INTERNATIONAL Iso STANDARD 9001 Quality management systems — Requirements ‘S)tdmes de management de la qualité Exigences ‘so 900%:20150)180 9001:2015(E) Av. coorncre norecren vacant (© 1502015, Pblished in Site -Allrghs reserved. ols eter spect po part of hs abition maybe rpreucd or ied eters ay frm {by any meats lactone or mechan cg phen o Postng on he ret ran rane who por Seen mao eso cn bw nn omer Kb esc ery omy Soip@inore rons A (© 802015 ahs resend180 9001:2015(8) Contents age Foreword. Introduction 1 Scope. 2 Normative references ot 3 Termsand definitions, : a 4 Context ofthe organization : — at 1 Understanding the organization and its context 1 12 Unlerstanding the needs and expectations of interested partis 2 43. Devermining the scope ofthe qualty managemeat system, So 44 Quilty management system and is processes a 5 Leadership. — ‘Sa. Leadership and commitment. Si Generale S12 Customerfocus. 820 Poly 521 Establishing the quality policy 522 Communicating the quality policy 53. Organizational roles responsibilities and authorities. 6 Planning = 61 Ations to addres risks and opportunities. 62 Quality objectives and planning to achieve them. 63 Panning ot ehanges 7 Support. _ 7A Resources ~ 7a 712 73 714 Environment for the operation of processes. 7415. Monitoring and measuring resources. 7.416 Organizational knowledge 72 Competence. : = 73. woreness ee 74 Communication 75 Dowmented information 781 General, 732 Creating and updating = 783 Control of documented information 8 Operation ‘Operational planningand control 82. Regiments forpredusandvervics 821 Customer communication 822 Determining the requirements for products and services. 40 823 Review of the requirements for products and services 10 8.24 Changes to requirements fr products and services a 83 Design and development of products and services 831 General 832 Design and development planning 1833 Design and development inputs. 834 Design and development controls. 1835 _ Design and development outputs ‘836 Design and development changes. £2150 2015~ Ags reser i150 9003:2015(6) 84 Controlof externally provided processes, products and services. eel 841 General. 842 Typeand extent of control — 843 _ Information for external providers. 85 Production and service provision 851 Controlof production and servic provision 852 Mentieaton and traceability. 853 Property belonging to customers or exer B54 Preservation 855. Postdelvery activities 856 Control of changes = 86 Release of products and services 87 Contrl of nonconforming outputs 9 Performance evaluation. 941 Monitoring, measurement analysis and evaluation 944 Genera. 9412 Gstomersatistaction. 9:13 _ Analysis and evaluation 92 Internal adit 93 Management review 931 General. 932 Management review inputs 93.3 Management review outputs 10 Improvement. - 101" General 4302 _Nonconformity and corrective action 103 Continual improvement — = ‘Annex A (informative) Clarification of new structure, terminology and concepts. ‘Annex (informative) Other International Standards on quality managementand quality ‘management systems developed by 80/1370. —— 28 ‘Bibliography 28180 9001:2015(6) Foreword 1S0 (the International Organization for Standardization) isa worldwide federation of national standards bodies (I80 member bodies). The work of preparing International Standards is normally carried out ‘through IS0 technical committees. Each member body interested in asufect for which technical committee has teen established has the right to be represented on that committee International foryanlzations, geveramental and non-governmental, nlaison with IO, also take part in the work, 10 collaborates closely withthe International Electrotechnieal Commission (IEC) on all matters Of tlectrotechnial standardization. “The procedures used to develop this document and those intended for its further maintenance are described inthe ISO/IEC Directives, Part 1 In particular the differen approval criteria needed forthe liferen types ofS0 documents shouldbe noted. This document sas drafted in accordance withthe ‘editorial rules othe ISO/IEC Directives, Part? (see wus isaarg/directives), ‘Attention is drawn to the possibilty that some ofthe elements ofthis document may be the subject of patent rights SC shall not be held responsibe for identifying any or all such patent rights, Details of ‘ny patent rights identified during the development ofthe document will ben the Introduction andor ‘onthe ISO ist of patent declarations received (see wariniso ore/patems), ‘Any trade name used in this document s information given forthe convenience of users and does not ‘onstitute an endorsement. Foran explanatiot onthe meaningof SO speifc terms and expressions relatedo conformity assessment, as well as informition about 150s adherence tothe World Trade Organtaatien (WTO) priipes in the ‘Technical Barrer to Trade (TBT) see the following URL: wwssisoong/so/fosword ht. ‘The committee responsible for this document is Technical Committee ISO/TC 176, Quality management and quality assurence Subcommittee SC2, Quay systems. ‘This fifth edition cancels and replaces the fourth edition (ISO 9001-2008), which has been technically revised, through the adoption ofa revised clause sequence and the adaptation ofthe revised quality taagenient pices and uf ew concepts I alse tatwels and teplaces the Teenie] Corrgendut 180 9001:2008/Cor1:2009, (01502015 Aight reserved 70. General “The adoption of a quality management system isa strategic decision for an organization that can help ‘twimprove ts overall performance and provide a sound basis for sustainable development iitative. “The potential benefits to an organization of implementing a quality management system based on this International Standard are: 4) the ability to consistently provide products and services that meet customer and applicable Statutory and regulatory requirements; 1) facilitating opportunites to enhance customer satisfaction; ‘addressing risks and opportunites assoclated with ts context and objectives; 4) theabity to demonstrate conformity to specified quality management system requirements ‘This International Standard can be used by internal and external partes, leis not the intent ofthis International Standard to imply the need for: — uniformity inthe structure of different quality management systems; — alignment of documentation to the clause structure of ths International Standard = theuse ofthe specific terminology ofthis International Standard within the organization, ‘The quality management system requirements specified in this International Standard complementary to requirements for products and services, ‘Ths International Standard employs the process approach, which incorporates the Plan-Do-Check-Act (POCA) eyele and rise based thinking “The process approach enables an organization to plan its processes and their interactions. ‘The PDCA cycle enables an organization to ensure that is processes are adequately cesourced and managed, and that opportunites for improvement are determined and acted on. Risicbased thinking enables an organization to determine the factors that could eauseitsprocesses and ‘ts quality management system to deviate rom the planned results, to putin place preventive controls to minimize negative elects and to make maximum use of opportunities as they arse (se Clause A}. Consistently meeting requirements and addressing future needs and expectations poss a challenge for organizations in an increasingly dynamic and complex environment. Tp achieve this objective the ‘organization might find fe necessary to adopt various forms of improvement in addition to correction fd continval improvement, such as breakthrough change, innovation and re-organization. In this International Standard the following verbal forms are used “shall” indicates requirement: = “should indicates a recommendation; = “may” indicates a permission; — ‘ean’ indicates possibilty ora capability Information marked as NOTE" Isfor guidance in understanding or clarifying the associated requirement. “ (01502015 Alright rece180 9001:2015(8) 02 Quality management principles ‘This International Standard is based on the quality management principles described in 109000. The escriptons include a statement of each principle, a rationale of why the principle simportat forthe ‘organization, some examples of benefits assoctated with the principle and examples of typed ations to improve the organization's performance when applying the principle. ‘The quality management principles are: — customer focus: — leadership: = engagement of people: — process approach = Improvements = evidence-based decision making = relationship management. 