Quality Management Systems: ISO 9001:2015, Process Approach, Risk-Based Thinking, and IATF 16949

The ISO 9001:2015 High Level Structure

ISO 9001:2015 is organized using the High Level Structure (HLS), also called Annex SL, which provides a common framework shared by all ISO management system standards (ISO 14001 for environmental management, ISO 45001 for occupational health and safety, and others). The HLS has ten clauses:

Clauses 1-3 (Scope, Normative References, Terms and Definitions): non-certifiable clauses that define what the standard covers and the vocabulary it uses.

Clause 4 (Context of the Organization): requires the organization to understand its internal and external context (the factors that affect its ability to achieve its objectives), identify interested parties (stakeholders whose needs and expectations are relevant to the QMS), and define the scope of the QMS. The context clause drives the organization to think beyond its own operations to consider the competitive, regulatory, and social environment in which it operates.

Clause 5 (Leadership): places explicit accountability for the QMS on top management, requiring demonstrated commitment rather than delegated responsibility. Top management must establish and communicate the quality policy, assign roles and responsibilities, and ensure the QMS is integrated with business strategy. The 2015 standard eliminated the requirement for a Management Representative as a single point of accountability, distributing QMS responsibility across the leadership team.

Clause 6 (Planning): requires the organization to identify risks and opportunities that could affect the QMS (risk-based thinking), establish quality objectives at relevant levels, and plan the actions needed to achieve those objectives. This is the “Plan” step of the PDCA cycle at the system level.

Clause 7 (Support): covers the resources, competence, awareness, communication, and documented information necessary to operate the QMS. It includes requirements for ensuring that people performing quality-affecting work are competent on the basis of education, training, or experience, and that the organization retains documented information sufficient to demonstrate conformance.

Clause 8 (Operation): the largest clause, covering the operational processes: planning and controlling product and service provision, design and development, control of externally provided processes and products (purchasing and supplier management), production and service provision, control of non-conforming outputs, and release of product. This is the “Do” step of the PDCA cycle.

Clause 9 (Performance Evaluation): requires monitoring, measurement, analysis, and evaluation of QMS performance, including customer satisfaction monitoring, internal audit, and management review. This is the “Check” step of PDCA.

Clause 10 (Improvement): requires the organization to continually improve the suitability, adequacy, and effectiveness of the QMS through nonconformity and corrective action, and continual improvement actions. This is the “Act” step of PDCA.

The process approach

The process approach is the organizing principle of ISO 9001:2015. It requires the organization to identify the processes needed for the QMS, understand how they interact, and manage them as a system to produce consistent, conforming outputs. A process is defined as a set of interrelated activities that transform inputs into outputs. The key elements that must be defined for each process are: inputs and their sources; outputs and their intended recipients; resources required (personnel, equipment, materials, information); responsibilities and authorities; monitoring and measurement criteria; risks and opportunities associated with the process; and methods for improvement.

The process approach has several practical implications. First, processes must be managed end-to-end across organizational boundaries, not optimized within functional silos. The process that produces a product typically cuts across engineering, procurement, manufacturing, and quality departments; responsibility for process performance must be assigned to someone who owns the entire process, not just a functional segment of it. Second, process performance must be measured at the outputs, not just the inputs: the question is not whether the process is being followed but whether it is producing the intended results. Third, processes must be documented to the extent necessary to ensure consistent execution, but not beyond what is needed: the standard requires documented information to support process operation, not documentation for its own sake.

Risk-based thinking

Risk-based thinking is the application of structured analysis to identify and address risks that could prevent the organization from delivering conforming products and services, achieving quality objectives, or satisfying customers and interested parties. In ISO 9001:2015, risk-based thinking is embedded throughout the standard rather than confined to a single clause: the organization identifies risks in the context clause (clause 4), plans actions to address them in the planning clause (clause 6), implements those actions in the operation clause (clause 8), and verifies their effectiveness in the performance evaluation clause (clause 9).

