ISO 9001:2015 QMS — Implementation, Audit & CAPA

ISO 9001:2015 Quality Management System implementation, internal audit, and CAPA management. Use when implementing a QMS from scratch, conducting gap assessment against ISO 9001:2015 clauses 4–10, planning or executing internal audits, managing nonconformities, or running CAPA investigations (5-Why, fishbone, root cause analysis, effectiveness verification). Suitable for any industry — manufacturing, services, energy, construction.

Complete toolkit for ISO 9001:2015 Quality Management System work: gap assessment, implementation roadmap, internal audit checklists, and CAPA management.

---

Contents

1. Clause Structure Quick Reference
2. Required Documents & Records
3. Implementation Roadmap
4. Gap Assessment Workflow
5. Internal Audit — Clause Checklists
6. Nonconformity Classification
7. CAPA Investigation Workflow
8. Root Cause Analysis Methods
9. CAPA Action Planning & Effectiveness
10. CAPA Metrics

---

1. Clause Structure Quick Reference

Clause	Title	Core Requirement
4	Context of the Organization	Understand internal/external issues, interested parties, define scope
5	Leadership	Top management commitment, quality policy, roles and responsibilities
6	Planning	Risks and opportunities, quality objectives, change planning
7	Support	Resources, competence, awareness, communication, documented info
8	Operation	Process planning, design control, supplier management, production/service delivery
9	Performance Evaluation	Monitoring, customer satisfaction, internal audit, management review
10	Improvement	Nonconformity, corrective action, continual improvement

---

2. Required Documents & Records

Mandatory documented information (must exist)

• Quality policy (5.2)
• Quality objectives (6.2)
• Scope of the QMS (4.3)
• Process interactions map (4.4)
• Risk and opportunity register (6.1)

Mandatory records (must be kept)

• Competence/training records (7.2)
• Monitoring and measurement results (9.1)
• Internal audit program and results (9.2)
• Management review outputs (9.3)
• Nonconformity and corrective action records (10.2)
• Customer feedback / complaint records (9.1.2)

Recommended (not mandatory but auditors expect them)

• Customer satisfaction survey method
• Supplier evaluation records
• Design and development records (if clause 8.3 applies)
• Equipment calibration records (if measuring equipment used)

---

3. Implementation Roadmap

Phase 1 — Foundation (Months 1–3)

1. Secure leadership commitment (clause 5)
2. Define organizational context and interested parties (clause 4.1–4.2)
3. Define QMS scope (clause 4.3)
4. Conduct gap assessment against all clauses (see Section 4)
5. Build implementation project plan

Phase 2 — Development (Months 4–6)

1. Write quality policy and objectives
2. Map and document core processes (clause 4.4, 8.1)
3. Conduct risk and opportunity assessment (clause 6.1)
4. Create or update procedures and work instructions
5. Set up document control system (clause 7.5)
6. Train staff on QMS requirements

Phase 3 — Implementation (Months 7–9)

1. Deploy processes and start collecting records
2. Conduct first internal audits (clause 9.2)
3. Issue nonconformities and initiate CAPAs
4. Hold first management review (clause 9.3)

Phase 4 — Certification (Months 10–12)

1. Full internal audit cycle complete
2. All major CAPAs closed or in verification
3. Stage 1 audit (document review by certification body)
4. Stage 2 audit (on-site certification audit)
5. Address any findings → certificate issued

---

4. Gap Assessment Workflow

For each clause below, rate current state: ✅ Compliant / ⚠️ Partial / ❌ Missing

text

CLAUSE 4 — Context
[ ] 4.1 Internal and external issues identified and documented
[ ] 4.2 Interested parties and their requirements defined
[ ] 4.3 QMS scope defined and documented
[ ] 4.4 Processes and their interactions mapped

CLAUSE 5 — Leadership
[ ] 5.1 Top management demonstrates commitment (actions, not just words)
[ ] 5.2 Quality policy documented, communicated, understood
[ ] 5.3 Roles and responsibilities assigned and communicated

CLAUSE 6 — Planning
[ ] 6.1 Risks and opportunities identified and addressed
[ ] 6.2 Quality objectives set, measurable, monitored
[ ] 6.3 Process in place for managing planned changes