0.3 Process approach 03.4 Geners ‘This International Standard promotes the adoption of a process approach when developing, Implementing and improving te effectiveness of quality management system, to enhance customer stsfaction By meeting customer requirements. specific requirements considered essential to the Adoption of process approach are included in 4.4. Understanding and managing interrelated processes a a system contributes to the organizations effectiveness and efficiency in achieving its Intended results, This approach enables the organization to contra the interrelationships and interdependencies among the processes of the system se that the ‘overall performance of the organization can be enhanced ‘The process approach involves the systematic definition and management of processes, end their Interactions, so a5 to achieve the intended results in accordance withthe quality policy andstrategic direction ofthe organization. Management ofthe processes and the system as a whole can be achieved Using the PDCA eyele (see 0.32) with an overall focus on risk-based thinking (se 0.3.3) aimed aking advantage of opportunities and preventing undesirable results. “The application ofthe process approach in a quality management system enables 4) understanding and consistency in meeting requirements; 1) the consideration of processes in terme faded wale: ©). the achievement of effective process performance; 42) improvementof processes based on evaluation of data and information, ‘igure gives a schematic representation of any process and shows the interaction of ts elements. The ‘monitoring and measuring check points, which are necessary for contral are specie to each process ‘and wil vary depending o the related risks.150 9001:2015(E) Figure 1 —Sehematic representation of the elements ofa single process 03.2 Plan-Do-Cheal-Acteyele ‘The POCA eyete can be applied to all processes and to the quality management system as 2 whole. Figuce2 illustrates how Clauses 4 to 10 canbe grouped in elation to the POCA cyte. NOTE Numbersin brackets refer tothe clauses in this International Standaed, Figure 2— Representation ofthe structure of this International Standard in the PDCA cycle nu 1S02015- Alege rare180 9001:2015(8) ‘The PDCA cycle can be briefly described as follows: lan: establish the objectives ofthe system and its processes, and the resources needed to deliver results in accordance with customers requirements and the organization's policies, and ientify and address risks and opportunities, Do: implement what was planned: ‘Check: monitor and (where applicable) measure processes and the resulting products and services ‘against polices, objectives, requirements and planned activities, and report the result — Act take actions to improve performance, as necessary, 03.8 Rislcbased thinking Riskcbased thinking (see Cause A.4) is essential for achieving an effective quality management system. ‘The concept of rislebased thinking has been implicit in previous editions of his International Standard Including, for example, carrying out preventive ation to eliminate potential nonconformities, analysing any nonconformities that do occur, and taking action to prevent recurrence that is appropriate forthe tlcts ofthe noncontormity, ‘To conform to the requirements ofthis International Standard, an organization needs to plan and Implement actions to address risks and opportunities. Addressing both risks and opportunites textablishes basis for increasing the effectiveness ofthe quality management system, achieving Improved results and preventing negative effects, ‘Opportunities can arise as a result ofa situation favourable to achieving an intended result, for example, a set of circumstances thatallow the organization teattract customers, develop new products and services, reduce waste or improve productivity. Actions to address opportunites ean also include Consideration of associated risk. Risk i the effect of uncerainty and any auch uncertainty ean have positive or negative effects A postive deviation arising froma rskean provide an opportunity, but not El postive effects of ik result in opportunities 0.4 Relationship with other management system standards ‘This international Standard applies the framework developed by ISO to improve alignment among its International Standards for management systems (see Clause A). ‘This International Standard enables an organization to use the process approach, coupled with the PDCA eycle and riskbased thinking, to align or integrate ts quality management system withthe requirements of other management system standards “This International Standard relates to 1S0 9000 and ISO 900% as follows: = 150 9000 Quality management systems — Fundamentals and vocabulory provides essential background forthe proper understanding and implemensation ofthis International Standard, — 150.9004 Managing for che sustained sucess of on arganzation — A quality management approach provides guidance for organizations that choose to progress beyond the requirements of this International Standard, ‘Annex B provides details of other International Standards on quality management and quality ‘management systems that have been developed by S0/TC 195, ‘This Internationa Standard does not include requirements specific to other management systems, ch as thove for environmental management, occupaticnal health and safety management, Financial management. Sector-specifc quality management system standards basedon the requirements ofthis International Standard have been developed fora numberof sectors. Sone ofthese standards specify addtional ‘quality management system requirements, while others are limited to providing Buidance to the pplication ofthis International standard within the partculr sector (21502015 - tights served ix180.9001:2015(8) -Amatrix showing the correlation between the causes of this edition ofthis International Standard and {ie previous eatin (190 9001-2008) van be fount on the 1S0/7C 376/S 2 pen access web site at « (0150 2015-AtrnaesesredINTERNATIONAL STANDARD 180 9001:2015(8) Quality management systems — Requirements 1 Scope This International Standare specifies requirements for © quality management system when an organization 8) needs to demonstrate itsabilty to consistently provide products and services that meet customer and applicable statutory and regulatory requirements, and 1b) alms to enhance customer satisfaction through the effective application of the system, including Processor for improvement of the system and the assurance of conformity &0 customer and Epplicable statutory and regulatory requirements. Allthe requirements ofthis International Standard are genericand are intended tobe applicable to any borgantzaton, regardless ofits type or size or the produets and services it provides NOTE1 tn this iternational Standard, the terms “product” or “servic” only apply to products and services Intended or ar requlred by, acustomer NOTE2 statutory and regulatory requirements canbe expressed as legal requirement. 