The standard does not mandate a specific risk assessment tool or methodology. Organizations may use failure mode and effects analysis (FMEA), fault tree analysis, risk matrices, process FMEA, or qualitative risk registers depending on the complexity of their operations and the nature of their products. What the standard requires is evidence that the organization has thought systematically about what could go wrong, has prioritized its risks, has planned and implemented actions proportionate to the magnitude of the risks, and has evaluated whether those actions were effective.

Risk-based thinking replaced the separate preventive action procedure that was required by ISO 9001:2008. The intent was to shift from a reactive procedure (write a preventive action after you notice a risk) to a proactive culture (build risk consideration into every process and every decision). In practice, many organizations have found this transition challenging and continue to maintain a separate risk register or risk review process as the operational mechanism for meeting the risk-based thinking requirement.

The PDCA cycle in the QMS

The Plan-Do-Check-Act (PDCA) cycle, also called the Deming cycle or Shewhart cycle, is the governing improvement methodology of ISO 9001:2015. The standard explicitly maps the PDCA cycle to its clause structure: clause 6 (Planning) is Plan, clause 8 (Operation) is Do, clause 9 (Performance Evaluation) is Check, and clause 10 (Improvement) is Act. The cycle operates at multiple levels simultaneously: at the system level (the annual management review plans system-level improvements, which are implemented over the year, evaluated in the next review), at the process level (process owners plan and implement process improvements on shorter cycles), and at the product level (design and development reviews, production process monitoring, and customer feedback drive product-level improvements).

Documented information requirements

ISO 9001:2015 replaced the previous standard’s prescriptive list of required procedures and records with the broader concept of “documented information.” The standard requires documented information in two situations: where the organization needs documented information to support the operation of its processes (working documents such as procedures, work instructions, drawings, and specifications), and where the standard explicitly requires the organization to retain documented information as evidence of conformance (records). The specific clauses where the standard requires retained documented information include: calibration records, records of design and development outputs, supplier evaluation records, traceability records for product, records of non-conforming outputs, internal audit records, and management review records.

Critically, the standard does not require a quality manual (though many organizations continue to maintain one for certification and customer communication purposes), and it does not prescribe specific formats for documented information. Organizations have significant flexibility in how they structure and control their documented information.

IATF 16949 automotive extensions

IATF 16949:2016 is the automotive sector quality management system standard, developed and maintained by the International Automotive Task Force (IATF). It does not stand alone: it must be implemented together with ISO 9001:2015, which it supplements with automotive-specific requirements. Key additions beyond ISO 9001 include:

Customer-specific requirements (CSRs): each major automotive OEM publishes its own CSRs that impose additional requirements on their suppliers. CSRs address topics such as APQP process, PPAP submission requirements, FMEA methodology, measurement systems analysis, problem-solving response format and timing, and production part approval. Organizations certified to IATF 16949 must identify and comply with all applicable CSRs from their direct customers.

Product and process approval (PPAP): IATF 16949 requires a formal production part approval process before the first commercial shipment of any new or changed product. PPAP demonstrates that the organization understands the customer’s design and engineering requirements and has the manufacturing processes capable of producing product conforming to those requirements at production rates.

Advanced product quality planning (APQP): a structured product development and launch process that front-loads quality planning activities before production begins, ensuring that product and process designs are reviewed for manufacturability, that process FMEAs and control plans are developed, and that capability studies are completed before regular production begins.

Core tools: IATF 16949 requires the use of the AIAG core tools throughout the product lifecycle: APQP, PPAP, FMEA (using the AIAG-VDA methodology), MSA, and SPC. Competency in these tools must be demonstrated by relevant personnel.

Contingency planning: IATF 16949 requires contingency plans to address potential disruptions to production continuity, including equipment failures, utility outages, supplier disruptions, and natural disasters. The contingency plan must identify alternative means of production, communication protocols, and recovery timelines.

