Skill: wroadd/iso9001-qms (version 1.0.0)

--- name: iso9001-qms description: ISO 9001:2015 Quality Management System implementation, internal audit, and CAPA management. Use when implementing a QMS from scratch, conducting gap assessment against ISO 9001:2015 clauses 4–10, planning or executing internal audits, managing nonconformities, or running CAPA investigations (5-Why, fishbone, root cause analysis, effectiveness verification). Suitable for any industry — manufacturing, services, energy, construction. --- # ISO 9001:2015 QMS — Implementation, Audit & CAPA Complete toolkit for ISO 9001:2015 Quality Management System work: gap assessment, implementation roadmap, internal audit checklists, and CAPA management. --- ## Contents 1. [Clause Structure Quick Reference](#1-clause-structure-quick-reference) 2. [Required Documents & Records](#2-required-documents--records) 3. [Implementation Roadmap](#3-implementation-roadmap) 4. [Gap Assessment Workflow](#4-gap-assessment-workflow) 5. [Internal Audit — Clause Checklists](#5-internal-audit--clause-checklists) 6. [Nonconformity Classification](#6-nonconformity-classification) 7. [CAPA Investigation Workflow](#7-capa-investigation-workflow) 8. [Root Cause Analysis Methods](#8-root-cause-analysis-methods) 9. [CAPA Action Planning & Effectiveness](#9-capa-action-planning--effectiveness) 10. [CAPA Metrics](#10-capa-metrics) --- ## 1. Clause Structure Quick Reference | Clause | Title | Core Requirement | |--------|-------|-----------------| | 4 | Context of the Organization | Understand internal/external issues, interested parties, define scope | | 5 | Leadership | Top management commitment, quality policy, roles and responsibilities | | 6 | Planning | Risks and opportunities, quality objectives, change planning | | 7 | Support | Resources, competence, awareness, communication, documented info | | 8 | Operation | Process planning, design control, supplier management, production/service delivery | | 9 | Performance Evaluation | Monitoring, customer satisfaction, internal audit, management review | | 10 | Improvement | Nonconformity, corrective action, continual improvement | --- ## 2. Required Documents & Records ### Mandatory documented information (must exist) - Quality policy (5.2) - Quality objectives (6.2) - Scope of the QMS (4.3) - Process interactions map (4.4) - Risk and opportunity register (6.1) ### Mandatory records (must be kept) - Competence/training records (7.2) - Monitoring and measurement results (9.1) - Internal audit program and results (9.2) - Management review outputs (9.3) - Nonconformity and corrective action records (10.2) - Customer feedback / complaint records (9.1.2) ### Recommended (not mandatory but auditors expect them) - Customer satisfaction survey method - Supplier evaluation records - Design and development records (if clause 8.3 applies) - Equipment calibration records (if measuring equipment used) --- ## 3. Implementation Roadmap ### Phase 1 — Foundation (Months 1–3) 1. Secure leadership commitment (clause 5) 2. Define organizational context and interested parties (clause 4.1–4.2) 3. Define QMS scope (clause 4.3) 4. Conduct gap assessment against all clauses (see Section 4) 5. Build implementation project plan ### Phase 2 — Development (Months 4–6) 1. Write quality policy and objectives 2. Map and document core processes (clause 4.4, 8.1) 3. Conduct risk and opportunity assessment (clause 6.1) 4. Create or update procedures and work instructions 5. Set up document control system (clause 7.5) 6. Train staff on QMS requirements ### Phase 3 — Implementation (Months 7–9) 1. Deploy processes and start collecting records 2. Conduct first internal audits (clause 9.2) 3. Issue nonconformities and initiate CAPAs 4. Hold first management review (clause 9.3) ### Phase 4 — Certification (Months 10–12) 1. Full internal audit cycle complete 2. All major CAPAs closed or in verification 3. Stage 1 audit (document review by certification body) 4. Stage 2 audit (on-site certification audit) 5. Address any findings → certificate issued --- ## 4. Gap Assessment Workflow For each clause below, rate current state: **✅ Compliant / ⚠️ Partial / ❌ Missing** ``` CLAUSE 4 — Context [ ] 4.1 Internal and external issues identified and documented [ ] 4.2 Interested parties and their requirements defined [ ] 4.3 QMS scope defined and documented [ ] 4.4 Processes and their interactions mapped CLAUSE 5 — Leadership [ ] 5.1 Top management demonstrates commitment (actions, not just words) [ ] 5.2 Quality policy documented, communicated, understood [ ] 5.3 Roles and responsibilities assigned and communicated CLAUSE 6 — Planning [ ] 6.1 Risks and opportunities identified and addressed [ ] 6.2 Quality objectives set, measurable, monitored [ ] 6.3 Process in place for managing planned changes CLAUSE 7 — Support [ ] 7.1 Resources (people, infrastructure, environment) adequate [ ] 7.2 Competence defined and verified for all roles [ ] 7.3 Staff aware of quality policy and their contribution [ ] 7.4 Internal and external communication defined [ ] 7.5 Document control process in place (create, update, distribute, retain) CLAUSE 8 — Operation [ ] 8.1 Operational processes planned and controlled [ ] 8.2 Customer requirements determined and reviewed [ ] 8.3 Design and development process (if applicable) [ ] 8.4 External providers (suppliers) evaluated and monitored [ ] 8.5 Production/service delivery controlled; identification and traceability CLAUSE 9 — Performance Evaluation [ ] 9.1 Monitoring and measurement methods defined and used [ ] 9.1.2 Customer satisfaction measured [ ] 9.2 Internal audit program planned and executed [ ] 9.3 Management review conducted with defined inputs/outputs CLAUSE 10 — Improvement [ ] 10.1 Improvement opportunities identified [ ] 10.2 Nonconformity and corrective action process in place [ ] 10.3 Continual improvement demonstrated over time ``` **Prioritize gaps:** Any ❌ in clauses 5, 9, or 10 = high risk for certification failure. --- ## 5. Internal Audit — Clause Checklists Use during internal audits. For each item, record: **Compliant / Minor NC / Major NC / OFI** (Opportunity for Improvement). ### Clause 4 — Context - Is the organizational context documented and kept up to date? - Are interested parties and their relevant requirements identified? - Is the QMS scope clearly defined? Does it reflect actual activities? - Are all processes and their sequence and interaction defined? ### Clause 5 — Leadership - Can top management demonstrate active involvement in the QMS? - Is the quality policy available, communicated, and understood by staff? - Are quality roles, responsibilities and authorities clearly assigned? - Do staff know how their work affects product/service quality? ### Clause 6 — Planning - Is there a documented risk and opportunity register? - Are quality objectives measurable and monitored? Are results reviewed? - Is there a process to plan and implement changes in a controlled way? ### Clause 7 — Support - Are sufficient resources provided for QMS operation? - Is competence defined for each role affecting quality? Are records maintained? - Is awareness of the quality policy verified (e.g. through training)? - Are communication methods defined (who, what, when, how)? - Is document control working: approval, versioning, obsolete doc handling? ### Clause 8 — Operation - Are customer requirements reviewed before accepting orders? - Are purchasing/supplier controls appropriate to risk? - Are products/services identified and traceable throughout delivery? - Is customer property identified and protected? - Are post-delivery activities (warranty, feedback) controlled? ### Clause 9 — Performance Evaluation - Is customer satisfaction measured? Are results used for improvement? - Is the internal audit program risk-based and covers all clauses over time? - Are audit findings documented? Are CAPAs opened for NCs? - Does management review include all required inputs? Are outputs actioned? ### Clause 10 — Improvement - Are nonconformities recorded and corrective actions taken? - Is root cause analysis conducted for significant NCs? - Are CAPA actions verified for effectiveness? - Is there evidence of continual improvement over time? --- ## 6. Nonconformity Classification | Classification | Definition | CAPA Required | |---------------|------------|---------------| | **Major NC** | Absence of a required system element, or complete failure of it | Yes — within 30 days | | **Minor NC** | Single lapse or partial implementation of a requirement | Recommended | | **OFI** | No requirement breached, but improvement is possible | No | **Major NC examples:** - No internal audit program exists - Quality policy not communicated to staff - No documented process for handling customer complaints - Corrective actions never verified for effectiveness **Minor NC examples:** - Audit schedule exists but one area not audited in cycle - Training records incomplete for two employees - Document revision history missing from one procedure --- ## 7. CAPA Investigation Workflow 1. Document trigger event with objective evidence 2. Classify severity (Major / Minor) — see Section 6 3. Determine if CAPA is required — see trigger table below 4. Form investigation team (proportional to severity) 5. Collect evidence (records, interviews, observations) 6. Select RCA method and identify root cause — see Section 8 7. Validate root cause: if eliminated, would problem recur? 