2. Normative references ‘The following documents, in whole or in part, are normatvely referenced in this document and are Indispensable for its application. For dated references, only the edition cited applies. For undated references, the latest edition othe referenced document (including ny amendments) apples. 150 9000:2015, Quality management systems — Fundamentals and vocabulary 3. Terms and definitions For the purposes ofthis document, the terms and definitions given in 150 9000:2015 apply, 4 Context of the organization 4:1. Understanding the organization and its context ‘The organization shall determine external and internal issues that are relevant to its purpose and its strategic direction and that affect its ability to achieve the Intended result(s) ofits quality, management system. ‘The organization shall monitor and review information about these external and internal issues. NOTE Issues can include pose and negative factors or conditions fr consderaton. NOTE2 Understanding the ternal contest can be fclated by considering issues arising fom legal, ‘sahmolgia comput mast cultural tril and soonomisenireamant whether tartans nasoeal, gloat or focal. NOTE Understanding the itera context can be faiitated by considering sues related ovals, cle, Iuwlege and performance of he organisation. (6150 2015- legs reserve 4180 9001:2015(8) 42. Understanding the needs and expectations of interested parties Due to their effect or potential effect onthe organization’ ability to consistently prove products and services that meet customer and applicable statutory and regulatory requirements the organization shall determine 4) the terested parties that are relevant to the quality management system 1). the requirements ofthese interested parties that are relevant tothe quality management system ‘The organization shall monitor and review information about these intrested parties and their relevant requirements 4.3. Determining the scope of the quality management system ‘The organization shal determine the boundaries and applicability ofthe quality management system tovestablish ts scope When determining this scope, the organization shall consider: 28) the external and internal issues referred toin dls 1b) the requirements of relevant interested partes referred ton 4.2; ©) the products and servies ofthe organization. ‘The organization shall apply all the requirements of this International Standard ithey are applicable Within the determined scope of quality management system, ‘The scope ofthe organizations quality management system shall be avalable aud be maintained as documented information. The scope shall state the types of products and services covered, and provide justification for any requirement o ths International Standard thatthe organization determines te not Applicable to the scope of ts quality management system, Conformity to ths International Standard may only be calmed ifthe requirements determined as not ‘being applicable donot affect the organization’ ability ar responsibility to ensure the conformity of ts products and services andthe enhancement of customer satisfaction, 44 Quality management system and its processes 444 The organization shall establish, implement, maintain and continually improve a quality ‘management system, including the processes needed and their interactions, in accordance with the ‘requirements ofthis international Standard ‘The organization shall determine the processes needed for the quality management system and thelr application throughout the organization, and shall 4} determine the inputs required and the outputs expected from these processes, 1) determine the sequence and interaction ofthese processes; ©) determine and apply the criteria and methods (Including monitoring, measurements and related performance indicators) needed to ensure the effective operation and contrl of these processes: 4) determine the resources needed for these processes and ensure thelr avalabilty: ‘assign the responsibilities and authorities for these processes; 4) address the risks and opportunities as determined in accordance with the requirements of 6.1: £2) evaluate these processes and implement any changes needed to ensure that there processes achieve theirintended results; 2 (©1u 2015— Aras sera180 9001:2015(E) 1) improve the proceses and the quality management system, 442 Tothecextent necessary the organization shall 4) maintain documented information to support the operation ofits processes: 1b) retain documented information to have confidence thatthe processes are being carried out as planned, 5 Leadership 5. Leadership and commitment Sat Generat ‘Top management shall demonstrate leadership and commitment with respect to the quality management system by 28) taking accountability fr the effectiveness ofthe quality management system; b)_ ensuring thatthe quality policy and quality objectives are established forthe quality management ‘System and are compatible withthe context and strategic direction of the otgantation, ©) ensuring the integration ofthe quality management system requirements into the organization's business processes 4) promoting the use ofthe process approach and risk-based thinking ‘©) enduring thatthe resources needed forthe quality management system are avallable; 4) communicating the importance of effective quality management and of conforming to the quality ‘management system requirements; 12) ensuring thatthe quality management system achieves its intended results; 1) engaging, directing and supporting persons to contribute to the effectiveness of the quality ‘management system; 2) promoting improvement: 4) supporting other relevant management roles to demonstrate thelr leadership as applies to thelr areas of responsibility. NOTE Reference to “busines In this Internatlonal Standard can be interpreted broadly to mean those ‘eis tat are core tothe purpose ofthe rganiaton’venetence whether the organization's pli: priate, {or proficor oot for profi 5.2 Customer focus ‘Top management shall demonstrate leadership and commitment with respect to customer focus by ensuring that: 4) customer and applicable statutory and regulatory requirements are determined, understood and onsistenty met, 1). the risks and opportunities that can affect conformity of products and services and the ability to enhance customer satisfaction are determined and addressed; 6) thefocus on enhancing customer satisfaction is maintained. 6150 2015-leigsresered 3180 9001:2015(8) 52 Policy S21 Establishing the quality policy implement and maintain a qu “Top management shall esta ity policy that 8). is appropriate to the purpose and context ofthe organization and supports is strategic direction; 1b) provides framework or setting quallty objectives: 6) indudes a commitment to satisfy applicable requirements; 48) includes a commitment o continual improvement ofthe quality management system. 