Common errors in QMS implementation

• Building the QMS for auditors rather than for operations. QMS documentation that describes an ideal process rather than the actual process practiced on the shop floor creates a system that passes audits but fails to prevent quality problems. The documented process must reflect reality, and reality must conform to the documented process: the gap between the two is both a non-conformance and a source of uncontrolled quality risk.
• Treating quality objectives as checkboxes rather than as business drivers. Quality objectives must be measurable, monitored, and acted upon. An objective that is never reviewed, never missed, and never drives any corrective action is not functioning as an objective: it is a decoration on the QMS. Effective quality objectives are connected to real process performance data and drive resource allocation when performance falls short.
• Disconnecting the management review from actual business decisions. The management review is the mechanism by which top management fulfills its leadership obligation to the QMS. A management review that consists of reviewing a stack of compliance reports without making any decisions or committing any resources is not fulfilling the intent of the standard and will be flagged as a finding in a well-conducted audit.
• Failing to maintain documented information currency. Documented information that is out of date — work instructions that do not reflect the current process, drawings that have been superseded by engineering changes, procedures that reference organizational structures or tools that no longer exist — is worse than no documentation at all, because it creates confusion about what the correct process actually is and provides a false sense of control.

Frequently asked questions

What are the main changes in ISO 9001:2015 compared to the 2008 version?

ISO 9001:2015 introduced several significant changes compared to ISO 9001:2008. The most important are: (1) Context of the organization: the 2015 version requires organizations to formally analyze their internal and external context and identify interested parties — a requirement that did not exist in the 2008 version. (2) Risk-based thinking: the 2015 version requires systematic consideration of risks throughout the QMS, replacing the separate preventive action procedure of the 2008 version with an integrated risk management approach embedded in planning, operations, and performance evaluation. (3) High Level Structure: the 2015 version adopted the Annex SL common framework shared by all ISO management system standards, making it easier to integrate ISO 9001 with ISO 14001, ISO 45001, and other management system standards. (4) Leadership: the 2015 version strengthened the leadership requirements and eliminated the requirement for a designated Management Representative, distributing QMS accountability more broadly across the leadership team. (5) Knowledge management: the 2015 version added explicit requirements for organizational knowledge — identifying, maintaining, and making available the knowledge needed for effective process operation. (6) Reduced prescriptiveness: the 2015 version reduced the number of explicitly required documented procedures (from six in the 2008 version to none mandatory by name in the 2015 version) and eliminated the requirement for a quality manual, giving organizations more flexibility in how they structure their documented information.

What is the difference between ISO 9001 and IATF 16949?

ISO 9001 is the generic quality management system standard applicable to any organization in any industry. IATF 16949 is the automotive sector QMS standard that supplements ISO 9001 with additional requirements specific to organizations manufacturing production parts, service parts, and accessories for the automotive industry. IATF 16949 cannot be implemented without ISO 9001: it builds on the ISO 9001 foundation and adds automotive-specific requirements for product and process approval (PPAP), advanced product quality planning (APQP), failure mode and effects analysis (FMEA using the AIAG-VDA methodology), measurement systems analysis (MSA), statistical process control (SPC), contingency planning, and the AIAG core tools. IATF 16949 also requires organizations to identify and comply with all applicable customer-specific requirements (CSRs) from their direct automotive customers, which adds another layer of requirements beyond the base standard. A supplier to an automotive OEM that requires IATF 16949 certification cannot substitute ISO 9001 certification: IATF 16949 is a separate, more demanding certification that requires a separate third-party audit by an IATF-recognized certification body using IATF-prescribed audit rules.

What is risk-based thinking in ISO 9001:2015 and how is it implemented?

