Before 4: clauses 1 to 3 are not audited
Scope, references and definitions. They are the standard's cover page. Nobody will ask you for evidence of them. The system starts at 4.
4 · Context of the organization
Who you are, who you work for and how far your system reaches. The standard asks you to identify the external and internal issues that affect you, the interested parties and what they expect from you, and to define the scope: which products, processes and sites are in.
External issue: the price of imported aluminium. Interested party: the construction companies that buy 60% of production and demand on-time delivery. Scope: design, manufacture and installation of blinds and curtains at the Pereira plant. That “design” in the scope is an important decision; we cover it in the ISO 9001 guide.
5 · Leadership
Top management must be inside, not just sign at the end. The clause requires a policy (a short statement of what the company commits to), assigned roles and responsibilities, and evidence that management is accountable for the system. The auditor interviews the manager; if they do not know what is being discussed, it shows.
The quality policy fits in six lines and the manager can explain it without reading: deliver on time, measure returns per installation and lower them every year. The quality lead role belongs to the head of production, with time allocated.
6 · Planning
What can go wrong, what you want to achieve and how you will change things. This is where risks and opportunities live, measurable objectives with their plan and, in the security and AI standards, risk treatment and the Statement of Applicability.
Risk: a single supplier of technical fabric. Treatment: qualify a second supplier before June. Objective: returns per installation from 4% to 2% in twelve months, measured monthly by the head of production.
7 · Support
What the system needs to work: resources, people's competence, awareness, communication and documented information. Clause 7.5 governs documents: how they are created, approved, controlled and protected. It is the clause that produces the most findings in SMEs, almost always because of old versions in circulation.
Competence: the cutting operator has a training record on the new cutter. Documents: the cutting procedure is at version 3, approved by the head of production on 12 February, and the two printed copies of version 1 that were on the shop floor were removed. That removal was, literally, the closure of a rehearsal nonconformity.
8 · Operation
The real work: planning and controlling the processes that produce what you sell. It is the longest clause and the only one where a standard allows excluding requirements that do not apply, with written justification. Almost every implementation gets lost here, because it is where documents must match what happens on the shop floor.
Operation is quoting, designing the made-to-measure blind, buying the fabric, cutting, assembling, installing and handling the warranty. Each step has a record: the production order, the pre-dispatch inspection, the installation report signed by the customer.
9 · Performance evaluation
Measure, audit and review. Indicators with data, at least one internal audit per cycle and a management review where management looks at the results and decides. Without this clause the system does not know whether it works.
Indicator: on-time deliveries, 91% last quarter. Internal audit: done by TAoI as a rehearsal, leaving five findings. Management review: a two-hour meeting with minutes, where qualifying the second supplier was approved.
10 · Improvement
What you do when something goes wrong: the nonconformity, its immediate correction, the root cause and the corrective action so it does not happen again. And continual improvement, which is not a slogan but the evidence that indicators change over time.
An installation returned because of wrong measurements. Correction: reinstall. Root cause: the salesperson took measurements without a form. Corrective action: measurement form with double check and training for the sales team. Three months later, zero returns due to measurements.
And on top of the skeleton, each standard's catalogue
What changes between standards is what goes on top: ISO 9001 adds the process approach and customer satisfaction; ISO 27001, the 93 Annex A controls and the Statement of Applicability; ISO 27701, the controller and processor roles; ISO 42001, the AI system impact assessment. That is why documenting the skeleton once saves so much time when the second standard arrives.