ISO 9001 Auditing Practices Group
Guidance on:
 
Context
 
In order for an organization to have an effective quality management system (QMS), the
QMS should be aligned with its strategic direction and take into account the internal and
external issues that are relevant, when planning to achieve its objectives.
 
For the purpose of effective planning the organization needs to understand:

·

its status,
what it wants to achieve, and
its strategy on how to achieve it.

 
(If you don’t know clearly your starting point for your journey it will be difficult to achieve the
desired destination.) 
Auditors need to evaluate whether the organization has addressed these issues.

 
1.
Understanding the organisation and its context

 
There are many ways and supporting techniques for organizations to observe and analyse
their context. The output from this activity should be evident in the determined risks and
opportunities. Although there is no requirement for documented information in this section
(ISO 9001:2015, clause 4.1), most organisations will find it useful to retain documented
information to help understand the rationale and level of understanding of their challenges
(e.g. “known knowns, known unknowns and unknown unknowns”).
 
The information which might be helpful in this process could include:

Business plan
Review of strategy plans
Competitor analysis
Economic reports from business sectors
SWOT analysis
Minutes of Meetings
Action lists
Diagrams, Spreadsheets, Mind mapping diagrams
External consultant’s reports

 
The auditor should approach this area through an interview with members of the
organization’s top management. It should be evident whether top management have
adequately considered their organization’s context; the evidence of this may be adequately
demonstrated by showing how the review outputs became the inputs into the QMS planning
process (risk based thinking). However, in exploring the nature of the risks and
 

 
opportunities, the auditor should be able to understand the adequacy of the organization’s
review of its context.

2.
Understanding the needs and expectations of interested parties

Auditors should understand and evaluate the way an organization decides on the
requirements of interested parties which are relevant for the QMS by considering:

the range of interested parties taken into account,
criteria to select relevant interested parties,
aspects to select relevant requirements.

 
Auditors should be able to conclude on the appropriateness of these practices and the way
this information is reviewed and monitored, such as through management reviews.
 
Examples of relevant interested parties are given in ISO 9000:2015, definition 3.2.3, and
clarification related to these requirements is provided in ISO 9001:2015, Annex A, clause
A.3.
 
The relevant requirements of those relevant interested parties should be evident as inputs
into the planning process, as potential risks and opportunities. Again, although there is no
requirement to retain documented information, it would be expected that an organisation
would keep some account of its analysis for ongoing and future reference. This could be
expressed, for example, as:

Minutes of meetings
Tables
Spreadsheets
Databases
Hyperlinks
External documentation
Quality manual (if organization decides to have one)
Etc.

 
Auditors should conduct this review in an interview with top management and follow these
issues throughout the audit. If documented information is not provided, auditors need to
collect objective evidence that the outputs of this activity are consistently reflected in the
review of risks and opportunities, external documentation, communication and other relevant
areas of their QM.

 
3.
Determining the scope of the quality management system

 
The scope of the QMS in many cases is self-evident and defined by the activities taking
place at a single location. The scope of the QMS will become more challenging in
circumstances where there is:

outsourcing
logistics
multiple sites
service centres
servicing at customer premises
collaborative products and services

 
From a review of the nature of the organisation’s operations, products and services, the
extent of the QMS should be clear. This should be expressed in the extent of processes and
controls which the organisation has established.
 

4.
Quality Management system and its processes

 
The extent (scope) of the QMS should be evident in the documented information supporting
the process approach. Such documentation could include:

process diagrams (input – process – output)
diagrams showing process linkages (inputs / outputs / customer)
overlays showing the locations of activities
identification of outsourced processes
resource diagrams (e.g. capacity analysis, value stream mapping, “Lean”…. )
programmes