52.2 Communicating the quality polley The quality poliy shal: 5) be available and be maintained as documented information; 1) be communicated, understood and applied within the organization; ©) be available to relevantinterested parties, as appropriate 5.3. Organizational roles, responsibilities and authorities Top management shall ensure that the responsibilities and authorities fr relevant roles are assigned, ‘communicated and understood within the organization, ‘Top management shall assign the responsiblity and authority for 4) ensuring that the quality management system conforms to the requirements of this International Standards 1b) ensuring thatthe processes are delivering thelr intended outputs; 9. reporting on the performance of the quality management system and on opportinities for improvement (see 10.1, particular to top management, {8} ensuring the promotion of customer focus throughout the organieation; ©) ensuring thatthe integrity ofthe quality management system is maintained when changes tothe ‘quality management system are planned and implemented, 6 Planning 6.1 Actions toaddress risks and opportunities 6.4.1 When plaaning for the quality management sytem, the organization shall consider the Issues| ‘ferred to in 4.1 znd the requirements referred to In 4.2 and determine the risks and opportunities that ‘eed to be addressed to 8) give assurance tat the quality management system can achieve ltsntended result); 1b) enhance desirable effects; prevent, or reduce, undesired effects; 4) achleve improvement. A 1150 2015- legs reseved180 9001:2015(8) 6.41.2 The organization shal plan: 4) actions to address these risks and opportunities; 1b) how to: 1) integrate and implement the actions int its quality management system processes see 44); 2) evaluate the effectiveness of these actions. Actions taken to address risks and opportunites shall be proportionate to the potential impact onthe ‘conformity of products and services. NOTE1 Options to address risks can include avoiding ris, taking skin order to purse an opportunity, ‘Siminating fhe ik source, hanging the Wlihod ce consequences, sharing the Ma oF real ik By NOTE2 Opportunities can lead tothe adoption of new prsctiet, ching new products, opening new ownblies to addfes the organizations ors customers needs Hasan eniatanayenie 6.2. Quality objectives and planning to achieve them 62.1 The organization shall establish quality objectives at relevant functions levels and processes needed for the quality management system. ‘The quality objectives shal 8) be consistent with the quality policy: 1b) bemeasurable: 1) take nto account applicable requirements; 4) berelevant to conformity of products and services and to enhancement of customer satisfaction; ©) bemonitored: 1) be communicated; 2) beupdatedas appropriate ‘Tho organization shall maintain documented information onthe quality objectives 62.2 Whon planning how to achieve its quality objectives, the organization shall determine: 3) what willbe done; 1) what resources will be required: who will be responsible; 4) when iewill be completed; )how the results willbe evaluated 63. Planning of changes, ‘When the organization determines the need for changes tothe quality management system the changes halle caried out ina planned manne (ee 4.8). (21902015 Arghte reseed 5180.9001:2015(8) “The organization shall consider 2) the purpose ofthe changes and their potential consequences; 1) the integrity ofthe quality management system; ©) the availabilty of resources; 4) he allocation or reallocation of responsibilities and authorities. 7 Support 7A. Resources 74a General The organization shall determine and provide the resources needed for the establishment, Implementation, maintenance and continual improvement ofthe quality management sytem, ‘The organization shall consider 4) the capabilities of and constraint on existing internal resources; 1b) what needs tobe obtained from external providers 742. People ‘The organization shall determine and provide the persons necessary forthe effective implementation ofits quality management system and for the operation and contral ofits processes, 7A Infrastructure ‘The organization shall determine, provide and maintain the infrastructure necessary forthe operation ofits processes and to achieve conformity of products and services NOTE Infrastructure can incude: 2) bullaings nd associated wtlties 1) equipment including hardware and software 6) transportation resources, 4) aformation and communication technology 7.44 Environment forthe operation of processes ‘The organization shall determine, provide and maintain the environment necessary fr the operation ofits processes and to achieve conformity of products and services NOTE suitable environment can bea combination of human and physical factors, sch as 4) social eg non discriminatory calm non-confrontstional} 1) peycholopel (eg streseredicing burnout prevention, emotionally protective): 1) physical (ea temperature, eat, humidity ight slow, yiee, ois) ‘These factors can differ substantially depending onthe products ad services provide. ‘ 80 2015- Allis reserved180 9001:2015(6) 74.8 Monitoring and measuring resources 748.1 General ‘The organization shill determine and provide the resources needed to ensure vali and reliable results when monitoring or measuring Is used to verify the conformity of products and services ‘0 Fequirements. “The organization shal ensure thatthe resources provided: 4) aresuitable forth specific type of monitoring and measurement activities being undertaken; 1) are maintained tc ensure their continuing fitness for their purpose, “The organization shall retain appropriate documented information as evidence of fitness for purpose of ‘the monitoring and measurement resources 74.52 Measurement traceability ‘When measurement traceability isa requirement ors considered bythe organization tobe an essential part of providing confidence inthe validity of measurement results, measuring equipment shall be 8) calibratedor verted, or both, at specified intervals, or prior to use, against measurement standards traceable to intemational or natinal measurement standards; wen no sich standards eit the basis used for cabration or verification shall be retalned as documented information, 'b)_entiied in orde to determine ther status; 6) safeguarded from adjustments, damage or deterioration that would invalidate the calibration ‘Status and subsecuent measurement results ‘The organization shall determine ifthe validity of previous measurement results has been adversely aifected when meastring equipment Is found to be unfit for ks Intended purpose, and hall take appropriate action as necessary 74.6 Organizational knowledge “The organization shal determine the knowledge necessary forthe operation ofits processes and to achieve conformity ofproduets and services ‘This knowledge shall e maintained and be made available to the extent necessary, ‘When addressing changing needs and trends the organization shall consider its current knowledge land determine how toaequre or access any necessary additonal knowledge and required updates, NOTE1 Organizatoral knowledge is knowledge specific tothe organization; Ie is generally gained by ‘xperence Is information that iro ad shared to achieve the organization's objective NOTE2 Organizatorl knowiedge canbe based on: Internal sources (eg Intellectual property: knowledge gained from experience; lessons learned {rom ues and sccensal projec capturing and sharing undocumented knowledge anexperen: the results of Improvements in procetie products and serves 1b) external sources (e4, standards; seademia: conferences external providers). tering knowledge from customers or 161502015 Agha D180 9001:2015(8) 72 Competence ‘The organization shall: 43) determine the necessary competence of person(s) doing work under its control that affects the performance nd effectiveness ofthe qualty management syste: 1) ensure that these persons are competent on the basis of appropriate education, raining, or experience; ‘where appliccble, take actions to acquire the necessary competence, and evaluate the eectiveness ofthe actionstaken; 4) retain appropriate documented information as evidence of competence. NOTE Apple los can alae or example th provision of aning he mentoring other 73° Awareness “The organization shall ensure that persons doing work under the organization's control are aware of 8) the quality peiey; 1) relevant quality objectives; their contribution to the effectiveness ofthe quality management system, including the benefits of Improved performance 48) the implications of not conforming with the quality management system requirements 74. Communication ‘The organization shall determine the internal and external communications relevant tothe quality management system, including 3) onwhatit wil communicate; 1) when to communicate: ©) with whom tocommunicate; 4) howto communicate; 2) who communestes. 