remains accountable for results. No separate leadership record is mandated. Supporting evidence: visible participation, actual resource decisions and completed management actions.

—

5.1.1 i

promoting quality culture and ethical behaviour;

Management promotes quality culture and ethical behaviour. Examples: employees report defects freely, test results are not falsified and customers receive accurate information. No separate ethics code is required. Supporting evidence: staff interviews, observed decisions and handling of actual concerns; a code or training materials can help.

—

5.1.1 j–k

promoting risk-based thinking and opportunity-based thinking;

Promote the process approach and thinking about both risks and opportunities. No special methodology or record is mandatory here. Supporting evidence: management explains trade-offs in supplier or technology decisions and links them to process outcomes, rather than treating risks as an isolated annual exercise.

—

5.1.2 a–c

the focus on enhancing customer satisfaction is maintained.

Management ensures customer and applicable statutory/regulatory requirements are understood and consistently met, addresses relevant risks/opportunities and maintains focus on satisfaction. No separate customer-focus procedure is required. Supporting evidence: timely response to complaints, accurate order fulfilment and management involvement in recurring customer issues.

—

5.2.1 a–e

includes a commitment to meet applicable requirements;

The policy fits the organisation's purpose/context and strategy, provides a basis for objectives, and commits to applicable requirements and continual QMS improvement. A documented policy is required under 5.2.2. Check the actual approved text against these elements and the organisation's activities.

Yes

—

5.2.2 a–d

be implemented, understood and applied within the organization.

Keep the policy documented, communicated, understood and applied; make it available to interested parties as appropriate. Required document: the current policy. Interviews and actual decisions demonstrate understanding/application; a signature confirming receipt alone does not. A specific policy-awareness record is not separately mandated.

Yes

—

5.3

Top management shall ensure that the responsibilities and authorities for relevant roles are assigned and communicated within the organization.

Assign and communicate responsibilities for QMS conformity, performance reporting, process results, customer focus, improvement opportunities and integrity during change. No mandatory appointment order is specified. Supporting evidence: staff consistently identify decision-makers and responsibilities; job descriptions, role matrices or appointments are possible aids.

—

6.1.1 a–d

When planning for the quality management system, the organization shall consider the issues referred to in 4.1 and the requirements referred to in 4.2 and determine the risks and opportunities that need to be addressed to:

Determine risks and opportunities from context and interested-party requirements to support intended QMS results, reduce undesired effects, enhance desired effects and improve. A standalone register is not mandatory. Supporting evidence: process owners explain relevant uncertainties and opportunities and demonstrate corresponding decisions in actual operations.

—

6.1.2

The organization shall determine, analyse and evaluate risks that can have an undesired effect on its ability to continually and consistently provide conforming products and services and enhance customer satisfaction.

Identify, analyse and evaluate risks affecting consistent conformity and customer satisfaction, including relevant disruption scenarios. A scored matrix or formal risk procedure is not required. Supporting evidence: reasoned prioritisation of equipment failures, supply interruptions or calculation errors and the choices made to address them.

—

6.1.2 a–b

Actions taken shall be proportionate to the potential impact of the risks on the intended results of the quality management system.

Plan proportionate risk actions, integrate them into QMS processes and evaluate effectiveness. No separate risk-action document is prescribed. Supporting evidence: an available backup supplier, implemented error checks or preventive maintenance, together with demonstrated reduction in failures. An action plan may help trace implementation.

—

6.1.3

The organization shall determine, analyse and evaluate opportunities that can have a desired effect on its ability to continually and consistently provide conforming products and services and enhance customer satisfaction.

Identify, analyse and evaluate opportunities such as automated order checks, new technology or partnerships. Opportunities need not be the reverse of risks. No separate opportunities register is required. Supporting evidence: responsible people explain expected benefits and selection decisions, supported where useful by pilots or proposals.

—

6.1.3 a–b

Actions taken to address opportunities shall be appropriate to the organization's context and support the achievement of desired results.

Plan opportunity actions, implementation in processes and effectiveness evaluation, appropriate to context. No standalone action plan is prescribed. Supporting evidence: a completed automation pilot and comparison of processing time/errors, followed by a reasoned implementation decision. Project records can support this.

—

6.2.1 a–h

The organization shall establish quality objectives at relevant functions, levels and processes.

