ISO 9001:2008 Audit Checklist

ISO 9001:2008 Clauses 4 Quality Management System (QMS) Requirements

4.1 General Quality Management System (QMS) Requirements a) Is a quality management system established, documented, implemented and maintained according to the ISO 9001:2008 standard? b) Are processes needed for the quality management system identified? c) Are the following determined for these processes: 1. The sequence and interaction 2. The criteria & methods to ensure effective operation & control? d) Are information necessary to support operation and monitoring of these processes available? e) Are there measurement, monitoring and analysis of these processes to achieve planned results and continual improvement? f) Are control of out-sourced processes identified in the quality management system? 4.2 General QMS Documentation Requirements a) Quality Manual : Is there a quality manual that documents the 3. Quality policy and objectives 4. Scope of the QMS & details of and justifications for any exclusions 5. Procedure for control of documents 6. Procedure for control of quality records 7. Procedure for conduct of internal audits 8. Procedure for control of non-conformity 9. Procedure for corrective action

Yes/ No

Remarks

10. Procedure for preventive action? b) Control of Documents: Are documents required by the QMS under document control? Are the following controls documented: 11. Approve documents for adequacy before issue 12. Review, update and re-approve documents 13. Changes & current revision status are identified 14. Relevant versions are available at point of use 15. Documents are legible and readily identifiable 16. Documents of external origin are identified and distribution controlled 17. Obsolete documents are suitably identified, if they are to be retained c) Control of Records: Are records maintained to provide evidence of conformance to QMS? 18. Are they legible, readily identifiable & retrievable 19. Are there documented procedures for the identification, storage, protection, retrieval, retention time and disposal of records? d) Are the following records maintained: 20. management review records 21. records of education, training, qualification/skill and experience 22. records to provide evidence of conformity to established processes & product requirements 23. product requirements/contract & review records 24. design and development review records 25. verification & validation records 26. records for design & development changes 27. purchase evaluation records 28. validation records for special processes 29. record for unique identification of product/service 30. records of customer supplied items 31. records for equipment calibrations & verification 32. records of person authorizing release of product 33. records of nonconformities & actions taken 34. Records of preventive actions taken?

5 Management Responsibility
5.1 Management Commitment a) Are there evidence of top management commitment to the development, implementation & improvement of the QMS through: 35. Communicating to the organization the importance of meeting customer, statutory & regulatory requirements 36. Establishing the quality policy 37. Ensuring the quality objectives are met 38. Conducting management review of the QMS 39. Ensuring the availability of resources for QMS implementation & improvement? 5.2 Customer Focus a) Does top management ensure customer requirements are: 40. Determined 41. Fulfilled with the aim of enhancing customer satisfaction? 5.3 Quality Policy a) Does top management ensure that the quality policy: 42. Is appropriate to the purpose of the organization 43. Include a commitment to meeting customer and regulatory requirements 44. Include a commitment to continual improvement 45. Provide a framework for establishing and reviewing quality objectives 46. Is communicated and understood at appropriate levels in the organization 47. Is reviewed for continuing suitability? 5.4 Quality Objectives/QMS Planning a) Quality Objectives: Does top management ensure that quality objectives are established at relevant functions and levels with the organization?

b) Are the quality objectives measureable and consistent with the quality policy? c) Are quality objectives established to ensure that product requirements met? d) QMS Planning : Does the top management ensure that 48. QMS planning is carried out in order to meet requirements given in section 4.1, as well as the quality objectives 49. The integrity of the QMS is maintained when changes to the QMS are planned & implemented? e) Is the output of this planning documented? 5.5 Responsibility, Authority and Communication a) Responsibilities & Authority: Are the responsibilities & authority for various functions defined & communicated to facilitate effective quality management? b) Management Representative : Is a management representative appointed by top management to 50. Ensure the processes of the QMS are established, implemented and maintained 51. Report to top management of the performance of the QMS, including needs for improvement 52. Promote awareness of customer requirements throughout the organization 53. Liaise with external parties on matters relating to the QMS? c) Internal Communication: Are the processes of the QMS and their effectiveness communicated between various levels and functions within the organization? 5.6 Management Review of QMS a) Is there a review of the QMS by top management at planned intervals to ensure its continuing suitability, adequacy and effectiveness? b) Does the review include: 54. Assessing opportunities/recommendations for improvements *0 Improvement of the QMS & its processes *1 Improvement of product related to customer requirements 55. Assessing need to change the QMS, including quality policy & objectives 56. Review of audit results & customer feedback

