Category: Audits

ISO 13485 Internal Audits: Preparing Medical Device Manufacturers for MDSAP

Why ISO 13485 Internal Audits Matter for MDSAP

For a medical device manufacturer, an internal audit is not simply a requirement to be completed before the certification auditor arrives, but if done well, it is the organization’s own independent test of whether the quality management system can consistently protect the patient, satisfy regulatory requirements and provide reliable evidence of control. That purpose becomes even more important when the organization is preparing for the Medical Device Single Audit Program (MDSAP).

ISO 13485 provides the quality management system foundation. MDSAP uses that foundation but applies it through a regulatory audit model that incorporates the applicable requirements of participating jurisdictions. A manufacturer that conducts only a clause-by-clause conformity audit may therefore be ISO 13485 compliant on paper and still be poorly prepared for MDSAP. The internal audit program must test the connections among processes, products, risks, records and regulatory obligations. ISO 13485 and MDSAP are therefore related, but not identical.

ISO 13485 Internal Audit Requirements and MDSAP

ISO 13485 is an international quality management system standard written specifically for medical devices and for regulatory purposes. Clause 8.2.4 requires the organization to conduct internal audits at planned intervals to determine whether the quality management system conforms to planned arrangements, the standard, and the organization’s own requirements, and whether it is effectively implemented and maintained. The audit program is to consider the status and importance of processes and areas, as well as the results of previous audits. Auditor objectivity, records, timely correction and corrective action, and verification of action taken are essential parts of the requirement.

MDSAP is not another management system standard. It is a structured audit approach under which a recognized auditing organization may conduct one regulatory audit that addresses the relevant requirements of the participating regulatory authorities for example, Australia, Brazil, Canada, Japan and the United States. A single audit does not mean one universal set of regulations. It means that applicable country-specific requirements are examined through one coordinated audit model.

This distinction matters. An ISO 13485 internal audit may ask, ‘Does the complaint process meet Clause 8.2.2?’ An MDSAP-oriented internal audit must also ask whether the complaint was assessed against reportability criteria in every market where the device is supplied, whether the decision was made within the required time, whether any advisory notice or field action was properly controlled, and whether the information entered the risk-management and CAPA processes. Therefore, the intend is to think in audit trails, not isolated clauses.

Follow Audit Trails, Not Isolated Clauses

The MDSAP audit model is process based and follows defined linkages. Its major process areas include management, device Marketing authorization and facility registration, measurement, analysis and continual improvement, medical device adverse events and advisory notices reporting It also includes design and development, production and service controls and purchasing. The audit is designed to follow evidence from one process into another. That approach should influence the manufacturer’s internal audit program. Instead of auditing document control on Monday, purchasing on Tuesday and complaints on Wednesday as unrelated subjects, select representative devices, changes, suppliers, complaints or nonconformities and trace them through the system. For example, a complaint involving a failed component can provide an audit trail through complaint intake, evaluation and investigation (Clause 8.2.2); regulatory reporting and advisory-notice decisions (clause 8.2.3 and applicable national requirements); analysis of data and detection of adverse trends (clause 8.4); risk-management review and design or process implications (clauses 7.1 and 7.3); supplier controls and purchasing information (clause 7.4); and correction, CAPA and effectiveness review (clauses 8.3, 8.5.2 and 8.5.3).

Build a Risk-Based ISO 13485 Internal Audit Program

This is a much stronger test of effectiveness. It also reflects the way regulatory auditors think. A weakness rarely remains confined to one procedure. A missed complaint trend may reveal problems in data analysis, risk management, supplier control and management oversight at the same time. The idea is to build the audit program around risk and regulatory importance. Clause 8.2.4 expects the audit program to consider the status and importance of the processes and areas to be audited, and previous audit results. This is a clear basis for risk-based planning. ‘All clauses once a year’ may be easy to schedule, but it is not necessarily an effective audit program.

Processes with a direct effect on device safety or regulatory compliance should receive greater depth or frequency. These may include sterile barriers, software validation, special processes, design transfer, complaint handling, adverse-event reporting, supplier controls, traceability, product release and CAPA. The organization should also consider new products, transfers, acquisitions, major changes, recurring nonconformities, supplier deterioration, adverse trends and prior external-audit findings.

Risk-based does not mean that low-risk processes are ignored. It means that audit resources are applied intelligently. The program should document why certain processes are audited more frequently, why particular products or sites were sampled, and how previous results influenced the next cycle. An MDSAP auditor should be able to see that the internal audit program responds to the actual risk profile of the business.

Include Applicable Regulatory Requirements

The need is to add the applicable regulatory requirements. ISO 13485 repeatedly refers to applicable regulatory requirements. An internal audit cannot verify conformity unless the auditors know what those requirements are. The organization therefore needs a maintained regulatory matrix or equivalent method that identifies the markets served, device classifications, licenses or registrations, reporting obligations, record-retention periods, language or labeling requirements, and responsible functions.

This matrix should be used when preparing audit criteria and sampling records. If a device is marketed in Canada, Brazil and the United States, the auditor should not stop after confirming that an ISO procedure exists. The auditor should verify that the current authorizations are in place, changes have been assessed for notification or approval, establishment information remains accurate, and reportable events have been handled under the applicable jurisdictional rules.

FDA QMSR and ISO 13485 Alignment

For U.S. manufacturers, the regulatory context changed materially on February 2, 2026, when FDA’s Quality Management System Regulation (QMSR) became effective. QMSR incorporates ISO 13485:2016 by reference, with additional FDA requirements and the FD&C Act controlling where a conflict exists. FDA also replaced the former QSIT inspection approach with its updated inspection process. This alignment makes a mature ISO 13485 system more valuable, but it does not eliminate U.S.-specific obligations. Internal auditors must understand both the incorporated standard and the regulatory additions.

Begin the MDSAP Audit with Management Responsibility

Top management auditing should be the start of the audit. That way down the line at workplaces this can be verified. Therefore, audit management responsibility first. MDSAP places strong emphasis on management responsibility because leadership provides the resources and decisions that hold the system together. Internal audits should test more than whether management-review minutes exist. Under clauses 5.1 and 5.6, auditors should evaluate whether top management receives meaningful information, acts on it and ensures the continuing suitability, adequacy and effectiveness of the system.

Useful trails include overdue CAPAs, complaint trends, supplier performance, audit findings, regulatory changes, product nonconformities and resource constraints. Was management given accurate information? Were decisions assigned, resourced and completed? Did management recognize a systemic issue before an external auditor did? Repeated problems accompanied by polished management-review minutes are evidence that the review may be ceremonial rather than effective.

Strengthen High-Value MDSAP Audit Trails

The spirit of the auditing clause from ISO 13485 seen with MDSAP implies strengthen the high-value audit trails to ensure:

Measurement, analysis and improvement: this process is often the best starting point because it shows whether the manufacturer learns from its own data. Audit complaint handling, internal audits, nonconforming product, data analysis and CAPA as one system. Challenge the rationale for investigation and reportability decisions. Select closed CAPAs and verify effectiveness using subsequent performance data—not merely evidence that a procedure was revised or training was completed.
Design and development: for devices subject to design controls, trace user needs into design inputs, outputs, verification, validation and transfer (Clause 7.3). Confirm that risk-management activities are integrated throughout development and that design changes are reviewed, verified or validated as appropriate, approved and assessed for regulatory impact. Include software, usability, cybersecurity and supplier-developed elements where applicable to the product.
Production and service controls: follow a released device from approved specifications through production, inspection, acceptance, identification, traceability, storage and distribution (Clauses 7.5 and 8.2.6). For processes whose output cannot be fully verified later, examine validation, revalidation triggers, equipment, personnel qualification and process monitoring. Ask whether acceptance evidence can be linked to the person, equipment, method and current specification used.
Purchasing and outsourced processes: clause 7.4 requires controls proportionate to the supplier’s effect on product quality. Internal auditors should test whether supplier classification drives selection, monitoring and reevaluation; whether purchasing information accurately states requirements; and whether changes are communicated and controlled. Outsourcing transfers work, not accountability. Sample critical suppliers and verify that poor performance leads to escalation, corrective action or reconsideration of approval status.
Adverse-event and advisory-notice reporting: this regulatory process deserves deliberate sampling. Begin with complaints, service reports, returns, literature, distributor communications or trend signals that could involve serious injury, malfunction or public-health risk. Verify the reportability assessment, decision date, rationale, submission evidence, follow-up and linkage to CAPA and risk management. A sound decision should be reproducible from the record without relying on the memory of one regulatory specialist.

Make Internal Audit Evidence MDSAP-Ready

Make internal audit evidence MDSAP-ready A credible audit file should tell the story of what was tested and what was concluded. It should contain the audit objective, scope, criteria, auditor independence, processes and locations covered, samples selected, evidence reviewed, findings, conclusions and follow-up. Vague statements such as ‘procedure reviewed—acceptable’ do not demonstrate audit depth.

The organization should also be careful not to confuse a document review with an audit. Procedures may be compliant while practice is not. Internal auditors need access to records, personnel, electronic systems and the workplace. They should observe activities, interview process owners, sample objective evidence and follow trails across departmental boundaries.

A Practical MDSAP Readiness Method

A practical MDSAP-readiness method ensures that a manufacturer can progressively strengthen its internal audit program through the following six actions:

· Map the QMS processes to the MDSAP audit model and to the regulations of every market served.

· Create a risk-based audit schedule using product risk, process importance, change, performance and previous results.

· Train auditors in ISO 13485, the MDSAP process approach and the applicable jurisdictional requirements—not only in generic auditing technique.

· Use end-to-end audit trails built around real devices, complaints, changes, suppliers and CAPAs.

· Write findings against clear criteria and address systemic causes, not merely the isolated record sampled.

· Verify correction, corrective action and effectiveness, then feed significant results into management review.

A useful final step is a focused readiness audit conducted in the expected MDSAP sequence. This should not be a staged performance in which employees memorize answers. It should be an honest stress test of the system, including incomplete records, adverse examples and older files. The objective is to discover weakness while the organization still has time to act.

Common MDSAP Audit Weaknesses to Avoid

Common weaknesses to avoid:

· Auditing only against ISO 13485 and omitting country-specific regulatory criteria.

· Using the same checklist every year regardless of changes, risks or past results.

· Allowing auditors to audit their own work or areas for which they are directly responsible.

· Reporting findings without enough objective evidence to support correction and root- cause analysis.

· Closing CAPA on completion of tasks rather than demonstrated effectiveness.

· Failing to connect complaints, adverse events, risk management, design changes and supplier action.

· Treating management review as a presentation rather than a decision-making process.

Conclusion

In conclusion my thought is MDSAP readiness is not achieved by adding another checklist to the audit folder. It comes from using internal audits to test whether the entire management system works as an integrated regulatory system. ISO 13485 Clause 8.2.4 provides the mechanism; management commitment, competent auditors, risk-based planning and disciplined process trails give that mechanism value. The best internal audit is not the one that produces the fewest findings. It is the one that identifies weaknesses before they affect a patient, a customer or a regulatory authority. When internal audits follow the evidence across functions, challenge the effectiveness of controls and confirm jurisdiction-specific obligations, the manufacturer is not merely preparing for MDSAP. It is strengthening the system that MDSAP is intended to evaluate—and improving the assurance that safe and effective medical devices will consistently reach the people who depend on them.

