Last updated: 25 Feb 2005

Summary of ISO 9001:2000 requirements

Clause	Title	Requirements	Comments
4.	Quality management system
4.1	General requirements	You must have a documented quality system which is kept up to date and continually improved. T here is a requirement for: identify involved processes; determine the sequence of involved processes; determine methods by which you can be sure that identified processes are working correctly; make sure that you provide needed resources for operating identified processes and you monitor them; monitor and improve of your system.	None.
4.2	Documentation requirements
4.2.1	General	This section requires that certain types of documentation to exist in the system. Documents required by this clause are: statements of quality policy; statements of quality objectives; a Quality Manual; documented procedures, required by the standard (six areas to be covered); records required by the standard to prove that requirements are fulfilled.	Documentation can be in any kind of format, like paper or electronic.
4.2.2	Quality manual	The standard requires a Quality Manual which has to be up to date. I f there is any exclusion from standard requirements, they have to be mentioned in the manual, along with good explanations of reasons for which those requirements are not applied. T he manual has to reference of contain the procedures required by the standard; there are six areas that needs procedures. I nteraction and succession of the processes should be included into manual. There can exist flow chart diagrams.	Most of the time is useless to put the entire documentation in a single book. Try to separate them as suits your needes better.
4.2.3	Control of documents	You must ensure that correct version of documents is available for use. They must be reviewed and approved prior to use. Y ou should know what documents exist and which version is the correct one. Y ou must make sure that the documents are kept in good order, so that they can be easily read. I f you need external documents in order to produce your products or services, you must describe how you control them (what happens when new ones are received or when existing ones become obsolete or no longer required, etc). I f you keep old versions for reference purposes, you must describe how you stop them form being used by accident.	There must exist a procedure, which must describe how is addressed each requirement of this clause. P ay attention that because of this clause, you may end up in a severe bureaucracy!
4.2.4	Control of records	You must make sure that you keep sufficient records to prove that you are operating your quality management system correctly. Y ou must keep them for a defined minimum period. Y ou must keep them in good condition, in such a way that they can be easily found. T his clause requires that you have a procedure which ensures that quality records are suitably controlled with regard to: defining what records are required; how and where they are stored; ensuring that they can be retrieved; describing their retention time and subsequent disposal; you should also describe who is responsible for these activities.	There must exist a procedure, which must describe how is addressed each requirement of this clause. P ay attention what records are usefull and which are not. At least the records required by the standard must exist.

Clause	Title	Requirements	Comments
5.	Management responsibility
5.1	Management commitment	Top management commitment to development and improvement of the system must be defined. A quality policy must exist. Q uality objectives must exist. M anagement reviews must be conducted at regular time intervals. T op management must ensure that sufficient resources are provided.	None.
5.2	Customer focus	Commitment of top management regarding determining, meeting and enhancing customer satisfaction must be defined.	A good solution would be to define a person or a group responsible for determining customer requirements and expectations.
5.3	Quality policy	The company has to have a relevant policy for products or services provided to clients. Quality Policy is one of the most important facets of your quality system. It is the top-level document of the system; It should include a commitment to meet requirements (customer and legal, etc.), and to continually improve the effectiveness of the quality management system; Quality policy must ensure that there exist a system for establishing and reviewing quality objectives; Quality policy must ensure that staff are aware of quality policy and what it means to them, and how they contribute to achieving the objective of having your Quality Policy; Quality policy must be periodically reviewd.	A good solution for establishing quality policy and its review would be management review meetings.
5.4	Planning
5.4.1	Quality objectives	Top management must make sure that adequate resources has beed provided to achieve the required level of quality. Here, objectives for quality must be established by top management, using measurable terms.	Pay attention that quality objectives must be measurable. It's useless to set an objective and after that, not to be able to say if it was achieved or nor, or in what extent. E ven if there is no specific requirement to record quality objectives, they should be included in quality manual.
5.4.2	Quality management system planning	Top management must ensure that needed resources are provided, in order to ensure that objectives for quality are planned and identified. W hen changes are made to system, top management must ensure that the integrity of the system is maintained. Those changes must be made in a controlled way so that the system continues to meet the requirements of ISO 9001:2000.	None.