Risk-based thinking in ISO 9001:2015 is the systematic consideration of risks and opportunities throughout the QMS to prevent undesired outcomes and promote desired ones. The standard requires that risk-based thinking be applied in four stages of the management cycle: in the context analysis (clause 4), the organization identifies the risks posed by its external and internal environment; in planning (clause 6), the organization determines what actions to take to address the identified risks and opportunities; in operations (clause 8), those actions are implemented; and in performance evaluation (clause 9), the organization assesses whether the actions were effective. Implementation in practice typically involves maintaining a risk register that documents identified risks, their assessed likelihood and impact, the mitigation actions planned or implemented, and the residual risk after mitigation. Process FMEAs serve as the detailed risk analysis tool for manufacturing processes. Design FMEAs serve the same function for product designs. Management review provides the forum where risk status is reviewed at the system level and resource decisions are made to address high-priority risks. The standard does not prescribe any specific risk analysis methodology: organizations choose the tools appropriate to their context and the nature of their risks.

What documented information is mandatory under ISO 9001:2015?

ISO 9001:2015 requires two types of documented information: maintained documented information (working documents that describe how processes are performed) and retained documented information (records that provide evidence that activities were performed as planned). The standard does not prescribe a quality manual, a fixed set of procedures, or specific formats: organizations have significant flexibility. The clauses that explicitly require retained documented information (records) include: monitoring and measurement equipment calibration records (clause 7.1.5); evidence of competence of personnel (clause 7.2); design and development outputs (clause 8.3.6); supplier evaluation, selection, and re-evaluation records (clause 8.4.1); evidence that processes are carried out as planned (clause 8.1); traceability records for product and service provision (clause 8.5.2); records of property belonging to customers or external providers (clause 8.5.3); records of changes in production (clause 8.5.6); records of non-conforming outputs and actions taken (clause 8.7.2); internal audit results (clause 9.2.2); and management review results (clause 9.3.3). Organizations may choose to maintain additional documented information beyond these minimums as a matter of practice, risk management, or customer requirement.

How does the management review requirement work and what should it cover?

The management review is a formal meeting of top management at planned intervals to assess the suitability, adequacy, effectiveness, and alignment of the QMS with the organization’s strategic direction. ISO 9001:2015 clause 9.3 specifies the inputs that the management review must consider: the status of actions from previous reviews; changes in external and internal issues relevant to the QMS; information on QMS performance (customer satisfaction, quality objectives, process performance, product and service conformity, nonconformities and corrective actions, monitoring and measurement results, audit results, supplier performance); the adequacy of resources; the effectiveness of actions taken to address risks and opportunities; and opportunities for improvement. The outputs of the management review must include decisions and actions related to: opportunities for improvement; changes to the QMS including resource needs; and any additional resources required. The management review is not a compliance exercise: its purpose is to give top management the information they need to make resource and strategy decisions about the QMS. A well-run management review produces decisions: resource commitments to address performance gaps, approved changes to quality objectives, endorsement or revision of the quality policy, and action assignments with owners and due dates.

What is APQP and how does it relate to IATF 16949?

Advanced product quality planning (APQP) is a structured framework for planning the design and manufacture of a new or revised automotive product to ensure that it meets customer requirements. It was developed by the Automotive Industry Action Group (AIAG) and is required by IATF 16949 as the standard product development methodology for automotive suppliers. APQP is organized into five phases: (1) Plan and Define Program — translating customer needs into product and process requirements; (2) Product Design and Development — completing the design, design FMEA, prototype builds, and design verification; (3) Process Design and Development — completing the process flow diagram, process FMEA, control plan, and work instructions; (4) Product and Process Validation — completing capability studies, measurement systems analysis, and the production trial run to demonstrate that the product and process meet requirements at production rates; and (5) Feedback, Assessment, and Corrective Action — ongoing monitoring of production performance and response to quality issues. The APQP process culminates in the PPAP (production part approval process) submission, which provides the customer with documentary evidence that the supplier’s design and manufacturing processes are capable of producing conforming product consistently at production rates. APQP is the quality planning methodology that connects customer requirements to production process design, ensuring that quality is engineered in rather than inspected out.