Document quality objectives for relevant functions, levels and processes. Objectives must align with policy, be measurable, consider requirements, support conformity/satisfaction, and be monitored, communicated and updated. Required information: the objectives themselves; examples include reducing repeat enquiries from 6% to 3% by an agreed date.

Yes

—

6.2.2 a–e

When planning how to achieve its quality objectives, the organization shall determine: a) what will be done; b) what resources will be required; c) who will be responsible; d) when it will be completed; e) how the results will be evaluated.

For each objective determine actions, resources, responsibility, timing and evaluation. A separate written achievement plan is not expressly required by 6.2.2, although the objectives are documented under 6.2.1. Supporting evidence: owners explain agreed actions and demonstrate resource allocation and actual progress.

—

6.3

When the organization determines the need for changes to the quality management system, the changes shall be carried out in a planned manner.

Plan QMS changes, considering purpose, consequences, integrity, resources/information and responsibilities. No specific change-control form is mandated by this clause. Supporting evidence: an orderly CRM or site transition, prepared staff and maintained controls. Other clauses can require records for particular operational or design changes.

—

6.3 e–g

how the effectiveness of the changes will be monitored and evaluated;

Plan change communication, monitoring/evaluation and review of results. No separate review report is required here. Supporting evidence: staff understand the change and managers can demonstrate post-launch performance checks and responses to problems. If no changes occurred, verify preparedness rather than inventing records.

—

7.1.1–7.1.2

The organization shall determine and provide the persons necessary for the effective implementation of its quality management system and for the operation and control of its processes.

Determine and provide people and other resources, considering internal capabilities/constraints and external needs. No separate resource plan is mandatory. Supporting evidence: sufficient competent coverage, functioning substitution arrangements and resources available when required; budgets and staffing plans can corroborate this.

—

7.1.3

The organization shall determine, provide and maintain the infrastructure necessary for the operation of its processes and to achieve conformity of products and services.

Provide and maintain buildings, equipment, software, transport and communications needed for conformity, including remote work where relevant. No standalone infrastructure register is prescribed. Supporting evidence: functioning equipment, timely repairs and accessible IT; maintenance records may support assessment and may be required by other applicable obligations.

—

7.1.4

The organization shall determine, provide and maintain the environment necessary for the operation of its processes and to achieve conformity of products and services.

Maintain suitable physical, social and psychological conditions relevant to product/service conformity. Examples include temperature, cleanliness, lighting and manageable workload. No dedicated environment report is required here. Supporting evidence: workplace observation, staff accounts and stable process operation under the required conditions.

—

7.1.5.1

Appropriate documented information shall be available as evidence of fitness for purpose of the monitoring and measurement resources.

Provide suitable monitoring/measuring resources, maintain their fitness and retain evidence of suitability. Required information may include capability checks, calibration/verification results or validated software checks, depending on the resource. This is not limited to physical instruments. Documents must demonstrate fitness for the intended use.
N/A only if monitoring/measurement for conformity verification genuinely does not apply, justified under 4.3. Having no physical instruments is not sufficient.

Yes

7.1.5.2 a–c

identified in order to determine its calibration or verification status;

Where measurement traceability is required or necessary for confidence, calibrate/verify equipment against traceable standards, identify status and protect it. Documented fitness evidence is required by 7.1.5.1; if no recognised standards exist, document the calibration/verification basis explicitly required by 7.1.5.2. Examples: certificates and an internal reference method.
N/A if measurement traceability is neither required nor considered necessary for confidence in results. Justify the conclusion.

Yes

7.1.5.2

When measuring equipment is found to be unfit for its intended purpose, the organization shall determine whether the validity of previous measurement results has been adversely affected and shall take appropriate action as necessary.

When equipment is unfit, assess previous results and take necessary action, such as rechecking affected batches. This paragraph does not prescribe a separate impact-assessment form. Supporting evidence: affected output is contained and remeasured, and responsible staff explain the response; related nonconformity/release records remain subject to their own requirements.
N/A only if 7.1.5.2 is justifiably inapplicable. Having no equipment failures does not remove the need for response arrangements.

7.1.6

This knowledge shall be retained, applied and shared to the extent necessary.

Determine knowledge needed for processes and QMS results; retain, use and share it, and obtain updates as needs change. No mandatory knowledge database is specified. Supporting evidence: effective mentoring, handover when experts leave and staff applying lessons learned; a knowledge base is one possible tool.