About the Author:

Inderjit (IJ) Arora, Ph.D., is the Chairman of QMII. He serves as a team leader for consulting, advising, auditing, and training regarding management systems. He has conducted many courses for the United States Coast Guard and is a popular speaker at several universities and forums on management systems. Arora is a Master Mariner who holds a Ph.D., a master’s degree, an MBA, and has a 35-year record of achievement in the military, mercantile marine, and civilian industry.

RCMS vs ISO 14001: Understanding the Responsible Care Management System for Chemical Companies

Chemical companies may think that by implementing ISO 14001 they meet the requirements for Responsible Care ®. ISO 14001 is an internationally accepted standard that provides the framework for an environmental management system. However, the Responsible Care ® program demands more. It adds a layer of requirements for Health & Safety and Security to be integrated along with environmental requirements.

Members of the American Chemistry Council (ACC) commit to implementing a system aligned to either the Responsible Care ® Management System (RCMS) Technical Specification or the RC 14001 which integrates the requirements of RCMS and ISO 14001 into one standard. Companies choosing the RC14001 standard can then claim conformity to both standards while putting in similar effort.

This article clarifies what each framework covers, where they overlap, and how to audit both efficiently

What RCMS Is and Who Requires It

Responsible Care ® is the American Chemistry Council’s (ACC) industry-wide performance initiative. It is not just an environmental standard. The need for a performance standard was identified following major incidents at chemical plants in the 1980s. RCMS is more than just a set of operational requirements. It outlines the requirements for a management system. Management systems include interaction from the highest level of the organization to the lowest level and enables effective interaction across processes.

ACC member companies are contractually required to certify to RC 14001 or RCMS; non-members may still be pulled in by customer or supply-chain requirements. Some organizations may voluntarily opt to confirm to the requirements of these standards. While RCMS is not a regulatory requirement, it is an obligation an ACC member opts to conform to.

RCMS follows the plan-do-check-act cycle and dovetails well with the requirements of ISO 14001. It expands upon the environmental requirements of ISO 14001 to include health & safety and security (HSS). It is also supported by the underlying ACC codes. Namely the Process Safety code, the Product Safety code and the Security code.

RCMS vs ISO 14001: Key Overlaps and Differences

Both standards, the RCMS and RC14001 are management system standards and thus based on the Plan-Do-Check-Act cycle. This means that both require the foundational aspects of a management system. These include leadership commitment, a documented policy, operational controls to manage identified risks, monitoring of the system, internal audits and management reviews.

Each of these standards also require the organization to determine their compliance obligations and to then take measures to meet them and evaluate them. The system as a whole is to be used to drive continual improvement. The key difference is that ISO 14001 has a focus solely on environmental requirements and does not address HSS requirements.

RCMS and RC14001 also integrate loosely via the Process Safety Code the OSHA PSM requirements. It is, however, not a replacement for these regulatory requirements. Further the two RC standards also address product stewardship which entails enhancing EHSS requirements throughout the supply chain from cradle to cradle.

Compared to ISO 14001, the RC standards also carry specific ACC-mandated elements (e.g., community outreach/CAER, security vulnerability assessments) with no ISO 14001 equivalent. There are also different certification requirements when it comes to RCMS and ISO 14001. The RCMS requiring just one audit by an approved provider every three years.

Why Chemical Companies Often Need Both

Depending on the customer base, especially when international, an organization can benefit from using the RC14001 standards. There is an increasing demand from stakeholders for sustainable production and procurement. As such many are seeking ISO 14001 certification. As a member of ACC companies that need to conform to RCMS may benefit from alignment with RC14001. Many downstream customers specify ISO 14001 certification contractually, independent of ACC membership

ACC membership requires member companies must certify to RC 14001 or RCMS on a fixed cycle to remain in good standing. There is however the added benefit to company reputation from an independent verification of practices to demonstrate to stakeholders and interested parties the organization’s commitment to EHSS goals.

Most chemical manufacturers end up needing both frameworks running concurrently rather than choosing one

Combining RCMS and ISO 14001 Audits

These standards aside, if your company has an integrated management system, there is no reason for you not to be doing integrated audits. So, what is an integrated audit? It is an audit where an auditor of team of auditors competent in the requirements of the various standards samples and assess the effectiveness of controls as determined and applied across the organizational processes. This to the various standards the company is certified to.

With ISO moving to the harmonized standard approach starting in 2013, most ISO management system standards including the RC14001 share the same 10 clause approach. This makes it easy to audit the system as there is shared audit evidence across standards. There is also cost savings to the company both from audit time of the auditor and the time of the auditee spent in the audit. There is less burden on the auditees overall from reduced audit fatigue.

An integrated audit essentially has a single audit schedule, combined checklists mapped to both standards’ (RCMS and ISO14001) clauses and one audit team covering both scopes. Companies choosing RC14001 have already integrated the requirements of RCMS and ISO 14001 into one standard and so perform a single audit. Integrated audits also result in fewer duplicate corrective actions for the same root cause

Building Auditor Competence for RCMS and RC14001

The above integrated audits require auditors preferably trained in both standards simultaneously, not two separately trained pools. This of course again to save on time and cost. QMII’s RC14001 Lead Auditor training approved by Exemplar Global covers the requirements of RCMS, RC14001 and the applicable ACC codes.

Auditors must understand the relevant additional RCMS elements in ISO 14001 and be able to be objectives if just performing and ISO 14001 audit versus an RCMS or RC14001 audit. An effective auditing course approaches audits as a positive activity that helps the organization identify improvement opportunities and audits as key in the preventive cycle. With this integrated competence auditors must remain objective and learn to look beyond documented processed to enable better inputs for leadership.

An auditing course apart from the requirements of the standard must also build competence in the principles of ISO 19011 and include hands on workshop that allow auditors to hit the ground running and to quickly contribute to their organization’s audit program.

Conclusion

In conclusion, RCMS and ISO 14001 aren’t competing standards, they’re complementary. RCMS adding in the HSS requirements to build on the foundation of an ISO 14001 if already in place. Those companies choosing between RCMS and RC14001 may want to opt from RC14001 given the later ease of integrating other ISO standards such as ISO 9001.

A well-trained auditor adds value to the system. They must provide good insight to the leadership on the state of the system, and this can only come from choosing a good sample, including whom to interview, questions to ask and documents to evidence.

ACC membership requires conformity to either RCMS or RC14001. Regardless of the option chosen by an organization, a trained audit team can only add value to the system. To learn more on the differences and build your auditing skills consider QMII’s RC14001 and RCMS Lead Auditor course.

Systematizing Government at all levels by using ISO 18091

The process-based management system approach gives any organization the best shot at systematically improving administration and addressing nonconformities, so the output of the administration is a confirming product as step one. The next step would be to continually improve the system and meet objectives. ISO 18091 (Quality management systems guidelines for the application of ISO 9001 in local government) is an international standard designed specifically to help local governments and municipal authorities implement effective quality management systems (QMS) based on ISO 9001. Using a standard which encompasses worldwide wisdom on the system approach as the basis of the system is better than reinventing the wheel every time.

The Technical committees for various standards (TC-176 for ISO 9001) bring to the table a lot of wisdom on which they frame these standards. ISO 18091:2019, the second edition, was reviewed and confirmed by ISO in 2024 and therefore remains current. It was prepared by ISO/TC 176, quality management and quality assurance. This is important because the guidance is connected directly to the accepted principles and requirements of ISO 9001 while recognizing that local government has responsibilities that are different from those of a commercial organization.

Government affects the citizen throughout life. Birth registration, education, public health, roads, water, sanitation, emergency services, licensing, land use and public safety are all delivered through processes. When these processes are left to personalities, informal practices or the priorities of the moment, results vary. A management system converts good intentions into defined responsibilities, controls, measures and opportunities for correction. It also helps preserve institutional knowledge when elected leaders or senior officials change.

The word systematizing should not be misunderstood as adding bureaucracy. The objective is to simplify and control the work so that it produces intended results. ISO 9001:2026, Clause 4.4, requires the organization to determine the processes needed for the QMS, their interactions, the criteria and methods for operation and control, the resources required, responsibilities, risks and opportunities, and the methods for evaluation and improvement. ISO 18091 explains how this process approach can be applied to public policy and municipal services.

Rather than creating a standalone set of requirements, ISO 18091 translates the core concepts, principles, and clauses of ISO 9001:2015 into terms, structures, and processes that directly address the public sector. The standard provides the core objectives for good administration particularly, citizen centric focus, reliability and transparency and alignment with UN (United Nations) SDGs (sustainable development goals) as follows:

Citizen-Centric Focus: Adapts the ISO 9001 concept of “customer satisfaction” into citizen satisfaction, focusing on key municipal responsibilities such as public safety, infrastructure, waste management, healthcare, and education.
Reliability & Transparency: Standardizes public administration processes to improve transparency, accountability, operational efficiency, and overall public trust (“Trusted Governance”).

Alignment with UN SDGs: Serves as a framework to implement, track, and measure progress toward the United Nations Sustainable Development Goals (SDGs) at the municipal level.

Citizen focus begins with understanding who the interested parties are and what they reasonably require. Clause 4.2 of ISO 9001 asks the organization to determine the relevant interested parties and their requirements. In a local government these parties extend beyond the person standing at a service counter. They include residents, visitors, businesses, employees, elected representatives, regulators, service contractors, vulnerable groups and future generations affected by present decisions. ISO 18091 helps the local government translate these different expectations into manageable processes and measurable public policy.

Leadership is central and Clause 5.1 requires top management to demonstrate leadership and commitment to the QMS. For local government this means that elected and appointed leaders cannot delegate the system to a quality coordinator and consider the work complete. Leaders must establish policy and objectives, provide resources, assign authority, review performance and act when results are not achieved. The system succeeds when it becomes the way the government manages, rather than a separate quality program maintained for an audit. Accountability remains with leaders and delegation of authority as per clause 5.3 would not mean leaders are not accountable.

Risk-based thinking also has direct public value. Clause 6.1 requires action on risks and opportunities. A municipality can therefore consider foreseeable interruptions and failures before they harm citizens: loss of drinking water, delayed permits, failure of waste collection, deterioration of roads, cyber incidents, extreme weather, contractor failure or loss of critical knowledge. Controls can then be proportionate to the consequence. The same analysis can identify opportunities such as digital services, shared resources, preventive maintenance and clearer communication with citizens.

A reliable system also distinguishes between correction and corrective action. If a citizen receives an incorrect permit, correcting the document solves the immediate problem. Clause 10.2 goes further by requiring the organization to react to the nonconformity, deal with its consequences, determine whether the cause could create the same or a similar failure elsewhere, implement needed action and review its effectiveness. This changes administration from repeated firefighting to prevention of recurrence.

The key Components and annexes of the standard include structured tools specifically tailored to municipal management. ISO 9001 remains the primary standard. ISO 18091 is not a sector specific standard in itself. It is a guideline enabling use of the ISO 9001 for governance. The standard provides:

Clause-by-Clause ISO 9001 Translation: Offers guidance on how each standard requirement (e.g., leadership, risk management, performance evaluation) applies to public policy and municipal administration.
Diagnostic Assessment Tool (Annex A): A self-assessment tool utilizing 39 key performance indicators across four broad policy categories:
- Institutional development for good governance
- Sustainable economic development
- Social development
- Sustainable environmental development

Integral Quality Management Processes (Annex B): Guidance on designing and maintaining processes that ensure reliable public service delivery.
Integral Citizen Observatories (Annex C): Guidelines for engaging citizens directly in monitoring public policy, fostering transparency and continuous improvement.
UN Agenda 2030 Alignment (Annex D): Maps local government management indicators directly to the 17 UN Sustainable Development Goals.