CLAUSE 7 — Support
[ ] 7.1 Resources (people, infrastructure, environment) adequate
[ ] 7.2 Competence defined and verified for all roles
[ ] 7.3 Staff aware of quality policy and their contribution
[ ] 7.4 Internal and external communication defined
[ ] 7.5 Document control process in place (create, update, distribute, retain)

CLAUSE 8 — Operation
[ ] 8.1 Operational processes planned and controlled
[ ] 8.2 Customer requirements determined and reviewed
[ ] 8.3 Design and development process (if applicable)
[ ] 8.4 External providers (suppliers) evaluated and monitored
[ ] 8.5 Production/service delivery controlled; identification and traceability

CLAUSE 9 — Performance Evaluation
[ ] 9.1 Monitoring and measurement methods defined and used
[ ] 9.1.2 Customer satisfaction measured
[ ] 9.2 Internal audit program planned and executed
[ ] 9.3 Management review conducted with defined inputs/outputs

CLAUSE 10 — Improvement
[ ] 10.1 Improvement opportunities identified
[ ] 10.2 Nonconformity and corrective action process in place
[ ] 10.3 Continual improvement demonstrated over time

Prioritize gaps: Any ❌ in clauses 5, 9, or 10 = high risk for certification failure.

---

5. Internal Audit — Clause Checklists

Use during internal audits. For each item, record: Compliant / Minor NC / Major NC / OFI (Opportunity for Improvement).

Clause 4 — Context

• Is the organizational context documented and kept up to date?
• Are interested parties and their relevant requirements identified?
• Is the QMS scope clearly defined? Does it reflect actual activities?
• Are all processes and their sequence and interaction defined?

Clause 5 — Leadership

• Can top management demonstrate active involvement in the QMS?
• Is the quality policy available, communicated, and understood by staff?
• Are quality roles, responsibilities and authorities clearly assigned?
• Do staff know how their work affects product/service quality?

Clause 6 — Planning

• Is there a documented risk and opportunity register?
• Are quality objectives measurable and monitored? Are results reviewed?
• Is there a process to plan and implement changes in a controlled way?

Clause 7 — Support

• Are sufficient resources provided for QMS operation?
• Is competence defined for each role affecting quality? Are records maintained?
• Is awareness of the quality policy verified (e.g. through training)?
• Are communication methods defined (who, what, when, how)?
• Is document control working: approval, versioning, obsolete doc handling?

Clause 8 — Operation

• Are customer requirements reviewed before accepting orders?
• Are purchasing/supplier controls appropriate to risk?
• Are products/services identified and traceable throughout delivery?
• Is customer property identified and protected?
• Are post-delivery activities (warranty, feedback) controlled?

Clause 9 — Performance Evaluation

• Is customer satisfaction measured? Are results used for improvement?
• Is the internal audit program risk-based and covers all clauses over time?
• Are audit findings documented? Are CAPAs opened for NCs?
• Does management review include all required inputs? Are outputs actioned?

Clause 10 — Improvement

• Are nonconformities recorded and corrective actions taken?
• Is root cause analysis conducted for significant NCs?
• Are CAPA actions verified for effectiveness?
• Is there evidence of continual improvement over time?

---

6. Nonconformity Classification

Classification	Definition	CAPA Required
Major NC	Absence of a required system element, or complete failure of it	Yes — within 30 days
Minor NC	Single lapse or partial implementation of a requirement	Recommended
OFI	No requirement breached, but improvement is possible	No

Major NC examples:

• No internal audit program exists
• Quality policy not communicated to staff
• No documented process for handling customer complaints
• Corrective actions never verified for effectiveness

Minor NC examples:

• Audit schedule exists but one area not audited in cycle
• Training records incomplete for two employees
• Document revision history missing from one procedure

---

7. CAPA Investigation Workflow

1. Document trigger event with objective evidence
2. Classify severity (Major / Minor) — see Section 6
3. Determine if CAPA is required — see trigger table below
4. Form investigation team (proportional to severity)
5. Collect evidence (records, interviews, observations)
6. Select RCA method and identify root cause — see Section 8
7. Validate root cause: if eliminated, would problem recur?
8. Develop actions — see Section 9
9. Implement and verify effectiveness