—

7.2 a–c

ensure that these persons are competent on the basis of appropriate education, training or experience;

Define competence for people affecting QMS performance, ensure it through education/training/experience, and address gaps with effectiveness evaluation. Documentary evidence of competence is required by 7.2. Examples: qualifications, experience evidence, practical assessments and authorisation to perform work; attendance alone may not prove capability.

Yes

—

7.2

Appropriate documented information shall be available as evidence of competence.

Keep appropriate evidence of competence available. Examples include a qualification, practical assessment, verified experience or authorisation. Select evidence suited to the task; a course attendance certificate may be insufficient to show the person can perform the work effectively.

Yes

—

7.3 a–e

the organizational quality culture and ethical behaviour.

People understand the policy, relevant objectives, their contribution, consequences of nonconformity, quality culture and ethical behaviour. No mandatory awareness sign-off sheet is specified. Supporting evidence: staff explain these matters in relation to their jobs and act accordingly; training records alone do not establish awareness.

—

7.4 a–e

The organization shall determine the internal and external communications relevant to the quality management system, including: a) on what it will communicate; b) when to communicate; c) with whom to communicate; d) how to communicate; e) who communicates.

Determine what, when, with whom, how and by whom QMS information is communicated. No communication matrix is mandatory. Supporting evidence: an actual order change reaches production, shift handovers work and defects are escalated to the right person. Messages or configured workflows can support the check.

—

7.5.1 a–b

documented information determined by the organization as being necessary for the effectiveness of the quality management system.

Include information required by the standard and information the organisation needs for QMS effectiveness. Required documents/records are those identified in applicable clauses, plus internally necessary information. Electronic systems are acceptable; a universal set of paper procedures is not required.

Yes

—

7.5.2 a–c

review and approval for suitability and adequacy.

Identify and describe documents, use suitable formats/media, and review/approve them for suitability and adequacy. No separate approval protocol is prescribed. Supporting evidence: current documents contain appropriate identifiers and show a functioning approval workflow; staff can demonstrate how an update is authorised.

—

7.5.3.1 a–b

it is adequately protected (e.g. from loss of confidentiality, improper use or loss of integrity).

Ensure documented information is accessible and usable where needed and adequately protected. No separate document-control report is required. Supporting evidence: staff retrieve the current instruction, unauthorised editing is prevented and backup/recovery arrangements work. Existing access settings and actual retrieval provide evidence.

—

7.5.3.2 a–d

retention and disposition.

Control distribution, access, retrieval/use, storage/legibility, revisions, retention and disposal; identify/control necessary external documents and protect conformity evidence from unintended changes. No standalone control procedure is prescribed. Supporting evidence: version history, functioning permissions, retrieval of retained records and obsolete documents prevented from accidental use.

—

8.1 a–e

The organization shall plan, implement and control the processes needed to meet requirements for the provision of products and services, and to implement the actions determined in Clause 6, by:

Plan and control work using product/service requirements, acceptance/process criteria and resources, incorporating Clause 6 actions. Under 8.1, documentation is required to the extent needed to demonstrate planned execution and conformity. Examples: a quality plan, work instructions, job records or electronic service workflow.

Yes

—

8.1

Documented information shall be available to the extent necessary to have confidence that the processes have been carried out as planned.

Keep information needed to demonstrate execution as planned and product/service conformity. Examples: completed job cards, test results and service records. Control planned changes, assess unintended changes and manage external provision under 8.4. The extent of records depends on the processes and risks.

Yes

—

8.2.1 a–e

obtaining customer feedback relating to products and services, including customer complaints;

Communication covers product/service information, enquiries/orders/changes, feedback/complaints, customer property and relevant contingency arrangements. No separate customer communication log is mandatory here. Supporting evidence: an actual enquiry or complaint is handled and relevant information reaches the customer; CRM entries or correspondence can corroborate this.

—

8.2.2 a–b

it can meet the claims for the products and services it offers.

Define product/service requirements, including applicable statutory/regulatory and internal requirements, and ensure claims are achievable. No separate claims-assessment report is required. Supporting evidence: actual capability matches advertised performance and delivery promises; technical specifications and demonstrations can support the check.

—

8.2.3.1 a–e

The organization shall ensure that it has the ability to meet the requirements for the products and services to be offered to customers.