7.5 Documented information 7841 General ‘The organization’ quality management system shall include: 48) documented iformation required by this International Standard; 1) documented information determined by the organization as being necessary forthe efetiveness ‘ofthe quality management system, NOTE The extent of documented information for a qualty management system can difer from one rganzaion to anater du ta — the stae of orgartzation ants type of atvts, processes, products and services: ® (01502015 Aighersevd180 9001:2015(E) = the complsity of processes andthe interactions: = thecompetencea persons 75.2 Creating and updating ‘When ereating and updating documented information, the organization shall ensure appropriate: 2) entification and description (gail, date, author, or reference number} 1b) formate language, software version, graphics) and mei (e4. paper, electron): ty and adequacy. 9) review and approval fr suital 753. Controlof documented information 7.53.1. Documented information required by the quality management system and by tis International ‘Standara Shall be controlled to ensure: 8) ttisavallableand suitable for use, where and when it is needed; 1) tisadequately protected (eg rom los of confidentiality, improper use, oF loss of integrity) 753.2 For the control of documented information, the organization shall adress the following activities, as applicable: 8) distribution access, retrieval and use; 1) storage and preservation, incuding preservation of legibility: ©) control of changes (eg version control) «)_ retention and disposition. Documented information of external origin determined by the organization to be necessary forthe planning and operation ofthe quality management system shal be identified as appropriate, and be controlled Documented Information retained as evidence of conformity shall be protected from unintended alterations, NOTE Access can imply a decison regarding the permission to view the documented information only, or the permission and authority to view and change the dacumented informa, 8 Operation Operational planning and controt ‘The organization shall plan, implement and control the processes (eee 4.1} needed to mect the ‘requirements forthe provision of products and services, and to implement the ations determined in 4) determining the requirements for the products and services; 1) establishing eriteria for: 1) the processes; 2) the acceptance of products and services: determining the resources needed to achleve conformity tothe product and service requirements; (01502015 gered °180 9001:2015(E) 4) implementing control ofthe processesin accordance withthe criteria; 6) determining, maintaining and retaining documented information tothe extent necessary: 1) tohavecanfidence thatthe processes have been carried out as planned; 2), to demonstrate the conformity of products and services to thelr requirements ‘The output ofthisplanning shall be suitable forthe organization's operations ‘The organization shall control planned changes and review the consequences of unintended changes, taking Scion to mitigate any adverse effects, as necessary. ‘The organlzation shal ensue that outsourced processes are controlled (se 8.4). Requirements for products and services 82.1 Customer communication Communication with customers shall neude 28) providing information relating to products and services; 1)_handling enquiries, contracts or orders, including changes; 6) obtaining customer feedback relating to products and services, including customer complaints handling or controling customer property: «)_ establishing specific requirements for contingency actions, when relevant 82.2 Determining the requirements for products and services ‘When determining the requirements forthe products and services to be offered to customers, the ‘organization shallensure that 4) the requirements forthe products and servicesare defined including: 1) any ppliabl statutory and regulatory requirements; 2) those considered necesary by the organization 1) the onganizaton can meet the claims forthe products and services iter. 82.3 Review ofthe requirements for products and services 823.1 The orgenization shall ensure that thas the ability to mect the requirements for products and services tobe offered to customers. The organization shall conduct a review before commiting to supply Products and serves toa customer, to include: 3) requirements specified by the customer, Including the requirements for delivery and post: delivery activities; 2) reucement not stated by the astomer but necestry forthe speedo ended se, when {9 requirementsspecfied bythe organization; 4). statutory andregulatory requirements applicable tothe products and services; 6) contract or order requirements difering from those previously expressed 10 11502015 Aligned180 9001:2015(8) “The organization shall ensure that contrat oF order requirements difering fram those previously defined are resolved. ‘The customers requirements shall be confirmed by the organization before acceptarce, when the ‘customer doesnot provide a documented statement oftheir requirements, NOTE tn some situations such as intrne sales, a formal review is impractical fo each or Fevlew can cover relevant product Informatio, such as ctalogues Insts, the 823.2 The organization shall retain documented information as applicable: 4) onthe results ofthe review: 1) onany new requirements fr the products and services. 82.4 Changes to requirements for products and services The organization shall ensure that relevant documented information is amended, and that relevent persons are made aware of the changed requirements, when the requirements for 3roducte and Services ae changed. 83 Design and development of products and services, 83.1 General ‘The organization shall establish, implement and maintain 2 design and development process that is appropriate to ensure the subsequent provision of products and services, 83.2 Design and development planning In determining the stages and controls for desig and development, the organization shall consider: 3) the nature, duration and complexity ofthe design and development activites; 1b) the required process stages, including applicable design and development reviews; 9) therequired design and development verification and validation activities; 44) the responsibilities and authorities involved inthe design and development process; 19) the internal and external resource needs forthe design and development of products and services 4) theneed to contrl interfaces between persons involved in the design and development process 12) theneed for involvement of customers and user in the design and development process 1h) the requirements for subsequent provision of products and services; 1) the love of control expected for the design and development process by customers and other felevant interested parties, 1) the documented information needed to demonstrate that design and development -equirements have been met 83.3 Design and development inputs ‘The organization shall determine the requirements essential for the specific types of products and service tobe designed and developed. The organization shall consider: 8) functional and performance requirements; 11502015 Argh reservet at180 9001:2015(8) 1) information cerived from previous similar design and development activities, statutory and regulatory requirements; 4) standards orsodes of practice thatthe