57. Process performance & product conformance 58. Status of corrective & preventive actions 59. Follow-up actions from earlier review meetings 60. Changes that could affect the QMS 61. Resource needs for QMS implementation & improvement? c) Are the results of the management review recorded?

6 Resource Management
6.1 Provision of Resources a) Are resources determined and provided for: 62. Implementing, maintaining and improving the processes of the quality management system 63. Enhancing customer satisfaction by meeting customer requirements? 6.2 Human Resources a) Are personnel assigned responsibilities defined in the QMS competent on the basis of applicable education, training, skills/qualifications and experience? b) Competence, Awareness & Training: Are competency needs for personnel performing activities affecting product conformity identified? c) Are training provided to satisfy the competency needs? d) Is effectiveness of training provided evaluated? e) Are employees aware of the relevance and importance of their activities and how they contribute to the achievement of the quality objectives? f) Are appropriate records of education, experience, skills/qualifications and training maintained? 6.3 Infrastructure / Facilities a) Are infrastructure / facilities needed to achieve conformity of products identified, provided and maintained? b) Do they include: 64. Building, workspace and associated utilities

65. Process equipment, hardware and software 66. Supporting services (e.g. transport communication or information systems)? 6.4 Work Environment a) Are the human and physical factors of the work environment needed to achieve conformity of product identified and managed?

7 Product Realization
7.1 Planning of the Product Realization Processes a) Are the processes needed for product realization planned, developed & documented in a quality plan? b) Are the following determined in the quality plan, as appropriate: 67. Quality objectives for product, project or contract 68. Need to establish processes / documents 69. Need to provide resources / facilities 70. Required verification, validation, monitoring, inspection, test activities & criteria for acceptance 71. Records to provide evidence of conformity to established processes & product requirements? 7.2 Customer Related Processes a) Determination of Product Requirements: 72. Requirements specified by the customer, including delivery & postdelivery activities 73. Requirements not specified by the customer but necessary for intended or specified use 74. Statutory, regulatory requirements and any other requirements determined by the organization. b) Product Requirement/Contract Review: 75. Product requirements are adequately defined & documented 76. Contract or order requirements that differ from those previously

expressed are resolved 77. The organization has the ability to meet the defined requirements. c) Are the results of the product/contract review and subsequent follow-up actions recorded? d) Note: For internet sales, formal review is not practical for each order. Instead the review can cover the relevant product catalogue or advertising material. e) Are customer requirements confirmed, if the customer provide no documented requirements? f) Where product/contract requirements are changed, does the organization ensure 78. That relevant documentation is amended 79. Relevant personnel are made aware of the changed requirements? g) Customer Communication : Does the organization identify & implement arrangement for communication with the customers relating to: 80. Product information 81. Enquiries, contract or order handling, including amendments 82. Customer feedback, including customer complaints. 7.3 Product Design and Development a) Design and Development Planning : Are the following determined: 83. Design and development stages 84. Review, verification and validation activities 85. Responsibilities & authority for design and/or development activities? b) Are the interfaces between different groups managed to ensure effective communication & clarity of responsibilities? c) Are planning output kept up-to-date? d) Design and Development Inputs: Are these defined, documented and do they include: 86. Functional & performance requirements 87. Applicable statutory & regulatory requirements 88. Applicable info. derived from similar design 89. Any other essential requirements? e) Design and Development Outputs : Are these documented, approved before