Before commitment, review customer, intended-use, internal and statutory/regulatory requirements and resolve differences. Confirm undocumented customer requirements before acceptance. Applicable review results and new/changed requirements must be documented under 8.2.3.2. Examples: approved contract, order review or electronic confirmation.

Yes

—

8.2.3.2 a–b

Documented information shall be available, as applicable, as evidence of: a) the results of the review; b) any new or changed requirements for the products and services.

Retain applicable evidence of review results and new/changed requirements. Examples: signed contract, completed order-review fields, confirmed oral order or approval history. The standard does not require a particular form or a separate paper checklist for every transaction.

Yes

—

8.2.4

When requirements for products and services are changed, the organization shall ensure that the relevant documented information is updated and communicated to the relevant interested parties.

When requirements change, update relevant documented information and communicate it to relevant parties. Required information may be a revised specification, contract amendment or updated electronic order. Check that affected staff/providers receive the change. If no changes occurred, verify the mechanism without inventing change records.

Yes

—

8.3.1

The organization shall establish, implement and maintain a design and development process that is appropriate to ensure the subsequent provision of products and services.

Establish a design process that converts needs into defined product/service characteristics and supports subsequent provision. No standalone design procedure is prescribed by 8.3.1. Supporting evidence: a real project follows controlled stages and responsibilities; mandatory inputs, outputs and control records are addressed in 8.3.3–8.3.6.
N/A only with justified non-applicability under 4.3: no responsibility for converting needs into product/service characteristics. Outsourcing design alone does not justify exclusion.

8.3.2 a–j

the documented information needed as evidence that design and development requirements have been met.

Plan stages, reviews, verification/validation, roles, resources, interfaces, stakeholder involvement, subsequent provision and expected controls. Determine the information needed to demonstrate fulfilment of design requirements. Examples: project plan and defined required records, proportionate to complexity; a particular plan template is not mandated.
N/A only with justified non-applicability under 4.3: no responsibility for converting needs into product/service characteristics. Outsourcing design alone does not justify exclusion.

Yes

8.3.3

Inputs shall be complete, unambiguous and adequate for design and development purposes.

Define complete, unambiguous inputs covering function/performance, previous learning, legal requirements, adopted standards and failure consequences; resolve conflicts. Documented design inputs are required. Examples: agreed requirements specification, safety requirements and resolved design-input decisions.
N/A only with justified non-applicability under 4.3: no responsibility for converting needs into product/service characteristics. Outsourcing design alone does not justify exclusion.

Yes

8.3.4 a–b

reviews are conducted to evaluate the ability of the results of design and development to meet requirements;

Define intended results and review whether the design can meet requirements. Evidence of these activities is required by 8.3.4 f. Examples: design review minutes, recorded technical decisions and resolved issues at a project milestone.
N/A only with justified non-applicability under 4.3: no responsibility for converting needs into product/service characteristics. Outsourcing design alone does not justify exclusion.

Yes

8.3.4 c

verification activities are conducted to ensure that the design and development outputs meet the input requirements;

Verify that design outputs meet input requirements. Required evidence under 8.3.4 f may include calculations, drawing checks, software tests and resolution of findings. Verification checks against requirements; it does not replace validation of intended use.
N/A only with justified non-applicability under 4.3: no responsibility for converting needs into product/service characteristics. Outsourcing design alone does not justify exclusion.

Yes

8.3.4 d–f

validation activities are conducted to ensure that the resulting products and services meet the requirements for the specified application or intended use;

Validate that the resulting product/service is suitable for specified application or intended use. Required evidence includes validation activities and action on identified problems. Examples: operational trials, user acceptance under intended conditions or a service pilot; review, verification and validation have distinct purposes.
N/A only with justified non-applicability under 4.3: no responsibility for converting needs into product/service characteristics. Outsourcing design alone does not justify exclusion.

Yes

8.3.5 a–d

Documented information shall be available as evidence of design and development outputs.

Document outputs that meet inputs, support subsequent provision, include/reference control and acceptance criteria, and specify essential characteristics and safe/proper-use information. Examples: approved drawings, specifications, service definitions and instructions.
N/A only with justified non-applicability under 4.3: no responsibility for converting needs into product/service characteristics. Outsourcing design alone does not justify exclusion.

Yes

8.3.6

Documented information shall be available as evidence of: a) design and development changes; b) results of reviews; c) authorization of the changes; d) actions taken to prevent adverse impacts.