5.5	Responsibility, authority and communication
5.5.1	Responsibility and authority	Top management has to make sure that resposibilities of key function within the company are identified and communicated to them.	Identified responsibilities should be documented, for a better understanding and communication. P eople should be aware of who they report to and who reports to them (if relevant). They have to be aware of the general structure of the organisation, or at least have access to that information, when they need it.
5.5.2	Management representative	Top management has to appoint a person from management level who will be the "Management Representative". Responsibilities of Management Representative include: ensuring that the quality management processes are operating correctly; reporting performance of the system to the top management; promoting awareness of customer requirements.	Even if there is no particular requirement of the standard, there should exist a record for who is Management Representative . T here is no suggestion on how to choose the proper person. However, that person has to come from management level and must have sufficient authority to carry out specified duties.
5.5.3	Internal communication	Top management must ensure that there is adequate communication between the various levels of staff and between different departments, etc.	None.
5.6	Management review
5.6.1	General	Top management must review the operation of the quality system, so as to ensure that it is up to date and effective. Top management must also consider how to improve the system and what changes are needed for it.	Records of these analyzes must be maintained.
5.6.2	Review input	Inputs for review must be defined (e.g. inspection results, customer surveys, internal audit reports, etc). The standard lists some specific topics which must be addressed: results of audits; customer feedback; process conformity; product (service) conformity; status of corrective and preventive actions; follow-up actions from previous reviews; changes that could affect the system; recommendations for improvement	Mentioned topics are minimum requirements. There should be more topics for management reviews, since these reviews are used especially for determining how system works and what need to be improved, for a better performance and increased customer satisfaction.
5.6.3	Review output	Standard require that output of the management review to be defined. There are certain things that must result as output of the management review, required by the standard: improvements to the effectiveness of the management system ; improvement of the product/services supplied by the company; resources needs (i.e. what resources are needed to achieve these improvements).	Mentioned topics are minimum requirements. There should be more topics for management reviews output, since these reviews are used especially for determining how system works and what need to be improved, for a better performance and increased customer satisfaction.

Clause	Title	Requirements	Comments
6.	Resource management
6.1	Provision of resources	Organization must ensure that are provided adequate resources to enhance customer satisfaction and to implement the required processes and to improve them.	None.
6.2	Human resources
6.2.1	General	Organization must ensure that adequately trained and experienced personnel is undertaking appropiate jobs.	None.
6.2.2	Competence, awareness and training	Competence of personnel must be determined. O rganization has to provide needed training, to fulfill the requirements set in 6.2.1. E ffectiveness of training must be evaluated E mployees must be aware of the importance of tasks they are undertaking. A dequate records must be kept for education, training, experience and abilities	Competence is the combination of experience, abilities, trainings and education.

Clause	Title	Requirements	Comments
7.	Product realization
7.1	Planning of product realization	Organization must: determine the quality objectives and requirements for your products; ensure that exist adequately plan for all of the processes and sub-processes needed for products/services; plan the required inspection/testing activities; identify what records must be kept, to prove that the product has been properly produced; If each item produced or service supplied is different, the company will need to produce a plan for each one.	If the company produces each time a different product or service, the recorded plan for each of them must be kept, in accordance with requirements set in 4.2.4.
7.2	Customer related processes
7.2.1	Determination of requirements related to the product	The company must find out what customer requires, with regard to the actual supplied product or service and also any obligations that arise from it (such as legal requirements, warranties, and support, etc.).	One important thing that the company has to determine is what are the unspecified requirements, but needed for intended use of the product or service. This may be tricky most of the time, because plenty of things can be taken in consideration.
7.2.2	Review of requirements related to the product	The company must ensure that customer requirements are defined. I f they are not defined in writing, the company must identify how to confirm what it is that you thought the customer wanted. T he company must ensure have the resources to supply what has been ordered before acceptance of the order. O rganization must define how changes in requirements are recorded, how the information is circulated around the relevant sections of organisation.	There is a mandatory requirement in the standard about keeping records for the review, also for action arising from it.