organization has committed to implement; (9) potential consequences of fallure due tothe nature ofthe products and services. Inputs shall be adequate for design and development purposes, complete and unambiguous, Conflicting design and development inputs shall be resolved “The organization shall retain documented information on design and development inputs 8.3.4 Design and development controls The organization shall apply controls to the design and development process to ensure that: 4) theresults tobe achieved are defined; 1) reviews are conducted to evaluate the ability of the results of design and development to meet requirements verification a:tvitis are conducted to ensure that the design and development outputs meet the inputrequirenents; 48) validation activities are conducted to ensure thatthe resulting products and services meet the ‘equlrementsfor the specified application or intended use; ©) any necessary actions are taken on problems determined during the reviews, or verlfkation and Validation acovitis: 1) documented information ofthese activities is retained NOTE Design snd development reviews, verification and valdation have distnet purposes. They can be ‘Sovctdseparatdy orn any combinations sutable forthe products and serves fhe erganieation, 83.5 Design and development outputs “The organization shall ensure that design and development outputs: 4) meet the input requirements; 1b) areaidequat or the subsequent processes forthe provision of products and services; 6) indudeor reference monitoringand measuring requirements, 2s appropriate, and acceptance citer 4). specity the characteristics ofthe productsand services thatare essential fr ther intended purpose 4nd mer safeand proper provision. “The organization shall retain documented information on design and development outputs, 83.6 Design and development changes ‘The organization shall dentify, review and control changes made during, oF subsequent to, the design and development af products and services, to the extent necessary to ensure tat there fg no adverse Impact on conformity to requirements “The organization shall retain documented information on: 8). design and development changes 1b) theresultsofreviews: 2 (©802015 ~All igen180 9001:2015(8) ©). the authorizationof the changes; 4) theactions takento prevent adverse impacts ‘84 Control of externally provided processes, products and services 841 General ‘The organization shall ensure that externally provided processes, products and services conform to requirements ‘The organization shal determine the controls tobe applied to externally provided processes, products and services when 2 roductsand series fom external proviersareimendedfrincorporaton tthe oganiations ‘own productsand services; 1) products and services are provided directly to the customer(s) by external providers on behalf of the organization ©) process, or part ofa proces, is provided by an external provider as a result ofa decision bythe ‘organization, ‘The organization shall determine and apply criteria for the evaluation, selection, monitoring of performance, and re-svaluation of external providers, based on their ablty to provide processes or products and services in accordance with requirements. The organization shal retain documented Information of these sctvities and ay necessary actions arising from th evaluations. 842. Typeand extent of control ‘The organization shall ensure that externally provided processes, products and services do not auversely affect the organizations ability to consistently deliver conforming products and services to “The organization shal 8) ensure that extemally provided processr¢ remain within the control ofits quality management ‘system; b)_ define both the controls thatit intends to apply tan external provider and those it intends to apply tothe resulting xtput ©) take into consideration: 1) the potential impact of the externally provided processes, products and services on the ‘organization’ ably fo consistently meet customer and applicable statutory and regulatory Fedjulrements 2) theeffectiveressof the control applied bythe external provider; 4) determine the verification, or other activites, necessary to ensure thatthe externally provided ‘processes, products and services meet requirements {842 Information fr external providers ‘The organization shall ensure the adequacy of requirements prior to their communication to the external provider, “The organization shall communicate to external providers its requirements fr: 8) the processes, products and services tobe provided: (61802015 rights rere 3180 9001:2015(E) 1) the approval of 1) productsand services; 2) methods, processes and equipment; 3) therelease of products and services; ©) competence, including any required qualification of persons; 4) theexternal providers interactions with the organization; ©) control and monitoring ofthe external providers’ performance tobe applied bythe organization; 1) verification o: validation activities thatthe organization, or its customer, intends to perform atthe external providers premises. 85 Productioa and service provision 85.1 Control of production and service provision “The organization shall implement production and service provision under controlled conditions. ‘Controlled conditions shall ince, as applicable: 4). theavallabity of documented information that defines: 1) the characteristics ofthe products to be produced, the services tobe provided, or the activities tobe perormed 2). the results tobe achieved: 1). theavailabltyand use of suitable monitoring and measuring resources; ©) the mplemortation of monitoring and measurement activities at appropriate stages toverify that trteria for contol of processes or outpat, and acceptance criteria for products an services. hhave been met; 4) these of suitable infrastructure and environment forthe operation of processes ©) the appointment of competent persons, including any required qualification; 1) the validation and periodic revalidation ofthe ability to achieve planned results ofthe processes for production and service provision, where the resulting output cannot be verified by subsequent ‘monitoring or measurement {8} the implementation of ations to prevent human error: 1) the implemensation of release delivery and post delivery activities, 852 Identification and traceability ‘The organization shall use suitable means to identify outputs when it is necessary to ensure the conformity of products and services. ‘The organization shall identify the status of outputs with respect to monitoring and measurement requirements thraghout production and servie provision. ‘The organization shall control the unique identification of the outputs when traceability fs a requirement, and shall rotain the documented information necessary to enable traceability. 