Identify, review and control design changes so conformity is not harmed. Required records cover changes, reviews, authorisation and actions preventing adverse effects. Examples: change notices, approval history, impact review and repeat-test results where needed.
N/A only with justified non-applicability under 4.3: no responsibility for converting needs into product/service characteristics. Outsourcing design alone does not justify exclusion.

Yes

8.4.1

The organization shall ensure that externally provided processes, products and services conform to requirements.

Control external provision incorporated into outputs, delivered directly on your behalf or performed as an outsourced process. This general requirement does not prescribe a separate control procedure. Supporting evidence: actual incoming checks and contractor oversight; provider evaluation records are specifically required elsewhere in 8.4.1.

—

8.4.1

The organization shall determine and apply criteria for the evaluation, selection, monitoring of performance, and re-evaluation of external providers, based on their ability to provide processes, products or services in accordance with requirements.

Apply criteria for provider evaluation, selection, performance monitoring and re-evaluation. Keep evidence of these activities and necessary resulting actions. Examples: supplier approval, quality/delivery ratings and action plans for a poor-performing contractor. A certificate alone may not establish suitability.

Yes

—

8.4.2 a–d

define both the controls that it intends to apply to an external provider and those it intends to apply to the resulting output;

Define controls over both provider and output, considering impact on conformity/legal requirements and the provider's own controls. Outsourced processes remain within QMS control. No separate control matrix is mandatory. Supporting evidence: risk-appropriate checks are actually performed and staff explain why their extent is sufficient.

—

8.4.3 a–f

The organization shall ensure the adequacy of requirements prior to their communication to the external provider.

Check requirements before communicating them. Address supply, approvals, competence, interactions, performance monitoring and intended verification/validation where appropriate. No specific purchasing form is prescribed. Supporting evidence: the supplier correctly understands current requirements and actual delivery matches them; purchase specifications and correspondence may help.

—

8.5.1 a–e, g–h

The organization shall implement production and service provision under controlled conditions.

Provide controlled conditions: necessary instructions defining characteristics, activities and results; suitable monitoring, staged checks, infrastructure, competent staff, error prevention and release/delivery arrangements. 8.5.1 a requires documented information as applicable. Examples: work instructions, drawings, service scripts and acceptance criteria in the operating system.

Yes

—

8.5.1 f

the validation, and periodic revalidation, of the ability to achieve planned results of the processes for production and service provision, where the resulting output cannot be verified by subsequent monitoring or measurement;

Validate and periodically revalidate processes whose outputs cannot be verified afterwards, such as relevant welding or sterilisation processes. Evidence is needed to the extent necessary under 4.4.2/8.1: approved parameters, qualification results and revalidation evidence. No universal record template is prescribed.
N/A if there are no processes whose outputs cannot be verified by subsequent monitoring/measurement. Justify using actual operations.

Yes

8.5.2 a–b

identify the status of outputs with respect to monitoring and measurement requirements throughout production and service provision;

Identify outputs where necessary for conformity and make inspection/measurement status clear. No separate identification register is prescribed. Supporting evidence: labels, physical segregation or system status show what is awaiting checks, accepted or rejected. Specific traceability records are addressed separately in 8.5.2 c–d.

—

8.5.2 c–d

ensure that documented information necessary to enable traceability is available as evidence.

Where traceability is required, control unique identification and retain the records needed to reconstruct the history. Examples: links between raw material, batch, inspection and shipment, or a service history against an order. Documented evidence is conditional on traceability being required.
N/A if traceability is not required by customers, law or the organisation. Applicable identification/status requirements still apply.

Yes

8.5.3

The organization shall identify, verify, protect and safeguard property belonging to customers or external providers that is provided for use or incorporation into the products and services.

Identify, check and protect customer/provider property, including materials, tools, information, intellectual property and personal data. No standalone property register is mandated. Supporting evidence: property is identifiable and protected, with suitable access controls and handling. Loss/damage records are separately required when an incident occurs.
N/A only if no customer/provider property is controlled or used, including data and intellectual property. Justify under 4.3.

8.5.3

Documented information shall be available as evidence of what has occurred.

If customer/provider property is lost, damaged or unsuitable, notify its owner and retain evidence of what happened. Examples: incident record, damage report and notification. If there were no incidents, no fictitious incident records are needed; check the response arrangements.
N/A only if the underlying customer/provider property requirement does not apply. No incidents means no event records, not automatic exclusion.