7.2.3	Customer communication	The company must identify how the customer contacts the organisation, especially for product information, feedback including complaints, enquiries and orders, including amendments, etc.	None.
7.3	Design and development
7.3.1	Planning of design and development	The company must ensure that are identified various design & development processes and the related review stages. Also has to identify all relevant responsibilities.	None.
7.3.2	Inputs for design and development	The company must identify what the design inputs are (i.e. what information is needed in order to design or develop the product or service). I nputs should include any relevant functional requirements, standards, legal requirements (e.g. mandatory safety requirements, packaging disposal/recycling requirements, CE marking requirements, etc). Where it is relevant, it should consider similar previous designs and learnings from them.	Adequate records must be kept for this activity.
7.3.3	Outputs for design and development	The company must specify the design outputs (e.g. plans, drawings, schematics, etc) in such a way that they can be checked to ensure that they meet the design requirements. T hey must be suitable for use by the organisation that receives them. For example, the manufacturing department may require a Bill Of Materials, a "gold" sample, and a full set of engineering drawings, etc. Design plans should state what is required, after you have discussed and agreed this with the recipient (whether an external customer or an internal department).	None.
7.3.4	Review of design and development	The company must review the progress of the design activities at appropriate stages. T hese can include theoretical calculation checks, Beta testing, etc. O rganization must identify and record any problems and propose follow-up actions. The plans should identify what these stages are and when they occur. R ecords must be kept for these reviews.	Adequate records must be kept for this activity.
7.3.5	Verification of design and development	The company must verify designs to ensure that the design meets the design input requirements. P lans should state how and when you plan to do this.	Adequate records must be kept for this activity.
7.3.6	Validation of design and development	The company must ensure that the product or service works correctly in practice. I n some cases, validation may include reviews of customer feedback after release of the product. This may lead to subsequent design changes, or changes in future products. P lans should state how and when you plan to do this.	Adequate records must be kept for this activity.
7.3.7	Changes of design and development	The company must ensure any changes are reviewed and recorded. I t must also consider the effect that the changes may have on any sections of the design work already completed or under way.	Adequate records must be kept for this activity.
7.4	Purchasing
7.4.1	Purchasing control	The company ensure that suitable suppliers are selected, and they are told clearly what it is that you want from them, so that to receive wanted things.	Records are needed to be kept, regarding evaluation of suppliers.
7.4.2	Purchasing information	Purchase orders (or letters of contract, etc) must clearly state what it is wanted. These must be reviewed for adequacy before they are sent to the vendor.	No records are required by the standard to be kept, but most of the time they are used in practice.
7.4.3	Verification of purchased product	There is a requirement for the company to determine if the supplier has supplied proper products. This is what is called "receiving inspection". I f the product was not inspected upon receiving, it has to be inspected some time (the "in-process inspection"). I f the company decides to make needed inspections to supplier's premise, before the goods are released, this has to be mentioned in purchasing documents. I f the client decides to make the verification of product at supplier's premise, the company is still responsible for making a suitable product for client.	None.
7.5	Product and service provision
7.5.1	Control of production and service provision	The company has to take in consideration various things needed for product realization or supply of service. These have to be controlled. Items that need to be considered, specified by the standard are: information which specifies the characteristics of the product (so that inspections and functional tests can be properly conducted); provision of work instructions (or SOPs, Method Statements, etc). This can be by written instructions, drawings, photographs, samples, etc.; provision of suitable equipment and appropriate maintenance of the equipment; availability and use of suitable monitoring and measuring devices; provision of procedures for release, delivery and (if applicable) post-delivery activities (e.g. installation, commissioning, servicing, etc).	Where needed, work instructions must be prepared and made available for use.