The clause-by-clause guidance covers the full management cycle: context in clause 4, leadership in clause 5, planning in clause 6, support in clause 7, operation in clause 8, performance evaluation in clause 9 and improvement in clause 10. This sequence is useful because it prevents a government from jumping directly to measurement without first defining its purpose, processes, responsibilities and controls. Measurement then becomes evidence for decisions rather than a collection of statistics with no clear use.

Annex A can provide the starting point. Its 39 indicators enable a local government to examine public policy as an integrated whole. The value lies less in declaring a score and more in identifying where conditions are unacceptable, where essential practices are only partly established and where results are being sustained. Priorities can then be based on evidence, citizen need and risk. Periodic reassessment provides a visible record of progress and exposes areas that remain dependent on temporary effort.

Annex B supports the process view. Services such as issuing a license or repairing a road are rarely the work of one department from beginning to end. They require inputs, decisions, resources, contractors, information and communication across organizational boundaries. Mapping these interactions helps identify delays, duplication, unclear handoffs and missing controls. It also allows objectives to be assigned to the complete service, not merely to the activity of an individual department.

Annex C recognizes that citizens should not be treated only as passive recipients of government output. An integral citizen observatory provides a structured way for citizens to observe public policy, examine evidence and contribute to accountability. Citizen participation becomes more useful when it is based on defined indicators and verified information. It can confirm where services are working and identify gaps that internal reporting may overlook.

Annex D connects the local indicators to the UN Sustainable Development Goals and to other assessment and management systems. This helps local government translate broad global commitments into local processes and measures. A goal such as clean water, sustainable communities or climate action becomes meaningful only when responsibility, resources, controls, measures and follow-up are established at the level where services are delivered.

The key difference in ISO 18091 from the primary standard ISO 9001 is the guidelines. ISO 9001 provides generic requirements for any organization, whereas ISO 18091 is a sector-specific guide. It does not add or alter ISO 9001’s fundamental requirements; rather, it bridges the gap between private-sector quality management language and the multi-stakeholder, public-policy realities of local government.

This distinction is important for certification. A local government may be assessed for conformity to ISO 9001, but ISO 18091 itself supplies guidance and does not create additional certifiable requirements. The guidance should therefore be used to make the ISO 9001 system relevant and effective, not as a checklist that produces another layer of documentation.

Clause 7 helps ensure that plans are supported by competent people, suitable infrastructure, organizational knowledge, communication and controlled documented information. In government, documented information provides continuity and transparency, but documentation should serve the process. A procedure that is not followed, a record that is not analyzed or a measure that does not support a decision adds little value. The necessary amount and form of documentation should depend on complexity, risk, competence and the need for accountability.

Clause 8 brings the discipline to service delivery. Requirements must be understood, changes controlled, external providers managed and nonconforming outputs identified. This is particularly relevant because many public services are delivered through contractors or partnerships. Outsourcing an activity does not outsource accountability. The local government must determine the controls needed to ensure that externally provided processes and services continue to meet requirements.

Clauses 9.1, 9.2 and 9.3 close the management loop through monitoring, internal audit and management review. Clause 9.1.2 addresses customer satisfaction; ISO 18091 places this in the context of citizens and other interested parties. Satisfaction surveys can contribute evidence, but they are not enough by themselves. Service times, complaints, recurrence of failures, infrastructure condition, regulatory compliance, access, cost and achievement of public objectives provide a fuller picture. Internal audit should test whether processes are implemented and effective, while management review should lead to decisions on improvement, resources and needed changes.

Implementation can begin on a manageable scale. The local government can define its context and interested parties, use Annex A for an initial diagnosis, select one or two high-impact services, map their processes, establish measures and responsibilities, and begin the cycle of audit, review and corrective action. Early projects should demonstrate that the system makes work clearer and services more reliable. Lessons can then be applied across other departments and levels of government.

The benefits are practical. Citizens receive more consistent services and clearer information. Employees understand responsibilities and handoffs. Leaders receive evidence on whether policies are producing intended results. Suppliers and contractors work within defined controls. Problems are recorded and their causes addressed. Objectives are linked to resources and reviewed. Transparency improves because processes, measures and decisions can be explained.

ISO 18091 can therefore help systematize government without attempting to standardize political choices or make every municipality identical. ISO 9001 itself does not require uniformity in the structure of quality management systems. Each government retains its mandate, priorities and local context. What becomes systematic is the method used to understand needs, plan services, manage risk, deliver outputs, evaluate results and improve.

The real test of good governance is not the number of procedures written or certificates displayed. It is whether the administration consistently fulfills requirements, corrects failures, learns from evidence and improves the results experienced by citizens. ISO 18091 provides a sound guideline for doing this. Used by leadership and team with purpose, it can make government more reliable, transparent and capable of sustaining improvement beyond changes in personalities and political terms.

About the Author:

How Will an Internal Audit Help Any Business?

An internal audit is often viewed as a compliance exercise, a scheduled activity designed to check whether an organization is following its procedures and meeting the requirements of a standard. However, a well-planned internal audit can provide much more value. It can help a business identify risks, improve processes, reduce costs, strengthen customer satisfaction, and support better management decisions.

Whether a company operates under ISO 9001, ISO 14001, ISO 45001, ISO 27001, or another management system, internal auditing can become an important business-improvement tool.

Identifying Problems Before They Become Serious

One of the greatest benefits of an internal audit is early problem detection, like they, if you have a headache for more than a day then it’s best to get it checked before it becomes something big and uncurable.

Every organization has weaknesses. Procedures may not be followed consistently, records may be incomplete, employees may misunderstand responsibilities, or processes may have gradually changed without the relevant documentation being updated.

An internal audit provides an opportunity to identify these issues before they develop into major problems.

For example, an audit may discover that equipment inspections are not being completed according to schedule. If this issue is identified early, management can take corrective action before equipment failure causes production delays, customer complaints, or safety incidents.

In this way, internal audits are preventive as well as corrective.

Improving Business Processes

Internal auditing should not simply ask, “Are we following the procedure?”

A stronger audit asks, “Is this process actually working?”

A procedure may technically meet requirements but still be inefficient. Employees may spend unnecessary time completing forms, approvals may take too long, information may be duplicated, or communication between departments may be poor.

An internal audit can identify these inefficiencies and provide evidence for process improvement.

For example, an organization may discover that a purchasing process requires three separate approvals for relatively low-risk purchases. The audit could identify unnecessary delays and encourage management to simplify the process while maintaining appropriate controls.

The result is a system that is not only compliant but also more efficient.

Reducing Costs and Waste

Businesses constantly look for ways to reduce unnecessary costs. Internal audits can contribute directly to this objective.

Auditors may identify:

Repeated errors and rework
Excessive material waste
Inefficient use of resources
Unnecessary administrative activities
Poor inventory controls
Equipment maintenance problems
Duplicate processes
Supplier-related problems

Consider a manufacturing organization experiencing a high level of product rework. An internal audit may trace the problem back to unclear work instructions or inconsistent inspection practices.

Addressing the underlying cause can reduce scrap, labor costs, production delays, and customer complaints.

Therefore, the financial value of an internal audit can be much greater than the cost of conducting the audit.

Strengthening Risk Management

Modern businesses operate in environments filled with risks. These may include operational, financial, environmental, cybersecurity, supply-chain, regulatory, and reputational risks.

Internal audits provide management with an independent examination of how effectively these risks are being controlled.

For example, an audit may determine that an organization has identified cybersecurity risks but has not adequately controlled access to sensitive information. Similarly, an environmental audit may identify inadequate controls over waste management.

The auditor does not necessarily solve the problem. Instead, the audit provides management with objective information so appropriate action can be taken.

This makes internal auditing an important component of risk-based management.

Supporting Compliance

Organizations are often required to meet laws, regulations, contractual requirements, industry standards, and internal policies.

Failure to comply can result in fines, legal problems, loss of customers, operational disruption, or damage to reputation.

Internal audits can provide an early warning system.

For organizations certified to an ISO standard, internal audits also help determine whether the management system continues to conform to applicable requirements and whether processes are effectively implemented.

Importantly, an internal audit should not be treated as preparation for “passing” an external audit. Its purpose is to determine whether the organization’s management system is genuinely effective.

Preparing for External Audits

A strong internal audit program can significantly improve an organization’s readiness for certification, surveillance, recertification, regulatory, or customer audits.

External auditors are likely to examine evidence showing how processes are controlled and whether the organization is meeting applicable requirements.

If internal audits are performed regularly, problems can be identified and corrected before an external auditor discovers them.

For example, an internal audit may identify an incomplete training record, an overdue calibration, or an ineffective corrective action. Management can address the issue before it becomes an external-audit finding.

The objective should not be to hide problems from external auditors. Instead, internal audits should help the organization discover and resolve its own problems first.

Improving Employee Awareness

Internal audits also create opportunities for employee engagement and learning.

During an audit, employees may be asked questions about their responsibilities, procedures, objectives, risks, and controls. This can reveal whether employees truly understand the management system or are simply completing tasks because they have been instructed to do so.

An auditor might discover that employees understand what they do but do not understand why they do it.

That distinction is important.

Employees who understand the purpose behind a process are generally better positioned to recognize problems, make appropriate decisions, and suggest improvements.

Internal auditing can therefore contribute to a stronger culture of quality, accountability, and continuous improvement.

Providing Management With Objective Information

Managers often make decisions based on reports, meetings, performance indicators, and employee feedback. While these sources are valuable, they may not always reveal what is happening within a process.

Internal auditors provide another perspective.

A good auditor collects objective evidence through interviews, observation, document review, and sampling. The resulting findings can help management understand the actual condition of a process.

For example, management may believe that customer complaints are being addressed effectively. An internal audit might reveal that complaints are being closed quickly but that root causes are not being properly investigated.

That information can lead to better management decisions.

Encouraging Continual Improvement

Continual improvement is a fundamental principle of many management systems, but improvement cannot occur effectively without knowing where improvement is needed.

Internal audits provide that information.

An audit can identify trends and recurring weaknesses. If the same type of finding appears repeatedly, management should consider whether the organization is addressing symptoms rather than underlying causes.

For example, repeated findings involving incomplete records may indicate a deeper problem with training, process design, workload, responsibilities, or management oversight.

Instead of repeatedly correcting individual records, the organization can investigate the systemic cause.

This is where internal auditing moves from simple compliance checking to genuine business improvement.

Increasing Customer Confidence

Customers want to know that a business can consistently deliver products or services that meet requirements.

A reliable internal audit program helps strengthen the systems supporting that consistency.

By identifying process weaknesses, controlling risks, improving corrective actions, and monitoring performance, internal auditing can contribute to improved product and service quality.

This can ultimately lead to fewer complaints, fewer returns, better delivery performance, and stronger customer relationships.

Conclusion

An internal audit should not be viewed as an exercise designed to find fault with employees. Its real purpose is to provide an objective assessment of how well the organization is operating and where it can improve.