4 ‘©puznisAtramsrsee1809001:2015(6) 85:3 Property belonging to customers or external providers ‘The organization shall exercise care with property belonging to customers or external providers while (tis under the organization's contol or being used bythe organization. The organlzation shall identity verify, protectand safeguard customers! or external providers property provided for use or incorporation into the products and services. When the property ofa customer or external provider Is lost, damaged or otherwise fornd to be Unsuitable for se, the organization shal report this to the customer or external provider and retain ‘documented information an what has occurred, NOTE Acustomersor external provider's property can include materials, components toalsand equipment, Promise, intalloctual property and personal data 5.4 Preservation ‘The organtzation shall preserve the outputs during production and service provision, tn the wstont necessary to ensure conformity to requirements NOTE Preservation can include identification, handling, contamination control, packaging. storage, {ransmision ortransportaton and protection SS. Postdelivery activities ‘The organization shall meet requirements for post-dalivery activities associated withthe products and services. In determining the extent of pst delivery activities that are requlred, the organization shall consider: 4) statutory ad regulatory requirements; »)_ the potential undesired consequences associated with ts products and services; ©) thenature, use and intended lifetime ofits products and services; 4) customer requirements 1) customer feedback NOTE __Postdinery activites can ncide actions under waranty provisions contractual bition such $rmsinteance servic. and sppiementaty seve suchas eying ial oper) “ 85.6 Control of changes The organization shall review and control changes for production or service provision, to the extent necessary to ensure continuing conformity with requirements “The organization shall retain documented information describing the results of the review of changes, ‘he person(s) authorizing the change, and any necessary action arising fom the review. 8.6. Release of products and services ‘The organization shall implement planned arrangements, at appropriate stages, to verify thatthe product and service requirements have been met “The release of products and services tothe customer shall not proceed until the planned arrangements have been satisfactorily completed, unless otherwise approved by 2 relevant authority and, as applicable, bythe customer (61802015 -Atrghs reserved 15180 9001:2015() ‘The organization shall retain documented information on the release of products and services. The documented information shall aude: 4} evidence of conformity withthe acceptance criteria; 1). traceability tothe persons) authorizing the release 8.7 Control of nonconforming outputs 87.1 The organization shall ensure that outputs that do not conform to thelr requirements are ‘dented and controlled to prevent thetr unintended use or delivery The organization shal take appropriate action based onthe nature ofthe nonconformity and its eect on the conformity of praducte and service. Tis shall also apply to nonconforming products and Services detected after delivery of products during o after the provision of servis ‘The organization shall deal with nonconforming outputs in one or more ofthe following ways: 2) correction: 1) segregation, containment, return or suspension of provision of products and services ©) forming the customer; 4) obtaining authorization fr acceptance under concession. Conformity to the requirements shall be verified when nonconforming outputs are corrected 18.7.2. The organization shall retain documented information that: 8), describes the nonconformity; 1) describes the actions taken; ©) describes any concessions obtained: 4). ‘enti the authority deciding the action In respect ofthe nonconformity. 9. Performance evaluation 9.1. Monitoring, measurement, analysis and evaluation 9.44 General The organization sh Aetermine: 8) what needs tobe monitored and measured: 1) the methods for monitoring, measurement, analysis and evaluation needed to ensure valid results 6) when the monitoring and measuring shall be performed; 4) when the results from monitoring and measurement shall be analysed and evaluated The organization shall evaluate the performance and the effectiveness ofthe quality management system. “The organization shall retain appropriate documented information a evidence ofthe results, 16 (01502015 Arighersoed180 9001:2015(8) 9.4.2 Customer satisfaction ‘The organization shall monitor customers’ perceptions of the degree to which their needs and expectations. have been fulfilled. The organization shall determine the methods for obtaining, ‘monitoring and reviewing ths information. NOTE Rramples of monitoring customer perceptions can include customer surveys, customer fedback fn delivered products and servic, mestings with customers, marketshare anal complies, Waray ‘aims and deste repos 9.4.3 Analysis andevaluation “The organization shall analyse and evaluate appropriate data and information arising from monitoring ‘and measurement. ‘The results of analysis shall be used to evaluate conformity of products and services: 1) the degree of customer satisfaction; 9) the performance and effectiveness of the quality management system; 4) Mfplanning has been implemented effectively, €)_thecffoctivenes factions taken to address risks and opportunities; 1). the prformanceof external providers; £8) theneed for improvements tothe quality ma agement system, NOTE Methods toanalyse data can Include statistical techniques, 92. Internal audit, 9.2.4. The organization shall conduct internal audits at planned interval to provide information on whether the quality management system: 3) conforms: 1) the organlzaton’s own requirements forts quality management system: 2). the requirements of this international Standa 1b). seoctively implemented and maintained 92.2. The organization shal 43) plan establish, implement and maintain an audit programme() including the Frequency, methods, Fesponsiblites, planning requirements and reporting, which shall take into consideration the Importance of Uw processes concerned, changes affecting the organization, and the results of previous audits; 1b) define the audit itera and scope foreach ait; 6) selectauditors and conduct audit to ensure objectivity and the impartiality ofthe audit process 44) ensure that the results of the audits are reported to relevant management; {take appropriate sorrection and corrective actions without undue delay; (61502015 Alrghsceaet ain documented information as evidence of the implementation of the audit programme andthe sud results NOTE See1S019011 for guidance 9.3 Management review 93.1 General ‘Top management shall review the organization's quality management system, at planned Intervals, to censure its continuing suitability, adequay, effectiveness and alignment with the strategie direction of ‘the organtzation. 93.2 Management review inputs ‘The management review shall be planned and carried out taking into consideration: 4) thestatus of actions from previous management reviews 1) changes in external and internal issues that are relevant othe quality management system, {9 information on the performance and efectiveness of the quality management system, including trendsin: 1) customer satisfaction and feedback from relevant interested parties; 2). theextent to which quality objectives have been met 3) process performance and conformity of products and services; 4) nonconformitis and corrective actions; 5) monitoring and measurement results; 6) audit results 17). the performance of external providers 4). the adequacy of resources; ©) the effectiveness of actions taken to address risks and opportunities (eee 6); 1) opportunities fr improvement 93:3 Management review outputs ‘The outputs ofthe management review shall include decisions and actions related to 8) opportunities for improvement: 1) any need for changes tothe quality management system; 6) resource needs. ‘The organization shall retain documented information as evidence othe results ofmanagement reviews 19 (0150 2015- Ags reseed180 9001:2015(8) 10 Improvement 10.1 General ‘The organization shall determine and select opportunities for improvement and implement any ‘necessary actions to meet customer requirements and enkance customer satistacton ‘These sh 48) improving products and services to mect requirements as well as to adres future needs and ‘expectations Include: 1) correcting prevesting or reducing undesired effects; ‘)_emproving the performance and effectiveness of the quality management system. NOTE Examples of Improvement can include