Yes

8.5.4

The organization shall preserve the outputs during production and service provision, to the extent necessary to ensure conformity to requirements.

Preserve conformity during handling, storage, packaging, transfer and transport. Examples: contamination protection, temperature control or protection of digital deliverables. No standalone preservation procedure is specified. Supporting evidence: actual storage/handling conditions and undamaged, usable outputs; required process records remain governed by 8.1.

—

8.5.5 a–e

The organization shall meet the requirements for post-delivery activities associated with the products and services.

Determine and meet post-delivery requirements, considering law, potential consequences, intended life/use, customer requirements and feedback. No separate after-sales procedure is mandated. Supporting evidence: warranties, support or servicing are actually delivered as agreed; contracts and service history may corroborate this.
N/A only if no post-delivery obligations apply after considering all relevant factors. Justify under 4.3.

8.5.6

Documented information shall be available as evidence of the results of the review of changes, the person(s) authorizing the change and any necessary actions arising from the review.

Review and control production/service changes to maintain conformity. Required records identify review results, authorising persons and necessary actions. Examples: material substitution approval, equipment-setting change or revised service sequence with the related impact assessment.

Yes

—

8.6

The release of products and services to the customer shall not proceed until the planned arrangements have been satisfactorily completed, unless otherwise approved by a relevant authority and, as applicable, by the customer.

Complete planned checks before release unless properly authorised, including customer approval where applicable. Release records are required by 8.6 and must show conformity with acceptance criteria and who authorised release. Examples: final inspection, test report or approved service acceptance.

Yes

—

8.6 a–b

traceability to the person(s) authorizing the release.

Retain release evidence demonstrating acceptance criteria were met and identifying the authorising person. Examples: signed test record, electronic batch approval or service acceptance with verified results. A shipment date alone does not establish authorised release.

Yes

—

8.7.1

The organization shall ensure that outputs that do not conform to requirements are identified and controlled to prevent their unintended use or delivery.

Identify and control nonconforming outputs, including issues found after delivery. Use correction, segregation, return/suspension, customer notification or concession as appropriate. Records are required by 8.7.2 for actual cases: nature, actions, concessions and decision authority. A quarantine area alone does not replace these records.

Yes

—

8.7.1

When nonconforming outputs are corrected, the organization shall verify conformity to the requirements.

After correction, verify conformity before further use/release. Necessary evidence of conformity falls under 8.1, with nonconformity records under 8.7.2. Examples: repeat test results or an electronically recorded check of the corrected service/report. No records of nonexistent cases are needed.

Yes

—

8.7.2 a–d

the authority deciding the action in respect of the nonconformity.

For actual nonconforming outputs retain the nature of the issue, actions taken, concessions and the authority deciding the response. Examples: nonconformity report or electronic case record. If no cases occurred, confirm this and check that the process is ready; do not manufacture records.

Yes

—

9.1.1 a–d

The organization shall evaluate the performance and the effectiveness of the quality management system.

Define what and how to monitor/measure, timing and when results are analysed/evaluated. Evaluate QMS performance and effectiveness. 9.1.1 requires evidence of results; examples include process indicators, quality/delivery trends and evaluation conclusions. No separate monitoring procedure is mandated.

Yes

—

9.1.1

Documented information shall be available as evidence of the results.

Keep evidence of monitoring, measurement and evaluation results. Examples: defect and delivery measures, inspection results and process reports with identifiable periods and sources. A blank reporting template does not demonstrate actual performance evaluation.

Yes

—

9.1.2

The organization shall monitor customer satisfaction. The organization shall determine the methods for obtaining, monitoring and reviewing customer satisfaction information.

Monitor customer satisfaction using defined methods such as interviews, feedback, surveys and warranty/complaint information. A specific survey or questionnaire is not mandatory. Results should be available as monitoring evidence under 9.1.1; a consolidated feedback analysis can suffice. Absence of complaints alone does not establish satisfaction.

Yes

—

9.1.3 a–h

The organization shall analyse and evaluate relevant data and information arising from monitoring and measurement.

Analyse conformity, satisfaction, QMS/planning effectiveness, risk actions, opportunity actions, provider performance and improvement needs. Retain evaluation results under 9.1.1; examples include a trend analysis with conclusions and decisions. No separate report format is prescribed.