A valuable internal audit identifies weaknesses before they become major problems, improves processes, reduces waste, supports compliance, strengthens risk management, prepares the organization for external audits, and provides management with reliable information for decision-making.

The most effective organizations do not ask, “How can we pass the audit?”

They ask, “What can this audit teach us about our business?”

When internal audits are approached in this way, they become much more than a requirement of an ISO management system. They become a practical management tool that helps businesses operate more efficiently, control risk, improve performance, and achieve sustainable growth.

Ultimately, the value of an internal audit is not measured by how many findings an auditor raises. It is measured by how effectively the organization uses those findings to become better.

About the Author:

Anjalika Singh is the President of QMII (Quality Management International, Inc.), a global management systems consulting firm headquartered in Ashburn, Virginia. Over the course of her career, she has developed a sharp intuitive sense combined with strong operational and training management skills, making her a key asset in QMII’s consulting and training initiatives. Her work focuses on practical lead-auditor training and helping organizations adopt ISO and industry-specific management systems in a way that delivers real business value. Anjalika also serves as President and CEO of iCertifications, LLC, where she leads efforts to make accredited ISO certification services accessible to small and medium-sized businesses.

AS9100 Certification: What Aerospace Suppliers Need to Know Before Bidding

So much is happening in the quality and related world. ISO 9001:2026 is on the way, and the mid-September update this year changes look superficial but go deeper than a checklist update. The implementation is being more closely looked at then just cosmetic lip service. Leadership accountability, use of risk inputs to drive opportunity, and then the emphasis on effective root cause analysis is all being redefined. This will be then followed with updates to other standards in the harmonized structure (HS) and the aerospace standards.

In this article against this changing background, I want to look at the focus of aerospace suppliers. For commercial or defense suppliers preparing to bid on tier-1 or prime contractor awards, technical capability and competitive pricing are only half the equation. Prime contractors operate under stringent regulatory oversight, where a single non-conforming part or untraced engineering change can ground an aircraft, void a defense contract, or jeopardize mission safety. Therefore, before submitting a bid, suppliers must understand that a Quality Management System (QMS) built to AS9100 lead auditor certification is not just an operational advantage-it is a mandatory license to compete. Then why AS9100 is a prerequisite, and not a differentiator, in Aerospace, is a valid question.

In commercial manufacturing, ISO 9001 certification often serves as a competitive differentiator that signals product reliability. In aerospace, defense, and space supply chains, AS9100 certification is table stakes. Prime contractors (such as Boeing, Lockheed Martin, Northrop Grumman, and Airbus) maintain strict, approved vendor lists (AVLs). To gain initial consideration for a request for proposal (RFP), suppliers must show evidence of AS9100 compliance and maintain an active profile in the online aerospace supplier information system (OASIS) database. Having AS9100 does not win you the bid, it simply earns you a place at the table. Lacking it automatically disqualifies your bid during pre-qualification screening, regardless of your technical prowess or low-cost structure.

Therefore, it is important to consider how prime contractors vet supplier quality systems. Achieving AS9100 certification gets a company listed on the AVL, but prime contractors conduct their own rigorous supplier evaluation before awarding contracts. Tier-1 buyers do not rely solely on third-party audit certificates. They perform deep-dive supplier quality assessments to evaluate operational capability including checking OASIS database audit history. Primes inspect past third-party audit results, minor/major Non-Conformance Reports (NCRs), and corrective action (CA) performance recorded in OASIS.

Primes conduct on-site pre-award audits. Quality engineers evaluate physical shop-floor controls, calibration records, tool storage, material handling, and overall culture. Then there is the sub-tier supplier control. OEM auditors inspect how effectively you flow down technical and quality requirements to your sub-tier suppliers. On-time delivery (OTD) and quality metrics are looked at including historical performance data on parts per million (PPM) defect rates and delivery performance. Looking at the AS9100 (IA9100) and ISO 9001 changes for aerospace suppliers we see that the AS9100 Rev D encompasses the full text of ISO 9001:2015, layering over 100 aerospace-specific additions. Transitioning from ISO 9001 to AS9100 requires shifting from general process controls to strict risk prevention and traceability.

Area	ISO 9001:2015	AS9100 Rev D (Aerospace Addition)
Risk Management	High-level consideration of organizational risks and opportunities.	Formal operational risk assessment integrated into production planning and design.
Product Safety	Implicit within customer satisfaction and product quality.	Explicit mandatory requirements to identify safety-critical characteristics and lifecycle risks.
Counterfeit Parts	Basic vendor oversight and purchasing controls.	Strict policies for counterfeit part prevention, source verification, and segregation.
Configuration	Basic control of documented changes and revisions.	Formal Configuration Management across design, manufacturing baselines, and engineering changes.
Supplier Control	General evaluation and selection of external providers.	Mandatory requirement flow-down (e.g., test reports, NADCAP ((National Aerospace and Defense Contractors Accreditation Program)) requirements, retention periods).

For organizations building or upgrading an aerospace QMS prior to bidding on contracts, implementation should follow a structured approach including perform a gap analysis. Benchmark existing processes against AS9100 Rev D clauses to pinpoint missing controls (e.g., risk matrices, counterfeit mitigation, or design verification tools). Formalize Operational Risk Management by establishing systematic methods (such as FMEA or risk registers) to assess operational risks prior to taking on new job orders. Additionally, to establish requirement flow-down mechanics by building controls ensuring customer purchase order requirements, engineering drawings, and quality clauses are automatically flowed down to sub-tier suppliers and shop-floor traveler routes. Then there is the need to train key personnel by educating leadership, process owners, and shop-floor staff on aerospace quality imperatives, emphasizing individual contributions to product safety and ethical behavior. Finally, to execute internal audits & management reviews by conducting full internal audit cycles to verify process effectiveness before inviting an accredited registrar / certification Body (CB).

There are of course the configuration management and traceability requirements. The aerospace documentation burden is significantly higher than in general manufacturing, largely centered around configuration management and full material/process traceability. For configuration management (AS 9100 clause 8.1.2) organizations must control the design and manufacturing baseline. Every engineering change order (ECO) must evaluate impact on form, fit, function, and test procedures before implementation. Traceability & identification (AS 9100 clause 8.5.2): Suppliers must maintain bidirectional traceability from raw material heat numbers and special process certs to individual batch or serial numbers. Acceptance media control requires use of physical inspection stamps, electronic signatures, or system authorizations must be strictly controlled to prevent unauthorized signoffs.

Looking ahead auditing as emphasized in the revised ISO 19011:2026 and anticipated changes in ISO 9001:2026 (coming in September) the lead auditor and internal auditor training will require the team needs of the audit team to build internal competency as an essential for both initial certification and ongoing audit survival. When for example evaluating QMII training tracks for staff, matching the course depth to internal roles ensures both compliance and resource efficiency.

Internal Auditor Training (2 to 3 Days):
- Target Audience: Quality managers, process owners, manufacturing engineers, and internal audit team members.
- Focus: Understanding AS9100 Rev D requirements, ISO 19011 auditing principles, preparing checklists, gathering evidence, and writing clear non-conformance reports.
- Objective: Conduct periodic internal audits to keep the QMS healthy and compliant.
Lead Auditor Training (4 to 5 Days):
- Target Audience: Quality Directors, Chief Auditors, lead consultants, or staff managing complex multi-site QMS programs.
- Focus: Deep mastery of standard intent, lead-auditor protocols, managing audit teams, lead-closing meetings, and assessing root-cause corrective actions (RCCA).
- Objective: Drive strategic management system improvement and interface effectively with third-party certification bodies and prime contractor oversight teams.

Certification must be maintained through supplier audits. Achieving your initial certificate is only the baseline; maintaining it requires continuous readiness. Prime contractors and certification bodies conduct recurring surveillance audits to ensure systems do not degrade over time.

Maintain Robust Root Cause Corrective Action (RCCA): Move beyond surface-level fixes. Utilize structured methodologies like 5-Why Analysis or Fishbone (Ishikawa) Diagrams to resolve internal and customer-reported issues permanently.
Monitor Key Performance Indicators (KPIs): Track metrics continuously across process effectiveness, product conformity, and on-time delivery.
Conduct Continuous Process Audits: Audit high-risk shop floor operations, special processes, and sub-tier supplier handling throughout the year, rather than rushing preparation right before the third-party surveillance audit.

—

About the Author:

ISO 9001 Certification: A Business Leader’s Roadmap

ISO 9001 certification is more than a certificate displayed on a wall. For business leaders, it represents an opportunity to build a disciplined management system that consistently delivers quality, satisfies customers, manages risks, and supports continuous improvement. Yet organizations sometimes approach ISO 9001 as a compliance exercise rather than as a continual improvement tool. The difference in approach can determine whether certification becomes a valuable strategic asset or simply another administrative burden.

For leaders considering ISO 9001 lead auditor certification, the journey should begin with understanding what the standard is designed to accomplish and how it can support organizational objectives.

Understanding ISO 9001

ISO 9001 is an internationally recognized standard for quality management systems (QMS). It provides a framework for organizations to establish processes that consistently meet customer requirements, applicable regulatory requirements, and the organization’s own objectives.

Importantly, ISO 9001 does not prescribe exactly how a business must operate. A manufacturing company, consulting firm, software provider, construction company, or service organization can all implement the standard. The organization determines the processes, controls, resources, and methods appropriate to its size, complexity, products, services, and risks.

For business leaders, this flexibility is important. Certification should not mean copying another organization’s procedures. The management system should reflect how the organization operates.

Step 1: Establish Leadership Commitment

Successful ISO 9001 implementation starts with the Top Management/ Leadership.

Senior leadership must understand why the organization wants certification and what business outcomes it expects. Possible objectives include improving customer satisfaction, reducing defects, standardizing processes, strengthening supplier management, improving operational efficiency, entering new markets, or satisfying customer requirements.

Leadership should communicate that quality is an organizational responsibility rather than the sole responsibility of a quality manager.

A strong leadership commitment includes providing appropriate resources, establishing quality objectives, assigning responsibilities, participating in management reviews, and ensuring that employees understand the importance of effective processes.

If employees believe ISO 9001 is simply “the quality department’s project,” implementation is likely to struggle.

Step 2: Define the Business Context and Scope

The organization should next determine the context in which it operates. Leaders need to consider internal and external issues that can affect the organization’s ability to achieve its intended quality outcomes. These may include market conditions, technology, competition, customer expectations, regulatory requirements, organizational capabilities, supply-chain issues, and changes in the business environment.

The organization must also determine the scope of its quality management system. The scope should clearly identify the products, services, locations, and organizational activities covered by the QMS. It should be realistic and accurately represent the organization’s operations. A clearly defined scope prevents confusion later in the certification process.

Step 3: Identify and Manage Risks and Opportunities

Modern quality management is not simply about detecting problems after they occur. ISO 9001 encourages organizations to think about risks and opportunities before problems affect customers or business performance.

Leaders should ask questions such as:

What could prevent us from meeting customer requirements?
Which processes are most critical to our success?
Where are errors most likely to occur?
Which suppliers create significant operational risk?
What opportunities could improve efficiency or customer satisfaction?
What changes could affect our ability to deliver consistent products or services?

Risk-based thinking should become part of everyday decision-making rather than a standalone exercise performed only for an audit.

