ISO 9001: what the standard requires, and what follows for tooling

The four places where it gets concrete

Clause 9.2 — internal audit. What is required is an audit programme covering frequency, methods, responsibilities and reporting, established on a risk basis. What is not required is auditing every process annually — what is required is a traceable rationale for the selection. That rationale is almost always missing from spreadsheet solutions, because they record the result rather than the reasoning.

Clause 9.3 — management review. Audit results are a mandatory input. If the state of corrective actions can only be answered by manual collation, the requirement is met formally but at high cost and without reliability.

Clause 10.2 — nonconformity and corrective action. The standard explicitly separates the correction, which removes the symptom, from the corrective action, which addresses the cause. It additionally requires the effectiveness to be reviewed. In practice that is the most frequently skipped step.

Clause 7.5 — documented information. Evidence must be identifiable, retrievable and protected against unintended alteration. A file on a network share rarely satisfies all three.

What follows for tooling

Those four points imply four capabilities: a programme level carrying a documented risk rationale, a durable link between finding and clause, the effectiveness check as its own step rather than a checkbox, and a complete change history.

How qportal covers them is described on the audit management and action management pages.

Boundaries

ISO 9001 sets the requirements for the quality management system. How an audit is conducted is described by ISO 19011 as guidance — see the ISO 19011 page. For the automotive industry, IATF 16949 adds sector-specific requirements.