CAPA Trigger Decision Table

Source	CAPA Required	Criteria
Customer complaint	Yes	Any complaint affecting quality or safety
Internal audit — Major NC	Yes	Always
Internal audit — Minor NC	Recommended	If systemic pattern suspected
Nonconformance — recurring	Yes	Same type occurring 3+ times
Nonconformance — isolated	Evaluate	Based on severity and risk
External audit finding	Yes	All Major and Minor findings
Management review output	Evaluate	Based on significance

---

8. Root Cause Analysis Methods

Method Selection

text

Is it a safety or system reliability issue?
├── Yes → Fault Tree Analysis
└── No → Is human error the primary suspect?
    ├── Yes → Human Factors Analysis
    └── No → How many contributing factors?
        ├── 1–2 (linear) → 5 Why Analysis
        ├── 3–6 (complex) → Fishbone Diagram
        └── Unknown / proactive → FMEA

5 Why Template

text

PROBLEM: [Specific, measurable statement]

WHY 1: Why did [problem] occur?
BECAUSE: [First cause]   EVIDENCE: [Data]

WHY 2: Why did [first cause] occur?
BECAUSE: [Second cause]  EVIDENCE: [Data]

WHY 3: Why did [second cause] occur?
BECAUSE: [Third cause]   EVIDENCE: [Data]

WHY 4: Why did [third cause] occur?
BECAUSE: [Fourth cause]  EVIDENCE: [Data]

WHY 5: Why did [fourth cause] occur?
BECAUSE: [ROOT CAUSE]    EVIDENCE: [Data]

Root cause validation checklist:

• Supported by objective evidence
• If eliminated, problem would not recur
• Within organizational control
• Explains all observed symptoms

Fishbone — 6M Categories

Category	Focus
Man (People)	Training, competency, workload, awareness
Machine (Equipment)	Calibration, maintenance, capacity
Method (Process)	Procedures, work instructions, controls
Material	Specifications, supplier quality, storage
Measurement	Instrument accuracy, methods, interpretation
Mother Nature	Environment: temperature, humidity, cleanliness

---

9. CAPA Action Planning & Effectiveness

Action Types

Type	Purpose	Typical Timeframe
Containment	Stop immediate impact	24–72 hours
Correction	Fix this specific occurrence	1–2 weeks
Corrective	Eliminate root cause	30–90 days
Preventive	Prevent in similar processes	60–120 days

Action Plan Template

text

CAPA Ref: [CAPA-YYYY-NNN]
Root Cause: [Statement]

ACTION 1: [Description]
- Type: [ ] Containment  [ ] Correction  [ ] Corrective  [ ] Preventive
- Owner: [Name]
- Due: [YYYY-MM-DD]
- Success Criteria: [Measurable outcome]
- Verification Method: [How it will be checked]

Effectiveness Verification

CAPA Severity	Wait Before Verifying	Verification Window
Major	30 days	30–90 days post-implementation
Minor	60 days	60–180 days post-implementation

Effectiveness decision:

text

Did the problem recur during verification period?
├── Yes → CAPA INEFFECTIVE → Re-investigate root cause
└── No → Were all success criteria met?
    ├── Yes → CAPA EFFECTIVE → Close
    └── No → Gap significant?
        ├── Minor → Extend verification or accept with justification
        └── Major → CAPA INEFFECTIVE → Revise actions

---

10. CAPA Metrics

Track these KPIs for management review:

Metric	Target	Calculation
Average cycle time	< 60 days	(Close date − Open date) / # CAPAs
Overdue rate	< 10%	Overdue / Total open
First-time effectiveness	> 90%	Effective on 1st verification / Total verified
Recurrence rate	< 5%	Recurred issues / Total closed

CAPA Aging Categories

Age	Status	Action
0–30 days	On track	Monitor
31–60 days	Monitor	Review for delays
61–90 days	Warning	Escalate to management
> 90 days	Critical	Management intervention

---

Based on ISO 9001:2015 standard requirements. CAPA methodology adapted from ISO 13485 audit practices (RCA methods are universal across QMS frameworks).