Step 4: Map and Standardize Key Processes

A quality management system is fundamentally a system of processes. Organizations should identify their major processes and understand how they interact. Depending on the business, these may include sales, contract review, purchasing, design and development, production, service delivery, inspection, testing, customer support, human resources, maintenance, and supplier management.

Process mapping can reveal duplication, unclear responsibilities, bottlenecks, missing controls, and opportunities for improvement.

The goal is not to create excessive paperwork. The goal is to make important processes predictable and effective.

Step 5: Build Competence and Employee Awareness

Even the best designed QMS will fail if employees do not understand their responsibilities.

ISO 9001 places significant importance on competence and awareness. Organizations should determine the competencies required for people performing work that affects quality, provide appropriate training or other actions, and evaluate whether competence has been achieved.

Training should be practical.

Employees should understand not only what procedure they are expected to follow but also why it matters. For example, a purchasing employee should understand how supplier selection affects product quality, delivery performance, customer satisfaction, and organizational risk.

This creates ownership rather than simple procedural compliance.

Step 6: Establish Performance Measures

Business leaders cannot effectively manage what they do not measure.

Organizations should establish meaningful quality objectives and appropriate performance indicators. Depending on the organization, these might include customer complaints, on-time delivery, defect rates, rework, process efficiency, supplier performance, warranty claims, service response times, or customer satisfaction.

The key is to avoid measuring everything simply because data is available.

Good metrics help leaders answer important questions:

Are our processes working? Are customers satisfied? Are objectives being achieved? Where should management focus its attention?

Performance information should be reviewed regularly and used to make decisions.

Step 7: Implement Internal Audits

Internal audits are one of the most valuable tools in the ISO 9001 system.

An internal audit should not be treated as a rehearsal for the certification audit. Its purpose is to determine whether the QMS conforms to requirements and whether it is effectively implemented and maintained.

Effective auditors look beyond documentation. They follow processes, interview employees, examine records, observe activities, and evaluate objective evidence.

A strong internal audit program can identify weaknesses before they become customer complaints or external audit findings.

Leaders should encourage employees to view internal audits as improvement opportunities rather than investigations designed to assign blame.

Step 8: Use Corrective Action for Real Improvement

Problems will occur in every organization. ISO 9001 does not require perfection; it requires organizations to respond appropriately when nonconformities occur.

The critical question is whether the organization addresses the underlying cause.

For example, if an employee repeatedly completes a form incorrectly, simply retraining that employee may not solve the problem. The organization should investigate why the error occurred. Was the form confusing? Was the procedure unclear? Was the employee adequately trained? Was the process poorly designed? Was there insufficient supervision?

Effective corrective action addresses causes rather than symptoms.

Step 9: Conduct Management Review

Management review gives senior leaders an opportunity to evaluate whether the QMS remains suitable, adequate, effective, and aligned with organizational direction.

Management should review relevant performance information, audit results, customer feedback, process performance, nonconformities, corrective actions, risks and opportunities, supplier performance, and changes that could affect the QMS.

The output should be decisions and actions, not merely meeting minutes.

Leadership should use management review to determine where resources, priorities, or processes need to change.

Step 10: Prepare for the Certification Audit

Once the QMS has been implemented and has generated sufficient evidence of operation, the organization can engage an accredited certification body for the certification process. Certification generally involves an initial assessment conducted in stages. The certification auditors evaluate whether the management system meets ISO 9001 requirements and whether it is effectively implemented.

Organizations should not attempt to hide weaknesses from auditors. A mature QMS recognizes that problems are opportunities to improve. Preparation should include reviewing internal audit results, closing appropriate corrective actions, confirming employee awareness, ensuring required documented information is controlled, and verifying that processes are actually being followed.

The Business Leader’s Role After Certification

Certification is not the destination. One of the most common mistakes organizations make is treating certification as the end of the project. Once the certificate is issued, attention may decline and the QMS can gradually become disconnected from daily operations.

Business leaders should instead treat ISO 9001 as an ongoing management framework. The organization should continue monitoring performance, conducting internal audits, addressing customer feedback, managing risks, improving processes, reviewing objectives, and preparing for surveillance audits.

The real value of ISO 9001 becomes apparent when the QMS becomes part of how the organization is managed, not something maintained only because an auditor is coming.

Conclusion

ISO 9001 certification provides business leaders with a structured approach to improving quality, consistency, customer satisfaction, and organizational performance. However, the certificate itself is not the objective. The objective is to create a management system that helps the organization understand its processes, manage risks, make informed decisions, and continually improve.

The roadmap is straightforward: establish leadership commitment, understand the business context, identify risks and opportunities, manage processes, develop competent employees, measure performance, conduct effective internal audits, implement meaningful corrective actions, perform management reviews, and undergo certification with confidence.

When leadership treats ISO 9001 as a business management tool rather than a compliance exercise, certification can become much more than an external recognition of conformity. It can provide the foundation for a more disciplined, customer-focused, resilient, and continuously improving organization.

—

About the Author:

ISO 14001 vs ISO 9001: Can Your Organization Implement Both at the Same Time?

Organizations today face increasing pressure to deliver consistent quality while also managing their environmental responsibilities. Customers, regulators, investors, and other stakeholders increasingly expect organizations to demonstrate not only that their products and services meet requirements, but also that their operations minimize environmental impacts.

ISO 9001 focuses on quality management, customer satisfaction, and consistent processes, while ISO 14001 focuses on environmental management and the organization’s interaction with the environment. Although they have different purposes, the two standards share a significant amount of common management-system structure. As an add on, adding ISO 45001 will greatly add value to the organization with respect to Health and Safety along with Quality and Environmental Management Systems. As an option, an organization can also integrate ISO 9001 with ISO 27001 for integrated Cybersecurity management system. Perhaps, ISO 22301, for Business Continuity Management System. There are various ways why Integrated Management Systems works wonders for an organization. For a Maritime Company, organization can integrate ISO 9001 with ISM Code, or maybe add ISO 27001 to integrate and meet the objective of Maritime Cybersecurity. For the Aviation Industry, AS9100 or AS9110 can be integrated with ISO 9001.

Here’s a link to another article on the emphasis and benefits of having an integrated management system: https://www.qmii.com/integrated-management-systems-aka-a-balanced-lifestyle/

In this article, we will discuss the value behind implementing ISO 9001 with ISO 14001.

Understanding ISO 9001 and ISO 14001

ISO 9001 is the internationally recognized standard for Quality Management Systems (QMS). Its primary objective is to help organizations consistently provide products and services that meet customer and applicable statutory and regulatory requirements.

Key areas include:

Customer focus
Leadership
Planning
Risk and opportunity management
Competence and awareness
Operational control
Performance evaluation
Continual improvement
Corrective action

ISO 14001, on the other hand, specifies requirements for an Environmental Management System (EMS). It helps organizations manage their environmental responsibilities systematically and improve environmental performance.

Important areas include:

Environmental aspects and impacts
Compliance obligations
Environmental objectives
Operational controls
Emergency preparedness and response
Environmental monitoring
Risk and opportunity management
Continual improvement

The standards therefore address different organizational objectives, but they use many similar management principles.

Why Implement Both Standards?

One of the biggest advantages of implementing ISO 9001 and ISO 14001 together is that organizations do not necessarily need two separate management systems.

Many of the underlying processes can be shared. For example, an organization can establish one system for:

Document and record control
Internal audits
Management reviews
Corrective action
Employee competence
Training and awareness
Risk management
Supplier evaluation
Organizational context
Leadership responsibilities
Performance monitoring

The organization can then incorporate quality-specific and environmental-specific requirements into these common processes.

Instead of creating two independent systems, the organization can develop an Integrated Management System (IMS). A major reason ISO 9001 and ISO 14001 can work well together is their use of a common high-level structure.

Both standards address areas such as:

Context of the organization
Leadership
Planning
Support
Operation
Performance evaluation
Improvement

This common structure allows organizations to integrate requirements without unnecessarily duplicating procedures.

For example, an organization may conduct one internal audit covering both quality and environmental requirements. Similarly, one management review meeting can evaluate quality performance and environmental performance.

This approach can reduce duplication and make the management system easier for employees to understand.

What Should Remain Separate?

Although integration is beneficial, organizations should not assume that ISO 9001 and ISO 14001 are identical. Some requirements are specific to each discipline.

ISO 9001 places considerable emphasis on issues such as customer requirements, product and service conformity, customer satisfaction, design and development, and process performance; whereas, ISO 14001 places greater emphasis on environmental aspects and impacts, environmental compliance obligations, environmental objectives, life-cycle considerations, and environmental performance.

For example, a manufacturing organization may need to consider:

Quality perspective:

Are products manufactured according to specifications?
Are customer requirements being met?
Are defects being controlled?
Are processes producing consistent results?

Environmental perspective:

What emissions are generated?
How are wastes managed?
What resources and energy are consumed?
What environmental impacts are associated with operations?
What legal environmental requirements apply?

These requirements should remain clearly identifiable even when they are managed through common processes.

An Integrated Risk-Based Approach

Another advantage of combining the standards is the ability to consider quality and environmental risks together. Suppose an organization changes a production process to reduce manufacturing costs. From a quality perspective, the organization should consider whether the change could affect product conformity.

From an environmental perspective, it should consider whether the change could increase waste, energy consumption, emissions, or other environmental impacts. Considering both perspectives during planning can lead to better business decisions.

An integrated risk-management process can therefore help management understand the broader consequences of operational decisions.

Internal Auditing Can Also Be Integrated

Internal auditing is another area where organizations can achieve significant efficiencies.

Rather than conducting two separate audits for ISO 9001 and ISO 14001, an organization can develop an integrated audit program.

For example, an auditor reviewing a production process could examine:

Process controls
Product conformity
Customer requirements
Competence of personnel
Equipment and infrastructure
Waste management
Chemical handling
Energy consumption
Environmental controls
Emergency preparedness
Applicable compliance obligations

This provides a more complete picture of process performance. However, auditors must still understand the specific requirements of each standard. An integrated audit should not become a superficial checklist exercise.

Management Review Can Cover Both Systems

Management review is another area where integration provides significant value. Instead of holding separate meetings, top management can review quality and environmental performance during the same management review process.

The agenda might include:

Customer feedback
Quality objectives
Environmental objectives
Nonconformities
Corrective actions
Audit results
Process performance
Environmental performance
Compliance status
Risks and opportunities
Resource requirements
Improvement opportunities

This gives leadership a broader understanding of organizational performance.

What Are the Challenges?

Implementing both standards simultaneously is not without challenges.

The first challenge is Scope. The organization must clearly define which activities, locations, products, services, and processes are included.

The second challenge is Competence. Personnel responsible for quality management may not automatically understand environmental requirements, and environmental personnel may not have sufficient knowledge of quality-management principles. Training is therefore important. Click here to view some of the training services that QMII provides including ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22301 and many others: https://www.qmii.com/training-services-qmii/

Another challenge is avoiding unnecessary documentation. Organizations sometimes respond to two standards by creating excessive procedures, forms, and records. Integration should achieve the opposite: a streamlined system that provides effective control without unnecessary bureaucracy.

Leadership commitment is also essential. ISO 9001 and ISO 14001 should not be treated as separate certification projects owned by different departments. They should support the organization’s overall strategic direction to meet its measurable objectives and scope.

Should You Implement Them Simultaneously?