7.5.2	Validation of processes for production and service provision	Companies that have processes which produce items that cannot be tested directly (e.g welding operation), has to validate such processes. A special process is that one in which deficiencies appear only after the release of the product or service to the client. In other words, when the results of internal testing is not possible (unless by destroying the product) or gives only subjective proves, validation of processes must be applied. T he company has to: review, approve and revalidate production and/or service processes; approve and revalidate equipment and personnel involved in these activities. T he company has to define also: which methods or procedures must be followed when producing or servicing the product/service; what qualifications/experience are required for people involved in the processes; what records must be kept.	If the company has to validate special processes, records must be kept.
7.5.3	Identification and traceability	Where appropriate and to the extent necessary, organization must ensure that materials and goods are identified, so as to prevent accidental mix-ups. In some industries it may be necessary to trace exactly which materials from which supplier were used in which goods. This may also extend to knowing which operators were involved. The aerospace industry is a good example of this sort of level of traceability. I f there is a requirement for traceability (legal, customer, etc.), the company must define adequate methods for unique identifying of items, starting to client order, going through pucrhasing from suppliers, processes, and ending with delivery to client. Record must be kept to demonstrate traceability.	Labelling is a typical method. Other methods include signs on the wall with a picture of the items. Metal rods can have coloured paint put the end. However, if the differences are immediately obvious, there may be no need to label goods.
7.5.4	Customer property	This clause is applicabile if the company receives items that will be incorporated into final product, which will be supplied to client. It is applicable also when the company receives data from the client, e.g. drawings, plans. etc. I f any problems are discovered, or customer property is damaged or lost while under company's control, it must be reported back to the customer and records must be kept.	This clause is applicable only when goods or data are received from client to be incorporated into the final product, which is given back to the client.
7.5.5	Preservation of product	The company must ensure that all materials, subassemblies and finished goods, etc. are stored and handled so as to prevent them from damage or deterioration. H owever, this is not just limited to your stores or warehouse. It includes all areas where materials are handled, processed or moved. A lso included in this section are the steps that company must take to ensure that goods are not damaged following final inspection. If it is organization'sr responsibility to deliver goods to client (that is, they do not arrange for the collection of the goods), then company must also choose method of carriage appropriately. (If you use a carrier/courier, then they should be included in your supplier selection methods.	None.
7.6	Control of monitoring and measuring devices	The company must identify what measurements need to be made, and what equipment must be used. W here measuring equipment is used to inspect or set up the goods that you manufacture, you must ensure that they are accurate enough for the purpose. You should have then regularly checked (calibrated). You must be able to prove that the equipment is calibrated, so keep records of it I f you find that the equipment is faulty, you must consider the effect of that fault on the measurements taken using the equipment since the last time you knew it was OK. This may mean that you have to recall goods (e.g. if a braking system on a motor vehicle could have been adversely affected), or it may mean that no action is required (e.g. if the inaccuracy is not enough to cause any adverse consequences). Either way, you must formally consider the matter and record the consideration and the decision.	Records must be kept for calibration of devices. I f calibration is not possible against national or international standards, the basis for verification must be recorded (e.g. anti viral software from a market leader). I f an equipment is later found faulty, records must be kept regarding consideration of the effect of the problem.

Clause	Title	Requirements	Comments
8.	Measurement, analysis and improvement
8.1	General	The company must identify and plan measurement and monitoring activities in order to ensure that product and/or service is suitable and to enable improvement to processes and product. O rganization must consider the need for statistical techniques. C ompany has to consider the process by which is seeking continually improvement of the system.	The standard does not require the use of statistical techniques to be used; it just require the investigation of needed techniques. I t's unlikely for a company not to use statistical techniques. After all, every one is analysing the sales, by creating a simple chart... C ontinual improvement is one the biggest issues of the standard, along wiht customer satisfaction.
8.2	Monitoring and measurement
8.2.1	Customer satisfaction	The company must monitor customer feedback regarding its satisfaction (how requirement were fulfilled by the company). T his feedback must be an input for management review meetings.	None.
8.2.2	Internal audit	The company must perform internal audits, to ensure that the system meets ISO 9001:2000 requirements, also determining the level of implementation. A writen procedure is required to address this clause. I nternal audits must be planned. P lanning has to consider the importance and status of processes, also the results of previous audits. I t must be defined the criteria, scope, frequency of the audit and audit methods. A uditors must de independent and impartial. A uditors should have needed competence to perform audits. T hose responsible for managing the nonconformances found must decide for the need of actions and must implement in a diligent manner those ones, if any. R ecords must be kept for internal audits.	Iinternal auditing process is critical for quality management system. S uitable auditors should be used. If they are from inside the company, they have not to be affraid by their boss, nor to pursue hypotethical nonconformances, just because he or she had a dispute with someone else.
8.2.3	Measuring and monitoring of processes	Adequate methods must exist in order to prove that processes for production of good or supply of service are suitable and will continue to be suitable.	None.
8.2.4	Measuring and monitoring of product	At appropriated stages in production process, the company must measure the product, in order to determine the conformity of product. R ecords for tests and inspections must be kept. R ecords must identify the person responsbile for releasing the product to the next stage of production or to the client. R eleasing the product to the client must be made only when all planned inspections and tests were succesful.	This clause is focusing on what is called "in-process inspection" and "final inspection".
8.3	Control of nonconformity	Organization must ensure that nonconforming product is not used or supplied accidentally. N onconforming product must be identified. N onconforming product must be treated in a way, decided by a relevant authority. R ecords regarding the nature of nonconformance and actions for treatment must be kept. R eworked product must be verified (inspected) so that to ensure that it satisfy the requirements. I f a nonconforming product was released to the client, organization must take adequate measures correlated to the effects (actual or potential) of nonconformance.	A procedure is required by this clause. R ecording nonconformances is the first step towards continual improvement.
8.4	Analysis of data	Organization has to collect, to process and analyze relevant data in order to prove the suitability of quality system. D ata must come from specific sources and the output of analyze must provide information related to customer satisfaction, product conformance with requirements, processes characteristic and tendencies, suppliers and opportunities for preventive actions. These items are required by the standard.	As a requirement, this analyze must lead the company to improvements, based on facts, not suppositions.
8.5	Improvement
8.5.1	Continual improvement	This clause requires continual improvement of effectiveness of quality system which exists in organization. Basic motors for improvement are: quality policy; quality objectives; results of audits (either internal or external); analyze of data; corrective actions; preventive actions; management reviews	The clause asks for continual improvement regarding the effectiveness of the system. This means that improvement is not strictly related to the product or service supplied by organization. It can appear in processes, communication, human resource value, better evaluation systems, etc. In fact, any change made by organization, which lead to a better result than previous one is considered to be an improvement. A ny other method that organization things it’s suitable has to be used in order to achieve continual improvement.
8.5.2	Corrective action	The company must act so that to eliminate the cause of nonconformances. Corrective action (action taken to eliminate the cause) has to be in accordance with the effect of the problem. W hat is mandatory for an organization to comply with is: analyze of nonconformances; determining of causes; identify if there is needed corrective action. O nly if the company decide a corrective action is needed, the standard requires the determination and implementation of it, also the analyze of corrective action result. I t’s mandatory to maintain records regarding the results of implemented corrective actions.	A written procedure is required for addressing these requirements of the clause. F ighting against problem’s cause, gives the company what is required by clause 8.5.1 (improvement). Failing in identifying primary cause of a problem will lead the organization to spend time and money in a wrong direction, which in many cases complicate things; initial problem will come over and over... W Would be a good idea to link this clause to clause 8.3 Control of Nonconformity.
8.5.3	Preventive action	The company must act so that to eliminate the cause of potential nonconformance. Preventive action (action taken to eliminate the cause of a potential problem) has to be in accordance with the effect of the problem. What is mandatory for an organization to comply with is: identification of potential nonconformance; analyze of it; determining of causes; identify if there is needed preventive action. O nly if the company decides a preventive action is needed, the standard requires the determination and implementation of it, also analyze of preventive action result. I t’s mandatory to maintain records regarding the results of implemented preventive actions.	A written procedure is required for addressing these requirements of the clause. F ighting against potential problem’s cause, gives the company what a good chance to save money. That way, is prevented loose because of what is called poor quality.