How to Design an ISO 9001:2015 QMS Documentation Pack That Survives an Audit
What the standard actually requires, how to structure your documentation hierarchy, and the naming conventions that keep a QMS in control - updated for Amendment 1:2024 and the upcoming 2026 revision.
Building an ISO 9001:2015 QMS documentation pack correctly is one of the most important steps in any certification programme. Most organizations stack named procedures, call them a QMS, and discover at Stage 1 that they've produced a system of documents rather than a documented system. ISO 9001:2015 is explicit about the difference - and auditors find it immediately.
This guide sets out the architecture, mandatory documented information, document hierarchy, naming convention, and core templates you need to build a pack that works in practice and holds up under scrutiny. Where ISO's own published guidance makes a point clearly, I'll quote it. Where practical experience fills the gaps, I'll say so.
Two time-sensitive notes before we start: ISO published Amendment 1:2024 adding explicit climate-change consideration text into the common management system structure (Clauses 4.1 and 4.2). Separately, a revised ISO 9001 edition is in development with publication expected around September 2026. Both are addressed at the end of this guide.
What ISO 9001:2015 Actually Requires
To understand this, the 2015 revision reduced prescriptive mandatory procedures and replaced "documents and records" with documented information. Maintained information is kept current - what used to be called a document. Retained information is kept as evidence - what used to be called a record. That distinction shapes how your pack is built.
In fact, ISO's implementation guidance puts it plainly: ISO 9001 requires a documented QMS, not a system of documents. You can read ISO's guidance on documented information directly on their site. The amount of documentation varies with organizational size, complexity, and competence. There is no prescribed list of mandatory procedure titles. There is, however, a specific list of what must be maintained and retained as objective evidence.
What Must Be Maintained
- QMS scope (Clause 4.3)
- Quality policy (Clause 5.2)
- Quality objectives (Clause 6.2)
- Documented information to support operation and provide confidence processes are carried out as planned (Clause 4.4 - extent is organization-determined)
What Must Be Retained as Records
- Evidence of competence (7.2)
- Calibration/verification evidence where applicable (7.1.5)
- Customer requirements review results (8.2.3)
- Design and development evidence where applicable (8.3)
- Supplier evaluation and re-evaluation (8.4.1)
- Traceability evidence where required (8.5.2)
- Nonconformance handling (8.7)
- Internal audit results (9.2.2)
- Management review outputs (9.3.3)
- Corrective action evidence (10.2.2)
- Release and acceptance records (8.6)
Risk-Based Thinking and Documented Information
On risk-based thinking and documentation: ISO does not prescribe one specific way to document risks and opportunities. Organizations decide what documented information is needed as objective evidence. A risk register is valuable - it is not mandatory. What is mandatory is evidence that risk-based thinking was applied.
ISO 9001:2015 Mandatory vs Recommended Documents
With that established, the table below maps what the standard requires against what experience shows typically earns its place in a real QMS pack. The "when recommended becomes necessary" column is where judgement calls get made.
| Category | Mandatory documented information | Clause | Practical additions that typically add value |
|---|---|---|---|
| QMS top layer | QMS scope; quality policy; quality objectives | 4.3, 5.2, 6.2 | Quality Manual (optional — useful for multi-site, rapid onboarding); QMS process map; context and interested parties register |
| Process definition | Documented info sufficient to support operation and evidence processes carried out as planned | 4.4 | Process maps; turtle diagrams; procedures; work instructions; checklists. Extent scales with process risk and complexity. |
| Competence | Evidence of competence | 7.2 | Competency matrix; training plans; authorization logs. Evidence must match role criticality — inspection vs admin roles need different depth. |
| Calibration | Evidence of fitness for purpose of measurement resources; basis when no standards exist | 7.1.5 | Calibration program register; equipment list. Only required when measuring equipment is used to verify conformity. |
| Customer requirements | Results of review of requirements and new requirements | 8.2.3 | Contract review checklist; quotation sign-off form. Often the best evidence of customer focus under audit. |
| Nonconformance | Nature of nonconformities; actions taken; concession authority | 8.7 | NCR form; concession request form. Needs clear linkage to corrective action when systemic patterns emerge. |
| Internal audit | Audit program implemented; audit results | 9.2.2 | Annual audit calendar; process-based checklists; auditor competency log. Frequency is risk-based — the standard sets no fixed interval. |
| Management review | Evidence of management reviews and results | 9.3.3 | Agenda template; action log; input pack. Format is not specified — minutes are common but not required. |
| Corrective action | Nature of NC; actions taken; results and effectiveness | 10.2.2 | CAPA form with RCA method; effectiveness check template. Audited heavily — needs clear closure evidence. |
| Climate change (Amd 1:2024) | Determine whether climate change is a relevant issue; note if interested parties have climate-related requirements | 4.1, 4.2 | Climate relevance note in context register; climate-related risks in the R&O register. Not a new procedure — but must be demonstrably considered. |
ISO 9001:2015 Documentation Hierarchy
However, a robust QMS pack is significantly easier to build, maintain, and audit when structured as a clear hierarchy. ISO guidance explicitly lists examples of documents that can add value — organization charts, process maps, procedures, work instructions, forms — while noting none are specifically required. Structure them so each level answers a different question — as a result, the QMS becomes easier to navigate for both staff and auditors.
Quality policy, QMS scope statement, quality objectives register. Optionally: a Quality Manual or documented summary that maps processes to clauses. Why we do what we do and what we commit to.
Process architecture maps showing interactions; procedures that define who does what, when, with what controls and what records result. How our processes work.
Detailed how-to instructions for specific tasks. Checklists, acceptance criteria, inspection points. Add these where they genuinely reduce risk and variation - not as a completeness exercise. How we do specific tasks.
Blank forms (maintained) that when completed become records (retained). NCR reports, CAPA forms, release checklists, competence assessments, audit reports. That we did what we said we'd do.
Controlled as external documented information, tracked in a register, and updated whenever the source changes. What we must comply with beyond our own system.