issue and do they 90. Meet the design/development input requirements 91. Provide appropriate information for production & service operations 92. Contain or reference product acceptance criteria 93. Define the characteristics of the product that are essential to its safe and proper use? f) Design and Development Review: At suitable stages, are systematic reviews of design / development conducted to: 94. Evaluate ability to fulfill requirements 95. Identify problems & propose follow-up actions? g) Design and Development Verification: Is this performed to ensure that the design/development outputs meet its inputs? 96. Are the results of the verification and resulting follow-up actions recorded? h) Design and Development Validation: Is this performed to confirm that the resulting product is capable of meeting the requirements for intended use? 97. Wherever applicable, is validation completed before delivery or implementation of the product? 98. Are results of validation & subsequent follow-up actions recorded? i) Design and Development Changes: Are these identified, documented, reviewed, verified and validated, as appropriate before implementation? 99. Are there evaluation of the effect of changes on constituent parts and products already delivered? 7.4 Purchasing a) Purchasing Process/Control: Are type & extend of control to be applied to the supplier and purchased product dependent on the effects on subsequent product realization process or the final product? 100. Are criteria for selection & periodic evaluation defined? 101. Are results of supplier evaluations & follow-up actions shall be recorded? b) Purchasing Information : Do purchasing documents contain information describing the product to be purchased, including where appropriate: 102. Requirements for product approval, procedures, processes and

equipment 103. Requirements for qualification of staff 104. QMS requirements? c) Verification of Purchased Products : Are activities necessary for verification of purchased products established and implemented? d) Where verification needs to be performed at the suppliers premises, are intended verification arrangement & method of product release documented? 7.5 Production & Service Operations a) Operations & Service Control : Are production & service operations controlled through, as applicable: 105. Availability of info on characteristics of product 106. Availability of work instructions 107. Use & maintenance of suitable equipment 108. Availability & use of measuring & monitoring devices 109. Implementation of monitoring activities 110. Implementation of defined processes for release, delivery and postdelivery activities? b) Production & Service Operation Validation/Special Processes: Where resulting output cannot be verified by subsequent monitoring or measurement, are the production and service processes validated through (e.g. for packing of parachutes), as applicable: 111. Defined criteria for review and approval 112. Approval of equipment and qualification of personnel 113. Use of specific methods and procedures 114. Requirements for records and re-validations? c) Identification & Traceability: Are various products suitably identified throughout production and service operations? 115. Are the product status identified w.r.t. measurement & monitoring requirements? 116. Where traceability is a requirement, are unique identification of product controlled and recorded. d) Customer Property: Are customer property provided for use or incorporation

into the product identified, verified, protected & safeguarded? 117. If the customer property that is lost, damaged or otherwise unsuitable for use, is this reported to the customer and recorded? (customer property may include intellectual property, personnel data e.g. information provided in confidence). e) Preservation of Product : Are the conformity of product maintained during internal processing and delivery to the intended destination 118. Identification, handling, packaging, storage and protection of the product to be taken care of 7.6 Control of Measuring and Monitoring Equipment a) Are the following determined? 119. Monitoring and measurement to be undertaken 120. Monitoring and measurement devices needed to provide evidence of conformity of product to determined requirements b) Are processes to ensure that monitoring & measurements can be carried out determined? c) Is the measuring equipment: 121. Calibrated or verified at specified intervals 122. Adjusted or readjusted as necessary 123. Identified to enable the calibration status to be determined 124. Safeguarded from adjustments that would invalidate the measurement result 125. Protected from damage & deterioration during handling, maintenance & storage? d) When a measuring equipment is found not to conform to requirements: 126. Is the validity of the previous measuring results assessed and recorded? 127. Are appropriate actions taken on the equipment and any affected products? e) Are records of equipment calibration & verification maintained? f) When used for monitoring or measurement, is the ability of the computer software to satisfy the intended application confirmed before initial use?

8 Measurement, Analysis & Improvement

8.1 Measurement & Monitoring Planning a) Are measurement & monitoring activities planned and implemented to 128. Demonstrate conformity of the product 129. Ensure the conformity to QMS 130. Continually improve the effectiveness of the QMS b) Are applicable methods, including statistical techniques and the extent of their use determined? 8.2 Measurement and Monitoring a) Customer Satisfaction: Are the methods for obtaining and using this information determined? b) Internal Audit : Are internal audits conducted at planned intervals to determine whether the QMS 131. Conforms to the ISO 9001 requirements 132. Is effectively implemented & maintained? c) Is audit program planned, taking into consideration the status/importance of the activities/areas to be audited and the results of previous audits? d) Is the audit scope, frequency & methodology defined? 133. Are audits conducted by personnel other than those who perform the activity being audited? e) Are the following documented in a procedure: 134. Responsibility / requirement for planning & conducting audit 135. Reporting results and maintaining records? f) Does management ensure that timely actions are taken to eliminate detected non-conformities and their causes? 136. Are follow-up actions verified & verification results reported? g) Measurement & Monitoring of Processes: Are suitable methods for monitoring and, where applicable measurement of QMS processes applied? 137. Do these methods demonstrate the ability of the processes to planned

results? 138. When planned results are not achieved, are appropriate corrective action taken, to ensure conformity of the product? h) Measurement & Monitoring of Product: Are the characteristics of the products monitored & measured to verify that requirements of product have been met? 139. Are these carried out at appropriate stages of the product realization process in accordance with planned arrangements? 140. Are the evidences of conformity with acceptance criteria maintained? 141. Are records indicating the person authorizing the release of the product maintained? 142. Are product release and service delivery held back until the planned arrangements have been satisfactorily completed, unless otherwise approved by the customer or relevant authority? 8.3 Control of Non-Conformity a) Are products which do not meet requirements identified & controlled to prevent unintended use or delivery? b) Are the controls, responsibility and authority for dealing with non-conforming products defined in a documented procedure? 143. Are actions taken to eliminate the detected non-conformity or concessions provided by relevant authority or the customer for use, release or acceptance? c) Are records on the nature of the nonconformity and follow-up actions including concessions, maintained? d) Where the non-conforming product is corrected, is it subjected to reverification? e) Where the non-conforming product is detected after delivery or use, are actions appropriate to the effects or potential effects, taken? 8.4 Analysis of Data a) Are appropriate data to determine suitability & effectiveness of the QMS (and to identify improvements) determined, collected and analyzed? b) Are data relating to the following analyzed:

144. Customer satisfaction/dissatisfaction 145. Conformance to customer requirements 146. Characteristics & trends of process & products 147. Suppliers? 8.5 QMS Improvement, Corrective & Preventive Actions a) Continual Improvement: Are the effectiveness of the QMS continually improved through the use of: 148. quality policy & objectives 149. audit results, analysis of data 150. corrective & preventive actions 151. Management review? Corrective Action: Are corrective action taken to eliminate the cause of the non-conformities to prevent recurrence? 152. Corrective action shall be appropriate to the impact of the problems encountered. Do the documented procedures define requirements for: 153. Identifying & reviewing non-conformities (including customer complaints) 154. Determining the cause(s) of the non-conformity 155. Evaluate need for actions 156. Determining, implementing, recording & verifying the effectiveness corrective action(s)? Preventive Action: Are appropriate actions taken to eliminate cause(s) of potential nonconformities in order to prevent their occurrence? 157. Preventive action shall be appropriate to the impact of the potential problems. Do the documented procedures define requirements for: 158. identifying potential non-conformities & their causes 159. evaluating the need for action 160. Determining, implementing, recording and verifying the effectiveness of preventive action(s)?

b)

c)

d)

e)