Yes

—

9.2.1 a–b

The organization shall conduct internal audits at planned intervals to provide information on whether the quality management system: a) conforms to: 1) the organization’s own requirements for its quality management system; 2) the requirements of this document; b) is effectively implemented and maintained.

Audit at planned intervals against both internal and standard requirements, including effective implementation/maintenance. 9.2.2 requires evidence of programme implementation and results. Examples: completed audit reports with actual sampled evidence, findings and conclusions; checking document presence alone is insufficient.

Yes

—

9.2.2

The organization shall plan, establish, implement and maintain (an) audit programme(s), including the frequency, methods, responsibilities, planning requirements and reporting.

Plan an audit programme covering frequency, methods, responsibilities, planning and reporting; consider process importance, previous results and changes. Evidence of implementation and audit results is mandatory under 9.2.2. A schedule linked to completed reports is a practical solution; no fixed annual format is prescribed.

Yes

—

9.2.2 a–d

select auditors and conduct audits to ensure objectivity and the impartiality of the audit process;

Set audit objectives, criteria and scope; ensure impartial auditors; report to relevant managers; take timely correction/corrective action. Required evidence: programme implementation and audit results, with action records under 10.2 where relevant. Examples: audit plan, report, distribution and follow-up.

Yes

—

9.2.2

Documented information shall be available as evidence of the implementation of the audit programme(s) and the audit results.

Retain evidence that the programme was implemented and of audit results. Examples: completed reports identifying sampled processes, evidence, findings and conclusions. Blank templates or a planned calendar alone do not prove that audits occurred.

Yes

—

9.3.1

Top management shall review the organization's quality management system, at planned intervals, to ensure its continuing suitability, adequacy, effectiveness and alignment with the strategic direction of the organization.

Top management reviews the QMS at planned intervals for suitability, adequacy, effectiveness and strategic alignment. Documented results are required under 9.3.3. Examples: management minutes or coordinated periodic reviews with traceable conclusions and decisions; a separate annual ceremony is not required.

Yes

—

9.3.2 a–c

the status of actions from previous management reviews;

Review previous actions and changes in context and relevant interested-party needs/expectations. Results are documented under 9.3.3; supporting inputs can be an action tracker and updated context/customer requirements. A separate report for every input is not mandated.

Yes

—

9.3.2 d–h

the effectiveness of actions taken to address opportunities (see 6.1.3).

Review trends in nonconformities/actions, monitoring, audits, customer satisfaction/feedback, objectives, processes/products and suppliers, plus improvement opportunities, resources and effectiveness of risk and opportunity actions. Document review results under 9.3.3. A consolidated review pack/minutes can cover these inputs without separate reports for each.

Yes

—

9.3.3

The results of the management review shall include decisions related to continual improvement opportunities and any need for changes to the quality management system and resource needs.

Record management review decisions on improvement opportunities, needed QMS changes and resource needs. Required evidence: results of the review, such as minutes or approved electronic decisions. Owners and deadlines make implementation easier, although a particular minutes template is not specified.

Yes

—

10.1

The organization shall continually improve the suitability, adequacy and effectiveness of the quality management system.

Use monitoring/analysis and management review to select and implement improvement opportunities, addressing processes/products/services, future needs and undesired effects. No separate improvement register is required. Supporting evidence: implemented changes and demonstrable benefits such as fewer repeat errors; related review/action records retain their own requirements.

—

10.2.1 a–b

determining the causes of the nonconformity;

React to nonconformities, control/correct them and address consequences. Evaluate the need to eliminate causes by reviewing the issue, causes and similar actual/potential cases. 10.2.2 requires evidence of the issue and actions. Examples: complaint investigation, cause assessment and checks of other lines.

Yes

—

10.2.1 c–f

review the effectiveness of any corrective action taken;

Implement needed action, review effectiveness and update risks/opportunities or the QMS where necessary. Actions must be proportionate. Required records under 10.2.2 include action results; examples are verification over an adequate period and evidence of changed controls, not merely a completion tick.

Yes

—

10.2.2 a–b

the nature of the nonconformities and any subsequent actions taken;

Retain evidence of actual nonconformities, subsequent actions and corrective-action results. Examples: a case record with cause, measures, implementation evidence and effectiveness review. If no cases occurred, record that fact in the client comments as appropriate and verify preparedness; do not create fictitious cases.

Yes

—

100