correction, corective action, continual improvement ‘reslthraggh chang, novation and re-organisation 10.2 Nonconformity and corrective action 4102.1 When a noneanformity occurs, including any arising fom complaints, the organization shall: 4) reactto the noncenformity and, as applicable 1) take action te control and correct 2) deal with theconsequences: ')_ evaluate the nedfor action to eliminate the cause() ofthe nonconformiy, inorder that it des nat ‘recur oF occur elsewhere, by 1) reviewingand analysing the nonconformity: 2). determining the causes ofthe nonconformity: 2) determining similar nonconformitis exis, o could potentially occur, ©) implement any ation needed; 48) review the effectiveness of any corrective action taken ©) update risks and opportunities determined during planning. fnecessary; {) make changes tothe quality management system, necessary Corrective actions shllbe appropriate tothe effects of the nonconformities encountered 1022 The organization shall retain documented informations evidence of 4) thenature ofthe nonconformities and any subsequent actions taken; 1) the results of any corrective action, 10.3 Continual improvement “The organization shall continually improve the suitability, adequacy and effectiveness ofthe quality management system, (61802015~ Anghecenet 19180 9001:2015(8) ‘The organization shall consider the results of analysis and evaluation, and the outputs from ‘management reviey, co determine i there are needs or opportunities tht shall be addressed as part continual improverient. fat 121502015 -Alrehtsetred180 9001:2015(E) Annex A (informative) Clarification of new structure, terminology and concepts AA Structure and terminology ‘The clause structure (Le. clause sequence) and some of the terminology of this edition of this International Standard, in comparison with the previous edition (IS0 $001:2008), have been changed toimprove alignment with other management systems standards There {sno requirement inthis International Standard for is structure and terminology tobe applied to the documented information ofan organizations quality management system, The structure of clauses is intended to provide a coherent presentation of requirements, rather than a ‘model for documenting an organization's policies, objectives and processes. The structure and content ‘of documented information related toa quality management system can often be more relevant tits Users If relates to both the processes operated by the organization and information maintained for ‘other purposes. ‘Theres no requirement forthe terms used by an organization to be replaced bythe terms used in this International Standard to specity quality management system requirements. Organizations can choose to se terme which sut their operations (eg using “records”, “documentation” or “protocols” rather than “documented information’ or “supplier “partner” of "vendor" rather than “external provider”). ‘ale Al shows the major differences in terminology between this edition of this International ‘Standard and th previous edition, ‘Table A-1— Major differences n terminology between 1S0.9001:2008 and 160 9001:2015 150 9001:2008 15090012015 [Products Products and services exclusions Not used (Soe Clause A. fr clarification of applicability) [Management representative [Not usea (Sirlarresponsiilitesand authorities areassigned| bbutno requirement ora single management repre sentative) Documentation, quality manal, documented pro-|Decumented information | Jeodures records Work environment [Environment forthe operation of processes Monitoring.and measuring equipment [Monitoring and measuring resources Purchased product [eternally provided products and services Supplier External provider A2 Products and services 1509001-2008 used the term “product to include al output categories. This edition of this International Standard uses "products and service Produets and service” incide al output categories (hardware, Services, software and processed material) 16150 2015s reserved a180 9001:2015(6) The specific inclusion of "services" is intended to highlight the differences between products and Services in the application of some requirements. The characteristic of services is that at least part of the output is realized a the interface with the customer. This means, for example, that conformity £9 Fequirements cannot necessarily be confirmed before service delivery. In most cases, products and services are used together. Most outputs that organizations provide to fustomers, or are supplied to them by external providers, include both products and services. For trample, a tangible or intangible product ean have some associated service ora sevice can have some assoclated tangible or intangible product. A3 Understanding the needs and expectations of interested parties Subclause 4.2 specifies requirements for the organization to determine the Interested parties that are relevant to the quality management system and the requirements of those interested parties, However, £2 does not imply extension of quality management system requirements beyond the scope ofthis International Standard. As stated inthe Scope, tis International Standard is applicable where an organization needs to demonstrate its ability to consistently provide products and services that ‘meet customer and applicable statutory and regulatory requirements, and ame to enhance customer satisfaction. ‘There is no requirement in this International Standard for the organization to consider interested parties where thas decided that those parties ae not relevant tits quality management system. eis for the organization to decide ifa particular roquirement ofa relevant intoresod party Is relevant tits ‘quality management system. AA Risk-based thinking ‘The concept of risk based thinking ha been implicit in previous editions ofths International Standard, eg, through requirements for planning, review and improvement. This International Standard ‘Specifies requirements forthe organization to understand ts context (see 41) and determine risks as bass for planning (see 6.) This represents the application of risk-based ‘hinking to planning and Implementing quality management system processes (ee 4.4) and will asistn determining the extent ‘of documented information ‘One ofthe key purposes ofa quality management system isto act as a preventive tool. Consequently, this International Standard does not havea separate clause oF subeause a preventive action. The concept of preventive action is expressed through the use of risk-based thinking in formulating quality ‘management system requirements ‘The riskbased thinking applied in this International Standard has enabled some reduction in prescriptive requirements and their replacement by performance-based requirements. Tere s greater flexbiity than in ISO 9001-2008 in the requirements for processes, documented information and organizational responsiblts. ‘Although 6.1 specifies thatthe organization shall plan actions to address risks, thee sno requirement for formal methods for risk management or a documented risk management proces. Organteations can decide whether or not to develop a more extensive risk management methodslogy than s required by this Inernational Standard, eg through the application of other guidance or tandards, Not all the processes ofa quality management system represent the same level of risk in terms ofthe ‘organization's ability to meet its objectives, and the effects of uncertainty are not the same forall ‘organizations, Under the requirements off. the organization is responsible or ts aplication of isk based thinking and the actions itakes to address risk, including whether or aot to retain documented Information as evidence of ts determination of sks. 2 (2150 2015~A righ rset