For organizations that are starting from scratch, implementing both standards simultaneously can make considerable sense when quality and environmental management are both strategically important. However, the organization should consider its resources, size, complexity, regulatory environment, and existing management-system maturity. A practical implementation approach could be:

Step 1: Define the organizational context and scope

Identify internal and external issues, interested parties, organizational processes, and the boundaries of the management system.

Step 2: Identify common processes

Determine which processes can support both ISO 9001 and ISO 14001 requirements.

Step 3: Identify standard-specific requirements

Clearly identify quality-specific and environmental-specific requirements that need dedicated controls.

Step 4: Establish integrated objectives

Develop measurable quality and environmental objectives that support business strategy.

Step 5: Train employees

Ensure employees understand both the quality and environmental responsibilities relevant to their work.

Step 6: Implement operational controls

Integrate quality and environmental considerations into everyday processes rather than treating them as separate administrative activities.

Step 7: Conduct integrated internal audits

Evaluate both standards systematically while ensuring that each requirement is adequately addressed.

Step 8: Conduct management review

Use management review to evaluate the effectiveness and performance of the integrated system.

Step 9: Prepare for certification

If certification is required, the organization can work with a certification body to determine the appropriate audit and certification arrangements.

The Bigger Picture

The real value of implementing ISO 9001 and ISO 14001 together is not simply obtaining two certificates. The objective should be to create a management system that helps the organization produce consistent results while controlling environmental impacts and improving overall performance.

Quality and environmental performance are often interconnected. Poor process control can generate defects, rework, waste, and additional resource consumption. Better process control can therefore improve both quality and environmental performance.

An integrated management system can help organizations recognize these connections.

Conclusion

The two standards have different purposes, but their common management-system structure makes integration practical. Organizations can combine processes such as internal auditing, management review, corrective action, competence, document control, risk management, and continual improvement while maintaining separate controls for quality-specific and environmental-specific requirements.

The key is to avoid treating the standards as two independent compliance exercises.

Instead, organizations should build one coherent management system that supports quality, environmental performance, regulatory compliance, customer satisfaction, risk management, and continual improvement.

When implemented effectively, ISO 9001 and ISO 14001 can complement rather than compete—helping an organization become not only more consistent and customer-focused, but also more environmentally responsible and sustainable.

If you have any questions, contact QMII and our panel of expertise and solution providers can help you and guide you with your requirement of an integrated management system.

Email – [email protected]
Phone no – 888-357-9001
Website – www.qmii.com

—

About the Author

What to Expect from an ISO 9001 Consultant: A Plain-English Buyer’s Guide

Hiring an ISO 9001 consultant should not be treated as purchasing a collection of procedures or hiring someone to just get the certificate. A capable consultant should help your organization develop a management system that improves how work is controlled, how risks are managed, how customers are served, and how leadership makes decisions. It is of course a generic compilation of thoughts to assist all organizations who work with consultants to refine, retune and improve their management systems. With the ISO 9001 almost on the eve of being updated in September 2026, this is a pertinent question: how to select consultants. QMII has forty plus years of experience. I have been in the lead role at QMII for two decades now and share some of my thoughts to enable managements make good decisions on this.

The certificate matters, but it should be the result of an effective management system and not the sole purpose of the engagement.

Organization’s As-Is System.

QMII has worked with organizations and management systems for four decades. During that time, we have learned that successful consulting is not about imposing a generic ISO template. It is about understanding how an organization operates, identifying what already works, strengthening what does not, and helping its people develop a system they can use and improve long after the consultant has left. I think beginning with the “as-is” of the system is the best start. Basing a system design on a template or a fictional system is never a good idea.

For organizations considering ISO 9001 lead auditor certification or trying to obtain more value from an existing system, this guide explains what a competent consultant should provide, what the client should contribute, and what warning signs to watch for.

Build on What Already Exists

The consultant should begin by understanding the organization. Please don’t throw the baby with the bath water. Start with the “as-is” of the system. A good consultant does not arrive with a finished quality manual and begin changing the company to fit it. The consultant first learns how the organization works. This includes understanding, what the organization provides (products and services), who its customers and other relevant interested parties (ISO 9001 clause 4.1 and 4.2) are. Then look at how customer requirements are determined and fulfilled and connect these to which processes create value (ISO 9001 clause 4.4). A good consultant should systematically look at what can prevent those processes from achieving their intended results (ISO 9001 risks clause 6.1 and maintaining customer focus clause 5.1.2). No consultant can forget which regulatory, statutory, contractual, and industry requirements apply to the organization and its deliverables. Study how performance is currently measured and what leadership wants the management system to accomplish (policy 5.2 flowing to measurable objectives 6.2 considering the risks 6.1 to doing the work 8.5 and releasing the product and or service 8.6).

Use the Process Approach

This approach reflects ISO 9001 Clauses 4.1 and 4.2, which require an organization to understand its context and the needs and expectations of relevant interested parties. Clause 4.4 then requires the organization to determine and manage the processes needed for its quality management system.

These requirements cannot be addressed properly with a generic questionnaire alone. The consultant must talk with leadership, process owners, supervisors, and employees. They should observe work where it occurs and then follows the flow of actual orders, information, materials, decisions, and records. At QMII, we regard this discovery process as essential. Four decades of experience have reinforced a simple lesson, before recommending a solution, we must understand the client’s organization, its culture, its risks, and its intended results.

Emphasize the “as-is” of the system as a consultant. It is more and committed work as a consultant to start with what they already do as compared to a template. The consultant should be willing to build on what the organization already Has. Most established organizations already have a management system, whether they call it one or not. I often use a practical rule of thumb: if an organization has operated successfully for eighteen months, much of its management system, perhaps 85 percent is already present, even if it has not been formally defined in ISO language.

After all they receive customer inquiries, review contracts, purchase materials, train employees, produce goods or deliver services, inspect work, resolve problems, and monitor financial and operational performance. These activities may not be organized around ISO terminology, but the underlying processes already exist.

A capable consultant identifies and builds upon these existing practices. The objective is not to replace sound business methods with ISO methods. The objective is to ensure that the organization’s processes are adequately defined, controlled, measured, and improved. This may require, clarifying responsibilities and authorities, improving the interaction between departments as also establishing missing controls, simplifying duplicated or ineffective controls and identifying meaningful performance measures. There may be a need to strengthening corrective action, addressing risks before failures occur and lead risks as input to create OFI (opportunities for improvement) and finally retaining documented information where it adds value or provides necessary evidence. The system from a reactive where NC (non-conformity) drives correction and corrective action must be changed to a proactive system where data drives risk and trends. The consultant should help the organization close genuine gaps without creating unnecessary bureaucracy.

ISO 9001 does not require a procedure for every activity. It requires the organization to maintain and retain documented information to the extent necessary to support process operation and provide confidence that work is being performed as planned (clause 4.4 of ISO 9001). An experienced consultant understands this distinction.

The consultant should use a process-based methodology. ISO 9001 is based on the process approach. Consequently, the consultant’s methodology should also be process based. A process is more than a department or a procedure. It is a set of related activities that converts inputs into intended outputs. Each process should have a purpose, responsible ownership, appropriate resources, operating controls, performance criteria, and methods for addressing risk and improvement. For example, sales should not be examined only as an organizational department. The consultant should consider the full customer-related process which should include how are customer needs identified, how are quotations prepared, how are requirements reviewed before commitments are made and how are changes communicated? Then there should be clarity on how are operational departments informed, how is customer feedback is obtained and how does the organization determine whether the process is effective?

This thinking connects several ISO 9001 requirements instead of treating each clause separately. It can link the process requirements of Clause 4.4 with operational planning under Clause 8.1, the review of customer requirements under Clause 8.2, performance evaluation under Clause 9.1, and improvement under Clause 10.

QMII’s methodology has been developed and refined through four decades of consulting, training, auditing, and practical management-system experience. Our consultants look beyond individual clauses to understand how processes interact and whether the system is achieving its intended results.

Engage Leadership

Then in selecting consultants consider how the consultant will engage the leadership. ISO 9001 cannot be implemented successfully as a quality department project. Clause 5.1 places clear responsibility on top management for the effectiveness of the quality management system. Leadership is expected to establish direction, integrate quality requirements into business processes, provide resources, promote the process approach and risk-based thinking, and support continual improvement.

A competent consultant should therefore work directly with senior leadership. This does not mean occupying executives with the wording of every procedure. It means helping them understand and fulfill their responsibilities. The consultant should help leadership answer practical questions such as what results do we expect from this management system, what quality objectives support the organization’s business strategy, which risks could prevent us from fulfilling customer requirements and do the process owners have sufficient authority and resources? Without information leading to risks and trends the top management (TM) cannot make objective decisions. The consultant should bring to their understanding if the organization is receiving useful performance information, are management reviews resulting in decisions and action and is the system helping improvement or merely preparing us for audits?

The consultant should also be willing to challenge leadership respectfully. If managers want ISO 9001 certification but are unwilling to provide time, resources, accountability, or visible support, the consultant should explain the consequences honestly. Commitment cannot be delegated to the consultant.

Transfer Knowledge and Build Independence

Another important duty of the consultant is to transfer knowledge (ISO 9001 clause 7.1.6). A consultant’s responsibility to transfer knowledge also supports the intent of ISO 9001 Clause 7.1.6 concerning organizational knowledge. One of the most important tests of a consulting engagement is what happens after the consultant leaves. The organization should understand and own its management system. Employees should know how their work contributes to quality. Process owners should be able to monitor and improve their processes. Internal auditors should be capable of evaluating effectiveness, and leadership should be able to use management review as a genuine decision-making process.

The consultant should therefore act as an adviser, facilitator, coach, and educator and not as the permanent owner of the system. Consultants who intentionally make clients dependent on continuing support are not serving the client’s long-term interests. Prospective clients should therefore examine how the consultant intends to transfer knowledge and build internal capability. That is unethical and organizations should therefore be wise in selecting consultants. Knowledge transfer may include awareness sessions for employees (often called familiarization and or orientation), leadership briefings, process-owner workshops, risk-based thinking exercises, internal auditor training, corrective-action and root-cause training, guidance for management review and perhaps coaching during implementation and readiness activities. Training should be relevant to the participant’s role. Senior leaders, internal auditors, process owners, and frontline employees do not all need the same level or type of instruction.

QMII is both a consulting, auditing and a training organization. This enables us to combine subject-matter expertise with a strong emphasis on developing the client’s internal capability. Our measure of success is not client dependence; it is the client’s ability to sustain and improve the system.

Prepare for Certification, Without Becoming the Auditor

The consultant should prepare the organization for certification without becoming the auditor. A consultant may help an organization prepare for certification, but the consultant should not promise or guarantee certification. Certification decisions belong to an independent, accredited certification body. The consultant should explain the certification process, help the organization select a suitable certification body, and prepare the organization for the Stage 1 and Stage 2 audits. However, the certification body must remain independent of the consulting work. Before the certification audit, the consultant should help confirm that the quality management system has been implemented, processes are operating under planned conditions and required documented information is available. Then there is the need for employees to understand their responsibilities, for quality objectives being monitored, internal audits should have been completed, and management review has taken place. Then there are the NCs (Nonconformities) which should have been corrected. Basically, that there is evidence that the system is producing results.

