ISO 9001:2015 QMS — Implementation, Audit & CAPA#

Complete toolkit for ISO 9001:2015 Quality Management System work: gap assessment, implementation roadmap, internal audit checklists, and CAPA management.

---

Contents#

1. Clause Structure Quick Reference
2. Required Documents & Records
3. Implementation Roadmap
4. Gap Assessment Workflow
5. Internal Audit — Clause Checklists
6. Nonconformity Classification
7. CAPA Investigation Workflow
8. Root Cause Analysis Methods
9. CAPA Action Planning & Effectiveness
10. CAPA Metrics

---

1. Clause Structure Quick Reference#

ClauseTitleCore Requirement4Context of the OrganizationUnderstand internal/external issues, interested parties, define scope5LeadershipTop management commitment, quality policy, roles and responsibilities6PlanningRisks and opportunities, quality objectives, change planning7SupportResources, competence, awareness, communication, documented info8OperationProcess planning, design control, supplier management, production/service delivery9Performance EvaluationMonitoring, customer satisfaction, internal audit, management review10ImprovementNonconformity, corrective action, continual improvement

---

2. Required Documents & Records#

Mandatory documented information (must exist)#

• Quality policy (5.2)
• Quality objectives (6.2)
• Scope of the QMS (4.3)
• Process interactions map (4.4)
• Risk and opportunity register (6.1)

Mandatory records (must be kept)#

• Competence/training records (7.2)
• Monitoring and measurement results (9.1)
• Internal audit program and results (9.2)
• Management review outputs (9.3)
• Nonconformity and corrective action records (10.2)
• Customer feedback / complaint records (9.1.2)

Recommended (not mandatory but auditors expect them)#

• Customer satisfaction survey method
• Supplier evaluation records
• Design and development records (if clause 8.3 applies)
• Equipment calibration records (if measuring equipment used)

---

3. Implementation Roadmap#

Phase 1 — Foundation (Months 1–3)#

1. Secure leadership commitment (clause 5)
2. Define organizational context and interested parties (clause 4.1–4.2)
3. Define QMS scope (clause 4.3)
4. Conduct gap assessment against all clauses (see Section 4)
5. Build implementation project plan

Phase 2 — Development (Months 4–6)#

1. Write quality policy and objectives
2. Map and document core processes (clause 4.4, 8.1)
3. Conduct risk and opportunity assessment (clause 6.1)
4. Create or update procedures and work instructions
5. Set up document control system (clause 7.5)
6. Train staff on QMS requirements

Phase 3 — Implementation (Months 7–9)#

1. Deploy processes and start collecting records
2. Conduct first internal audits (clause 9.2)
3. Issue nonconformities and initiate CAPAs
4. Hold first management review (clause 9.3)

Phase 4 — Certification (Months 10–12)#

1. Full internal audit cycle complete
2. All major CAPAs closed or in verification
3. Stage 1 audit (document review by certification body)
4. Stage 2 audit (on-site certification audit)
5. Address any findings → certificate issued

---

4. Gap Assessment Workflow#

For each clause below, rate current state: ✅ Compliant / ⚠️ Partial / ❌ Missing

text

CLAUSE 4 — Context
[ ] 4.1 Internal and external issues identified and documented
[ ] 4.2 Interested parties and their requirements defined
[ ] 4.3 QMS scope defined and documented
[ ] 4.4 Processes and their interactions mapped

CLAUSE 5 — Leadership
[ ] 5.1 Top management demonstrates commitment (actions, not just words)
[ ] 5.2 Quality policy documented, communicated, understood
[ ] 5.3 Roles and responsibilities assigned and communicated

CLAUSE 6 — Planning
[ ] 6.1 Risks and opportunities identified and addressed
[ ] 6.2 Quality objectives set, measurable, monitored
[ ] 6.3 Process in place for managing planned changes

CLAUSE 7 — Support
[ ] 7.1 Resources (people, infrastructure, environment) adequate
[ ] 7.2 Competence defined and verified for all roles
[ ] 7.3 Staff aware of quality policy and their contribution
[ ] 7.4 Internal and external communication defined
[ ] 7.5 Document control process in place (create, update, distribute, retain)

CLAUSE 8 — Operation
[ ] 8.1 Operational processes planned and controlled
[ ] 8.2 Customer requirements determined and reviewed
[ ] 8.3 Design and development process (if applicable)
[ ] 8.4 External providers (suppliers) evaluated and monitored
[ ] 8.5 Production/service delivery controlled; identification and traceability

CLAUSE 9 — Performance Evaluation
[ ] 9.1 Monitoring and measurement methods defined and used
[ ] 9.1.2 Customer satisfaction measured
[ ] 9.2 Internal audit program planned and executed
[ ] 9.3 Management review conducted with defined inputs/outputs

CLAUSE 10 — Improvement
[ ] 10.1 Improvement opportunities identified
[ ] 10.2 Nonconformity and corrective action process in place
[ ] 10.3 Continual improvement demonstrated over time

Prioritize gaps: Any ❌ in clauses 5, 9, or 10 = high risk for certification failure.

---

5. Internal Audit — Clause Checklists#

Use during internal audits. For each item, record: Compliant / Minor NC / Major NC / OFI (Opportunity for Improvement).

Clause 4 — Context#

• Is the organizational context documented and kept up to date?
• Are interested parties and their relevant requirements identified?
• Is the QMS scope clearly defined? Does it reflect actual activities?
• Are all processes and their sequence and interaction defined?

Clause 5 — Leadership#

• Can top management demonstrate active involvement in the QMS?
• Is the quality policy available, communicated, and understood by staff?
• Are quality roles, responsibilities and authorities clearly assigned?
• Do staff know how their work affects product/service quality?

Clause 6 — Planning#

• Is there a documented risk and opportunity register?
• Are quality objectives measurable and monitored? Are results reviewed?
• Is there a process to plan and implement changes in a controlled way?

Clause 7 — Support#

• Are sufficient resources provided for QMS operation?
• Is competence defined for each role affecting quality? Are records maintained?
• Is awareness of the quality policy verified (e.g. through training)?
• Are communication methods defined (who, what, when, how)?
• Is document control working: approval, versioning, obsolete doc handling?

Clause 8 — Operation#

• Are customer requirements reviewed before accepting orders?
• Are purchasing/supplier controls appropriate to risk?
• Are products/services identified and traceable throughout delivery?
• Is customer property identified and protected?
• Are post-delivery activities (warranty, feedback) controlled?

Clause 9 — Performance Evaluation#

• Is customer satisfaction measured? Are results used for improvement?
• Is the internal audit program risk-based and covers all clauses over time?
• Are audit findings documented? Are CAPAs opened for NCs?
• Does management review include all required inputs? Are outputs actioned?

Clause 10 — Improvement#

• Are nonconformities recorded and corrective actions taken?
• Is root cause analysis conducted for significant NCs?
• Are CAPA actions verified for effectiveness?
• Is there evidence of continual improvement over time?

---

6. Nonconformity Classification#

ClassificationDefinitionCAPA RequiredMajor NCAbsence of a required system element, or complete failure of itYes — within 30 daysMinor NCSingle lapse or partial implementation of a requirementRecommendedOFINo requirement breached, but improvement is possibleNo

Major NC examples:

• No internal audit program exists
• Quality policy not communicated to staff
• No documented process for handling customer complaints
• Corrective actions never verified for effectiveness

Minor NC examples:

• Audit schedule exists but one area not audited in cycle
• Training records incomplete for two employees
• Document revision history missing from one procedure

---

7. CAPA Investigation Workflow#

1. Document trigger event with objective evidence
2. Classify severity (Major / Minor) — see Section 6
3. Determine if CAPA is required — see trigger table below
4. Form investigation team (proportional to severity)
5. Collect evidence (records, interviews, observations)
6. Select RCA method and identify root cause — see Section 8
7. Validate root cause: if eliminated, would problem recur?
8. Develop actions — see Section 9
9. Implement and verify effectiveness

CAPA Trigger Decision Table#

SourceCAPA RequiredCriteriaCustomer complaintYesAny complaint affecting quality or safetyInternal audit — Major NCYesAlwaysInternal audit — Minor NCRecommendedIf systemic pattern suspectedNonconformance — recurringYesSame type occurring 3+ timesNonconformance — isolatedEvaluateBased on severity and riskExternal audit findingYesAll Major and Minor findingsManagement review outputEvaluateBased on significance

---

8. Root Cause Analysis Methods#

Method Selection#

text

Is it a safety or system reliability issue?
├── Yes → Fault Tree Analysis
└── No → Is human error the primary suspect?
    ├── Yes → Human Factors Analysis
    └── No → How many contributing factors?
        ├── 1–2 (linear) → 5 Why Analysis
        ├── 3–6 (complex) → Fishbone Diagram
        └── Unknown / proactive → FMEA

5 Why Template#

text

PROBLEM: [Specific, measurable statement]

WHY 1: Why did [problem] occur?
BECAUSE: [First cause]   EVIDENCE: [Data]

WHY 2: Why did [first cause] occur?
BECAUSE: [Second cause]  EVIDENCE: [Data]

WHY 3: Why did [second cause] occur?
BECAUSE: [Third cause]   EVIDENCE: [Data]

WHY 4: Why did [third cause] occur?
BECAUSE: [Fourth cause]  EVIDENCE: [Data]

WHY 5: Why did [fourth cause] occur?
BECAUSE: [ROOT CAUSE]    EVIDENCE: [Data]

Root cause validation checklist:

• Supported by objective evidence
• If eliminated, problem would not recur
• Within organizational control
• Explains all observed symptoms

Fishbone — 6M Categories#

CategoryFocusMan (People)Training, competency, workload, awarenessMachine (Equipment)Calibration, maintenance, capacityMethod (Process)Procedures, work instructions, controlsMaterialSpecifications, supplier quality, storageMeasurementInstrument accuracy, methods, interpretationMother NatureEnvironment: temperature, humidity, cleanliness

---

9. CAPA Action Planning & Effectiveness#

Action Types#

TypePurposeTypical TimeframeContainmentStop immediate impact24–72 hoursCorrectionFix this specific occurrence1–2 weeksCorrectiveEliminate root cause30–90 daysPreventivePrevent in similar processes60–120 days

Action Plan Template#

text

CAPA Ref: [CAPA-YYYY-NNN]
Root Cause: [Statement]

ACTION 1: [Description]
- Type: [ ] Containment  [ ] Correction  [ ] Corrective  [ ] Preventive
- Owner: [Name]
- Due: [YYYY-MM-DD]
- Success Criteria: [Measurable outcome]
- Verification Method: [How it will be checked]

Effectiveness Verification#

CAPA SeverityWait Before VerifyingVerification WindowMajor30 days30–90 days post-implementationMinor60 days60–180 days post-implementation

Effectiveness decision:

text

Did the problem recur during verification period?
├── Yes → CAPA INEFFECTIVE → Re-investigate root cause
└── No → Were all success criteria met?
    ├── Yes → CAPA EFFECTIVE → Close
    └── No → Gap significant?
        ├── Minor → Extend verification or accept with justification
        └── Major → CAPA INEFFECTIVE → Revise actions

---

10. CAPA Metrics#

Track these KPIs for management review:

MetricTargetCalculationAverage cycle time< 60 days(Close date − Open date) / # CAPAsOverdue rate< 10%Overdue / Total openFirst-time effectiveness> 90%Effective on 1st verification / Total verifiedRecurrence rate< 5%Recurred issues / Total closed

CAPA Aging Categories#

AgeStatusAction0–30 daysOn trackMonitor31–60 daysMonitorReview for delays61–90 daysWarningEscalate to management> 90 daysCriticalManagement intervention

---

Based on ISO 9001:2015 standard requirements. CAPA methodology adapted from ISO 13485 audit practices (RCA methods are universal across QMS frameworks).