8. Develop actions — see Section 9 9. Implement and verify effectiveness ### CAPA Trigger Decision Table | Source | CAPA Required | Criteria | |--------|--------------|----------| | Customer complaint | Yes | Any complaint affecting quality or safety | | Internal audit — Major NC | Yes | Always | | Internal audit — Minor NC | Recommended | If systemic pattern suspected | | Nonconformance — recurring | Yes | Same type occurring 3+ times | | Nonconformance — isolated | Evaluate | Based on severity and risk | | External audit finding | Yes | All Major and Minor findings | | Management review output | Evaluate | Based on significance | --- ## 8. Root Cause Analysis Methods ### Method Selection ``` Is it a safety or system reliability issue? ├── Yes → Fault Tree Analysis └── No → Is human error the primary suspect? ├── Yes → Human Factors Analysis └── No → How many contributing factors? ├── 1–2 (linear) → 5 Why Analysis ├── 3–6 (complex) → Fishbone Diagram └── Unknown / proactive → FMEA ``` ### 5 Why Template ``` PROBLEM: [Specific, measurable statement] WHY 1: Why did [problem] occur? BECAUSE: [First cause] EVIDENCE: [Data] WHY 2: Why did [first cause] occur? BECAUSE: [Second cause] EVIDENCE: [Data] WHY 3: Why did [second cause] occur? BECAUSE: [Third cause] EVIDENCE: [Data] WHY 4: Why did [third cause] occur? BECAUSE: [Fourth cause] EVIDENCE: [Data] WHY 5: Why did [fourth cause] occur? BECAUSE: [ROOT CAUSE] EVIDENCE: [Data] ``` **Root cause validation checklist:** - [ ] Supported by objective evidence - [ ] If eliminated, problem would not recur - [ ] Within organizational control - [ ] Explains all observed symptoms ### Fishbone — 6M Categories | Category | Focus | |----------|-------| | Man (People) | Training, competency, workload, awareness | | Machine (Equipment) | Calibration, maintenance, capacity | | Method (Process) | Procedures, work instructions, controls | | Material | Specifications, supplier quality, storage | | Measurement | Instrument accuracy, methods, interpretation | | Mother Nature | Environment: temperature, humidity, cleanliness | --- ## 9. CAPA Action Planning & Effectiveness ### Action Types | Type | Purpose | Typical Timeframe | |------|---------|-------------------| | Containment | Stop immediate impact | 24–72 hours | | Correction | Fix this specific occurrence | 1–2 weeks | | Corrective | Eliminate root cause | 30–90 days | | Preventive | Prevent in similar processes | 60–120 days | ### Action Plan Template ``` CAPA Ref: [CAPA-YYYY-NNN] Root Cause: [Statement] ACTION 1: [Description] - Type: [ ] Containment [ ] Correction [ ] Corrective [ ] Preventive - Owner: [Name] - Due: [YYYY-MM-DD] - Success Criteria: [Measurable outcome] - Verification Method: [How it will be checked] ``` ### Effectiveness Verification | CAPA Severity | Wait Before Verifying | Verification Window | |--------------|----------------------|---------------------| | Major | 30 days | 30–90 days post-implementation | | Minor | 60 days | 60–180 days post-implementation | **Effectiveness decision:** ``` Did the problem recur during verification period? ├── Yes → CAPA INEFFECTIVE → Re-investigate root cause └── No → Were all success criteria met? ├── Yes → CAPA EFFECTIVE → Close └── No → Gap significant? ├── Minor → Extend verification or accept with justification └── Major → CAPA INEFFECTIVE → Revise actions ``` --- ## 10. CAPA Metrics Track these KPIs for management review: | Metric | Target | Calculation | |--------|--------|-------------| | Average cycle time | < 60 days | (Close date − Open date) / # CAPAs | | Overdue rate | < 10% | Overdue / Total open | | First-time effectiveness | > 90% | Effective on 1st verification / Total verified | | Recurrence rate | < 5% | Recurred issues / Total closed | ### CAPA Aging Categories | Age | Status | Action | |-----|--------|--------| | 0–30 days | On track | Monitor | | 31–60 days | Monitor | Review for delays | | 61–90 days | Warning | Escalate to management | | > 90 days | Critical | Management intervention | --- *Based on ISO 9001:2015 standard requirements. CAPA methodology adapted from ISO 13485 audit practices (RCA methods are universal across QMS frameworks).*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)