A readiness review should not be a rehearsal in which employees memorize answers. It should determine whether the system is genuinely ready to be evaluated. The best preparation for an external audit is an effective system used routinely, not a last-minute cleanup exercise. The consultant should focus on results, not just documents. This results-oriented emphasis is also consistent with ISO 19011:2026, published in May 2026, which places increased attention on risk, technology, digitization, and evolving audit practices. ISO 9001:2026 which should be available in September 2026 also emphasizes this.

Focus on Results, Not Documents

Remember that a management system may be fully documented and still fail to deliver. A skilled consultant looks beyond whether a procedure exists. The more important questions are is the process achieving its intended result, are customer requirements consistently fulfilled, are errors and delays decreasing, are employees competent to perform their work and are risks being addressed? This should be followed by addressing if recurring problems are being eliminated, are decisions based on reliable evidence, is customer satisfaction improving and is the organization learning from experience?

This results-based approach is consistent with ISO 9001 Clause 9.1, which requires organizations to determine what should be monitored and measured, and Clause 10, which focuses on nonconformity, corrective action, and continual improvement. The consultant selected should help establish measures that support decisions, not measurements collected only because they look impressive on a dashboard.

Match the Consultants to the Industry

Further the consultant should tailor the system to your industry. This is true for ISO 9001 and particularly true for industry specific standards. ISO 9001 can be applied across many industries, but implementation should never ignore industry context. An aerospace supplier, maritime organization, engineering company, training provider, nuclear supply-chain organization, and general manufacturer may all use ISO 9001, but their risks, contractual requirements, operational controls, and stakeholder expectations will differ substantially. Therefore, ask prospective consultants whether they understand the industry and operating environment, the applicable legal and regulatory requirements, customer-specific requirements, the industry terminology, product or service risks and the relevant sector-specific standards. This all affects the practical realities faced by the employees. The system is for the employees and not for auditors.

QMII’s subject-matter expertise extends beyond the text of ISO 9001. Our experience includes maritime safety and the ISM Code, aerospace standards such as AS9100 and IA9100, nuclear quality assurance, environmental and occupational health and safety management systems, supply-chain security, and auditor development. This breadth allows us to recognize where ISO 9001 must operate as part of a larger business and regulatory framework.

Warning Signs When Selecting a Consultant

The organization should consciously include study of promises of guaranteed certification, offers of a complete generic documentation package before understanding the organization, when consultants focus almost entirely on procedures and forms and treats ISO 9001 as the responsibility of the quality manager. Further when the consultant cannot explain requirements in plain English, has little relevant industry or auditing experience, discourages direct contact with employees or leadership, creates unnecessary documentation and or prepares people to say the right things to an auditor and specially makes the organization dependent on continued consulting support. Another warning sign is when the consultant shows little interest in business performance or customer satisfaction.

Questions to Ask Before Signing

A consultant’s credentials matter, but so do judgment, communication skills, integrity, practical experience, and the ability to gain the confidence of people at every level of the organization. Therefore, consider the questions to ask before signing a consulting agreement:

How will you learn about our organization and its processes?
What experience do you have in our industry?
Who will perform the consulting work?
What will you expect from our leadership team?
How will you avoid unnecessary documentation?
How will you help our employees understand and own the system?
What training is included?
How will progress and effectiveness be measured?
How will you prepare us for internal and certification audits?
What support will be available after certification?
Can you provide relevant references or examples?
How will the completed system support our business objectives?

The proposal should clearly define scope, responsibilities, deliverables, estimated timing, training, expenses, and assumptions. The least expensive proposal may not provide the best value, particularly if it results in a burdensome system that later must be redesigned. Remember the summary of ISO 9001 clause 8.4.1 on selecting vendors. Selecting a consultant solely on the lowest price can be costly if the resulting system is bureaucratic, ineffective, or must later be redesigned.

What QMII Brings to the Engagement

From QMII experience of 40 years and with satisfied clients I can say consultants should bring to the engagement value. For forty years, QMII has helped organizations understand, implement, audit, and improve management systems. That history has enabled us to perfect a practical methodology grounded in the process approach, systems thinking, risk-based thinking, and continual improvement. Amongst many qualities, I would say good consultants should at least bring these three qualities to every engagement.

First, bring subject-matter expertise. Consultants and instructors understand both management-system requirements and the operational environments in which those requirements must be applied. Second, the consultant must bring a proven methodology. For this begin by understanding the organization, map and evaluate its processes, identify meaningful gaps, work with its people to develop appropriate controls, and transfer the knowledge needed to sustain the system. Third, bring commitment to the client’s success. Do not measure success merely by the award of a certificate. Good consultants like QMII want the client to have a management system that employees understand, leadership uses, customers trust, and the organization continually improves.

The Final Test of a Successful Engagement

The final test of a successful ISO 9001 consulting engagement should leave an organization with more than a certificate and a set of documents. It should leave the organization with better-understood processes, clearer responsibilities, more engaged leadership, stronger control of operational risks, more capable employees and internal auditors, better information for decision-making, a more effective corrective action, greater confidence in meeting customer requirements and a s sustainable foundation for continual improvement. The real question is not simply, “Did we achieve ISO 9001 certification?” The better question is, “Has our management system made us a more capable, consistent, and successful organization?”

That is what a client should expect from an ISO 9001 consultant—and it is the standard to which QMII has committed itself for four decades.

—

About the Author:

ISO 9001 Gap Analysis: How to Do It Before Your First Certification Audit

What Is a Gap Analysis and Why It Matters Before Certification

When first looking to conform to ISO 9001, seeking certification or perhaps looking to upgrade your system to a new revision of the standard an ISO 9001 gap analysis comes up in conversations. This article outlines what a gap analysis is, what goes into it and why it matters.

Defined plainly, it is a structured comparison of your current Management System (MS) against ISO 9001 requirements, clause by clause. Think of it as a practice exam before the main exam that gives you insights into where your weaknesses are so you can improve on them. It is not a full audit of your system. More a diagnostic check. In a gap analysis no nonconformities are “issued,” just gaps identified.

Not knowing where your weaknesses in the management system lie can impact your operations by letting risks go unnoticed and unaddressed. Further it may result in certification delays especially if any non-conformities identified are major. In a few cases the major non-conformities may require a secondary onsite visit, that is an additional cost. If your business contracts and contingent upon certification being achieved, then an ISO 9001 gap analysis helps. It doesn’t guarantee a clean audit, but it de-risks it significantly.

It is a small cost to incur to avoid a failed external audit and certification delay. Other intangible costs are also incurred such as a hit to team morale and loss of faith in the system approach.

The 10-Clause Framework: Walking Through ISO 9001 Section by Section

With the harmonization to a uniform structure ISO 9001 and its 10 clauses are not aligned to the Plan-Do-Check-Act cycle. This allows for easier implementation and integration with other management systems. As a note, clauses 1-3 (scope, normative references, terms) are non-auditable but set context for the standard and its why.

Perhaps the best approach to the gap analysis is to use the clause structure of the standard as a starting point. The challenge often lies in assessing processes and connecting internal requirements to the language of ISO. Clauses 4 through 10 are the real “meat” of the standard.

Clause 4 — Context of the organization – Evidence for this clause is often found with the leadership and requires their involvement and engagement.
Clause 5 — Leadership – The clauses under 5 require leadership awareness of what the system needs from them as also the assignment of a clear vision via the policy and clear responsibilities and authorities.
Clause 6 — Planning – This clause requires the organization to assess the risks to meeting its goals (including customer satisfaction and continual improvement) and identify controls that will enable mitigation of these risks.
Clause 7 — Support (resources, competence, documented info) – While perhaps the easiest clause of the standard, documentation control is often the biggest weakness in systems and in audits.
Clause 8 — Operation – Clause 8 is the “meat” of any organizations operations and will perhaps take the longest time during the gap analysis.
Clause 9 — Performance evaluation – Here is where the organizations determine what they are going to monitor and how they monitor it.
Clause 10 — Improvement – Check whether your system has avenues for identifying and acting on improvement opportunities including identifying and taking action on non-conformities.

A simple was to look at each requirement is to ask, “What does this clause require? Do we have evidence? Is it followed consistently?”. If you struggle to identify a suitable checklist for the gap you can simply use the clause structure as a gap analysis checklist itself. Reach out to [email protected] should you want a checklist you can use.

Context of the organization: what most SMBs overlook in clause 4

SMBs often treat 4.1 (internal/external issues) as a one-time exercise, and not a living document. For micro business with only a few employees there may be no need to document the context. I say no need as the ISO 9001 standard does not require the context to be documented. It is best practice though as the company grows in locations, personnel and/or operations. Contextual issues are really business 101. An organization must determine what is going to impact them and what actions they should be planning to mitigate any negative impact while building on the positive ones. Penning them down helps keep track of them and review them later.

While leadership may know who the interested parties are what their needs are often internal parties get overlooked such as employees, and certain external parties such as suppliers and insurers. Interested parties are often thought of as customers and perhaps rightly so as they are probably the largest for a business. When reviewing the scope statement make sure it covers what you are seeking to get certified. While generally the limit of the actual site/process boundaries is common don’t use it as a means to exclude areas/processes that must be included.

Clause 4.4 is often a weakness in systems QMII has worked on. The clause requires the organization to determine the sequence and interaction of the processes. SMBs often have documented procedures but no process interaction map. QMII often captures this as a core process for its clients.

Pro tip: tie context review to a real business planning input (e.g., strategic planning meeting) so it doesn’t feel like a paperwork exercise

How to Score Your Gaps: A Simple Red/Amber/Green Method

A simple was to score your gap analysis is using the RAG logic:

Red = requirement not met at all, no evidence
Amber = partially met, inconsistent, or undocumented but practiced
Green = fully met with objective evidence

While it is easy to score the entire clause, QMII recommends scoring each requirement at the sub-clause level, for accuracy. In addition to the requirement in one column, additional columns may include current state evidence, RAG, actions needed to conform, action owner and target date.

Remember it is a system and you are identifying risks. As such even though an area/requirement may be conforming and green your ISO 9001 gap analysis should identify process risks such as when reliant on one person or no document exists, only tribal knowledge. This gives the leadership visibility on the risk and they can make a decision to accept it or not.

Pro Tip on prioritization: fix all Reds first, especially in clauses tied to product/service conformity (clause 8) since those tend to trigger major NCs

Common Gaps Found in US Manufacturing Plants (and How to Close Them Fast)

Below is a list of common gaps found across systems that QMII has helped implement and get through first time certification:

Calibration records incomplete or gauges past due date – Create/update the calibration log and set up a recall/alert system for upcoming due dates.
Supplier evaluation not risk-based (approved vendor list exists but no criteria/re-evaluation cycle) – For each supplier determine the evaluation, selection and re-evaluation criteria. Apply them to existing suppliers.
Nonconformance and corrective action process exists but isn’t tied back to root cause analysis (people fix symptoms, not causes) – preferably get a few personnel training in problem solving/root cause analysis (RCA) and these will then champion this RCA process.
Training records not linked to competency requirements for specific roles – Determine the competency requirements for each role, determine the records needed to prove competency is met, identify where and who will retain the records.
Management review meetings happen but don’t cover all required inputs/outputs from clause 9.3 – Review the existing review template against the requirements of Clause 9.3. In addition to the inputs remember to document the decision and actions of leadership.
Document control: multiple “current” versions floating on shop floor vs. controlled system – Ask personnel to identify all out-of-date documents either on the desktop or in print and to control them. The primary repository whether in print or electronic should be used each time a document is needed.
No core process mapped – map the sequence and interaction of processes.

Each of these while easily fixed are often looked over when a gap analysis is done by someone with little experience of the standard.

Clause 8 operations: where most manufacturers find the most gaps

Below is a list of common items identified during ISO 9001 gap analysis done by QMII:

Design and development controls (8.3) often skipped by manufacturers who think they don’t “design” anything, but engineering changes count
Control of externally provided processes/products (8.4) inadequate
Production and service provision (8.5), where work instructions as documented do not relfect actual practice
Control of nonconforming outputs (8.7), disposition process (use-as-is, rework, scrap) not always documented with authority sign-off and often missing a designated area for storage

Pro Tip: walk the actual production floor with the clause 8 checklist in hand rather than reviewing documents at a desk — gaps surface fastest this way

Gap Analysis vs Internal Audit: What’s the Difference and When to Use Each

Below is a handy reference on the difference between an ISO 9001 gap analysis and an internal audit.

Gap analysis = readiness check, usually done once before initial certification or major transition
Internal audit = ongoing, cyclical, required by clause 9.2 as part of maintaining certification. While the standard does not specify a frequency, mature organization do internal audits at least twice a year and sometimes more often.
Gap analysis can be broad-brush; internal audits require formal audit plans, trained iso 9001 lead auditor, and documented findings/CAPAs
Use gap analysis when: preparing for first certification, after a major QMS overhaul, after failed audit findings elsewhere or a major customer quality issue.
Use internal audit when: maintaining ongoing compliance, meeting the annual audit program requirement, preparing for surveillance audits

Key point: A gap analysis finding should feed into your first internal audit program, not replace it.

How to build a gap closure action plan with owners and deadlines

While the gap analysis is a good starting point failing to take actions timely can leave you too close to the project deadline with important issues unaddressed. Keep in mind that while the ISO project is important, the show must go on. As such personnel in an organization are being pulled in all directions to meet operational needs of getting the products and/or service out the door.

It is therefore imperative to get leadership involvement from the start of the project. For other personnel in the organization to know how important this is to leadership. To agree to deadlines mutually and identify verification methods to know actions items have been closed out effectively. Assign realistic deadlines based on complexity of the issue identified. For example, process redesign may take longer than a documentation fix.

For good measure the verifier must be someone other than the person who “fixed” it should confirm closure. Tie closure plan directly to the certification body’s audit date so there’s a hard deadline forcing prioritization.

Pro Tip: Recommend a weekly stand-up or tracker review cadence leading up to the audit date

FAQs

How long does a gap analysis take?

Typically, 2 days for a single-site SMB, depending on number of processes and whether it’s desk review only or includes floor walks. Larger or multi-site operations can take 1 week or more depending on the size of the sample chosen for the gap.

Who should conduct a gap analysis — internal team or external consultant?

Internal team: cheaper, deeper operational knowledge, but risk of blind spots/bias toward “we already do this”
External consultant: objective, benchmarked against many other clients, but costs money and takes time to onboard to your processes
Hybrid approach often works best: consultant-led framework, internal team fills in evidence

Can a gap analysis replace an internal audit?

No. A gap analysis is a one-time readiness check; internal audit is a mandatory recurring clause 9.2 requirement. Certification bodies will ask for internal audit records, not gap analysis reports, as objective evidence

What does a gap analysis report look like?

Typically, a spreadsheet or short report that includes clause-by-clause RAG score (or another methodology), evidence notes, gap descriptions, recommended actions, and an overall readiness percentage. Some consultants supplement it with an executive summary for leadership

How close do you need to be before scheduling a certification audit?

Rule of thumb: all Red-rated items closed, Amber items with an active action plan and target dates, before booking Stage 1.

—

About the Author:

Julius DeSilva is CEO of QMII (Quality Management International, Inc.), with more than 25 years of experience in quality management systems, maritime safety and security, and information security. A former seagoing officer and Exemplar Global Certified Lead Auditor (ISO 9001, ISO 27001, ISO 50001, RC14001), he has trained over 1,500 professionals as lead auditors and led consulting and auditing engagements across manufacturing, government, maritime, and aerospace sectors. He holds an MBA from the Darden School of Business, University of Virginia, and is an Associate Fellow of the Nautical Institute.

Understanding Nonconformance Reports (NCRs) in ISO Audits: What to Do When You Get One

A Nonconformance Report (NCR) is one of the most important outcomes of an ISO audit. While many organizations initially view an NCR as a sign of failure, it is a valuable management tool that identifies opportunities for improvement. Whether an organization is certified to ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22000, or another ISO management system standard, receiving an NCR is a normal part of the auditing process. The true measure of an organization’s management system is not whether it receives nonconformities, but how effectively it responds to them, and the corrective action and root cause analysis that follows. Understanding what an NCR means and knowing how to address it systematically can help organizations strengthen their management systems, reduce risks, improve compliance, and enhance overall business performance.

What Is a Nonconformance Report?

A Nonconformance Report is a formal record issued by an auditor when objective evidence demonstrates that an organization’s management system does not meet one or more requirements of the applicable ISO standard, its own documented procedures, or relevant legal and regulatory obligations.

An NCR is always based on objective evidence rather than opinion. Auditors collect evidence through interviews, observation of activities, examination of documents, and review of records.

If the evidence shows that a requirement has not been fulfilled, the auditor documents the finding in an NCR. The purpose of an NCR is not to assign blame or criticize employees. Instead, it highlights gaps that need to be corrected so that the management system remains effective and continues to improve.

Types of Nonconformities:

Although certification bodies may use slightly different terminology, nonconformities generally fall into two categories.

Major Nonconformity

A major nonconformity indicates a significant failure of the management system. It may involve:

Complete absence of a required process.
Failure to comply with a key ISO requirement.
Repeated occurrence of the same issue.
A situation that creates serious risk to product quality, environmental protection, occupational health and safety, or information security.
Failure to implement corrective actions from previous audits.

Major nonconformities often require prompt corrective action and may affect certification if not resolved within the specified timeframe.

Minor Nonconformity

A minor nonconformity represents an isolated lapse or limited breakdown in the management system that does not seriously compromise its overall effectiveness.

Examples include:

An incomplete training record.
Missing signatures on inspection forms.
An outdated document remaining in circulation.
A calibration label missing from one piece of equipment.

Minor nonconformities are more common and usually indicate areas requiring better process control rather than system failure.

Common Reasons Organizations Receive NCRs

Many NCRs arise from recurring management system weaknesses rather than complex technical issues. Common causes include:

Poor document control.
Inadequate employee training.
Failure to follow established procedures.
Missing or incomplete records.
Ineffective internal audits.
Lack of management review.
Failure to identify and evaluate risks.
Inadequate corrective action implementation.
Poor supplier monitoring.
Non-compliance with legal or regulatory requirements.

Most NCRs result from inconsistent implementation rather than poorly written procedures.

How Should an Organization Respond?

Receiving an NCR should trigger a structured corrective action process rather than a rushed attempt to “fix the paperwork.” ISO standards emphasize addressing both the immediate problem and its underlying cause.

Step 1: Read the NCR Carefully

The first step is to fully understand what the auditor has identified.

Review:

The requirement that was not met.
The objective evidence recorded.
The process involved.
The scope of the nonconformity.

If any wording is unclear, seek clarification from the auditor before the audit closes.

Step 2: Correct the Immediate Problem

Immediate correction addresses the specific issue identified during the audit.

Examples include:

Updating an incomplete record.
Calibrating overdue equipment.
Providing missing employee training.
Replacing obsolete documents.
Completing required inspections.

These actions eliminate the immediate nonconformity but do not necessarily prevent recurrence.

Step 3: Conduct Root Cause Analysis

Corrective action should always focus on why the nonconformity occurred.

Effective root cause analysis tools include:

The 5 Whys.
Fishbone (Ishikawa) Diagram.
Process Mapping.
Pareto Analysis.

For example:

Problem: Employee training records were incomplete.

Why? Training was conducted but not documented.

Why? Supervisors were unaware documentation was required.

Why? The training procedure did not clearly assign responsibility.

Root Cause: The documented process lacked defined accountability for maintaining training records.

Without identifying the true root cause, organizations often experience repeat NCRs.

Step 4: Develop Corrective Actions

Corrective actions should eliminate the root cause rather than simply correcting the symptom.

Examples include:

Revising procedures.
Assigning process ownership.
Improving employee training.
Introducing automated reminders.
Updating document control systems.
Strengthening internal audits.
Improving management oversight.

Corrective actions should include:

Responsibilities.
Deadlines.
Required resources.
Expected outcomes.

Step 5: Verify Effectiveness

ISO standards require organizations to determine whether corrective actions actually worked.

Verification may include:

Follow-up audits.
Review of performance indicators.
Process monitoring.
Interviews with personnel.
Examination of updated records.

If the same issue occurs again, the corrective action was not fully effective and further investigation is needed.

What Auditors Expect to See

During follow-up or surveillance audits, auditors typically review whether the organization:

Understood the nonconformity.
Identified the real root cause.
Implemented appropriate corrective actions.
Updated documented information where necessary.
Trained affected employees.
Verified effectiveness.
Prevented recurrence.

Auditors are generally more interested in the quality of the organization’s corrective action process than in the existence of the original nonconformity.

Mistakes to Avoid

Organizations sometimes weaken their corrective action process by making common mistakes, including:

Treating symptoms instead of root causes.
Blaming individual employees without examining system failures.
Closing NCRs before verifying effectiveness.
Implementing corrective actions without updating procedures.
Failing to communicate changes across departments.
Delaying corrective actions until the next audit.

These mistakes increase the likelihood of recurring findings and may lead to more serious nonconformities in future audits.

Preventing Future NCRs

The most successful organizations treat every NCR as an opportunity to improve their management systems. Preventive measures include:

Conducting thorough internal audits.
Reviewing risks regularly.
Monitoring process performance through key performance indicators (KPIs).
Keeping documentation current.
Providing ongoing employee competence and awareness training.
Performing effective management reviews.
Encouraging employees to report problems before audits.
Reviewing trends in previous NCRs to identify recurring weaknesses.

A culture of continual improvement helps organizations identify and resolve issues before external auditors discover them.

The Role of Leadership

Top management plays a critical role in responding to NCRs. Leaders should provide adequate resources, encourage open communication, avoid creating a blame culture, and ensure that corrective actions receive appropriate attention. When leadership demonstrates commitment to continual improvement, employees are more likely to engage positively in resolving nonconformities and strengthening the management system.

Conclusion

Receiving a Nonconformance Report during an ISO audit should not be viewed as a setback but as an opportunity to enhance organizational performance. NCRs provide objective evidence of areas where the management system can be strengthened, helping organizations improve compliance, reduce operational risks, and increase customer confidence.

The most effective response involves understanding the finding, correcting the immediate issue, identifying the root cause, implementing meaningful corrective actions, and verifying their effectiveness. Organizations that embrace NCRs as part of a continual improvement process often emerge with stronger, more resilient management systems and greater readiness for future audits. Rather than aiming for an audit with no findings, organizations should strive for a culture that learns from every NCR and uses it to drive sustainable improvement.

—

About the Author: