ISO 9001:2015 clause 8: Operation

• Evidence the operational processes are PLANNED - the requirements for the products/services determined, acceptance criteria set, and resources for conformity identified (8.1 a-c).
• Evidence the processes are CONTROLLED to the criteria, with the documented information needed to run them and to demonstrate conformity (8.1 d-e).
• Process control plans/quality plans for the key product/service lines, tying requirements to controls.
• Evidence planned changes are controlled and the consequences of unintended changes reviewed/mitigated.
• Evidence outsourced processes are controlled within this operational planning (link to 8.4).

• Minor NC: Operational processes are not planned - no defined requirements, acceptance criteria, or controls, so conformity cannot be assured or demonstrated.
• Minor NC: Acceptance criteria for processes and outputs are not established.
• Minor NC: The documented information needed to have confidence the processes ran as planned is not retained.
• Observation: Changes to operations are made without control, and unintended changes are not reviewed.

Review quality plans or process control plans for 2 key products/services. Verify criteria, resources, and controls are defined and followed.

• How do you plan and control the processes needed to deliver your products and services?
• Walk me through how you manage unintended changes to your operational processes.
• How do you ensure outsourced processes are controlled to the same standard as internal ones?

• Product specifications
• Customer requirements documents
• Regulatory requirements list

• Requirements not defined
• Unclear specifications
• Missing regulatory requirements

Select 2-3 recent orders/projects. Verify requirements were determined and documented before work started.

• How are product and service requirements determined before production or service delivery begins?
• How do you handle conflicting requirements from customers, regulations, and internal standards?

• Process specifications
• Acceptance criteria documentation
• Quality standards

• No process criteria
• No acceptance criteria
• Vague or undefined standards

Review process control documentation for a critical process. Verify measurable criteria exist for both the process and the output.

• What process criteria (parameters, settings, conditions) are established for your key processes?
• How are acceptance criteria for products and services defined, and who approves them?

• Resource planning documents
• Capacity planning
• Equipment lists

• Resources not determined
• Insufficient resources
• No resource planning

Review resource allocation for 2 recent production orders. Verify people, equipment, and materials were planned and available.

• How do you determine what resources are needed for each production run or service delivery?
• What happens when required resources are not available at the planned time?

• Process control records
• Monitoring data
• Control charts

• Processes not controlled
• No monitoring
• Criteria not followed

Observe a key process in operation. Verify that controls match documented criteria and operators follow procedures.

• How do you verify that processes are being controlled according to defined criteria during execution?
• What monitoring or in-process checks are performed?

• Process documentation
• Production records
• Inspection records
• Test records

• No documented information
• Records incomplete
• Cannot demonstrate conformity

Review batch records or service delivery records for 2-3 recent jobs. Verify they provide confidence that processes were executed as planned.

• What records do you maintain to demonstrate that processes were carried out as planned?
• How do you determine the extent of documentation needed for each process?

• Evidence customer communication covers product/service information, enquiries/contracts/orders (including changes), and obtaining customer feedback including complaints (the core 8.2.1 elements).
• Evidence it covers handling/controlling customer property where applicable.
• Evidence it establishes specific requirements for contingency actions where relevant (e.g. recall, business continuity).
• Communication/CRM records and complaint-handling records showing the processes actually run.
• A check that customer enquiries and orders are acknowledged and changes are captured, not lost.

• Minor NC: There is no defined process for handling customer complaints or feedback, so the voice of the customer is not captured.
• Minor NC: Customer enquiries/orders are not acknowledged or order changes are not captured, causing disputes.
• Minor NC: Handling of customer property is not addressed in customer communication where it applies.
• Observation: Contingency-action requirements are not established with customers where the product/service warrants it.

Review customer communication logs for 3 recent interactions. Verify all five communication elements (a-e) are addressed.

• Walk me through your process for communicating with customers from inquiry through delivery.
• How do you handle customer complaints and ensure they are resolved satisfactorily?
• What contingency communication plans exist for service disruptions?

• Product catalogs and brochures
• Technical data sheets
• User manuals and instructions
• Website product information
• Safety data sheets (if applicable)
• Warranty documentation
• Terms and conditions

• No product information available to customers
• Inaccurate or misleading product information
• Missing technical specifications
• No safety information provided when needed

Review product literature, website content, or catalogs. Verify information matches current specifications.

• How do you provide product/service information to prospective and existing customers?
• How do you ensure product information is accurate and current?

• Inquiry response records
• Quotation records
• Order acknowledgments
• Contract review records
• Order change documentation
• CRM system records

• Customer inquiries not responded to
• Orders accepted without acknowledgment
• No process for order changes
• Contract/order changes not communicated

Trace 2-3 recent orders from inquiry through acknowledgment. Verify changes were documented and communicated.

• How do you process customer inquiries, quotes, orders, and order changes?
• What is your turnaround time for responding to customer inquiries?

• Customer feedback mechanisms
• Complaint handling procedure and records
• Customer satisfaction survey process
• Feedback analysis reports
• Complaint resolution records

• No complaint handling process
• Customer feedback not sought or used
• Complaints not documented or tracked
• No analysis of customer feedback

Review customer satisfaction survey results and complaint logs from the past 6 months. Verify feedback is analyzed and acted upon.

• What methods do you use to obtain customer feedback beyond complaint handling?
• How is customer feedback data analyzed and used for improvement?

• Customer property handling procedure
• Customer property registers and tracking
• Communication records about customer property
• Damage or loss notification records

• Customer property not controlled or protected
• Loss or damage to customer property unreported
• No identification of customer property
• Customer property mixed with organization's property

If applicable, inspect customer property storage/handling. Verify identification, protection, and tracking records.

• What types of customer property do you handle, and how is each type protected?
• Can you show me your process for reporting loss or damage of customer property?

• Contingency plans and procedures
• Emergency customer notification procedures
• Business continuity communication plans
• Recall procedures with customer notification

• No contingency communication plans
• Customers not notified of disruptions
• No emergency contact procedures
• Service interruptions without customer communication

Review business continuity or contingency plans. Verify customer communication is addressed for disruption scenarios.

• What contingency actions have you established for situations that could affect customers?
• How are customers notified when contingency plans are activated?

• The defined product/service requirements - specifications, terms, and the list of applicable statutory and regulatory requirements - showing requirements are determined BEFORE the organization offers the product/service, not after problems arise.
• Evidence statutory/regulatory requirements specific to the product are identified (safety, labeling, environmental, import/export, data protection) - not just a generic 'we comply with applicable laws' statement.
• Evidence the organization can MEET the claims it makes - capability/capacity analysis or feasibility checks behind marketing and catalog claims.
• Accuracy of public claims - marketing materials, catalogs, and SLAs checked against what the organization can actually deliver, so claims are not overstated.
• For changed or new offerings, evidence requirements were re-determined rather than assumed from a previous product.

• Minor NC: Applicable statutory/regulatory requirements for the product/service are not identified, so the organization cannot demonstrate it determined them.
• Minor NC: Marketing or catalog claims are made that the organization cannot substantiate or consistently meet.
• Minor NC: Requirements are not defined before the product/service is offered, so commitments are made without knowing what must be met.
• Observation: Capability to meet a new offering's requirements is assumed rather than verified, risking commitments beyond capacity.

Review requirement specifications for 3 recent orders. Verify statutory, regulatory, and organizational requirements are included beyond customer-stated needs.

• How do you ensure all requirements for products and services are fully defined before committing to deliver?
• What happens when customer requirements conflict with statutory/regulatory requirements?

• Product/service specifications
• List of applicable statutory and regulatory requirements
• Regulatory compliance documentation
• Design specifications
• Internal quality standards

• Requirements not defined before offering products/services
• Regulatory requirements not identified
• Product specifications incomplete
• Organizational standards not documented

Review contract review records for evidence that unstated but necessary requirements were identified (e.g., packaging, labeling, safety).

• How do you capture requirements that the customer has not explicitly stated but that are necessary for intended use?
• Who is responsible for identifying implied requirements?

• Feasibility assessments
• Capability and capacity analysis
• Marketing materials (verified accurate)
• Resource planning documentation
• Technical capability assessments

• Marketing claims that cannot be met
• Accepting orders beyond capability
• No verification of ability to deliver
• Commitments made without checking feasibility

Check the regulatory requirements register. Verify it is current and matches applicable regulations for sampled products/services.

• What statutory and regulatory requirements apply to your products/services, and how do you stay current?
• How do you identify requirements that you set for yourself beyond customer and legal requirements?

• The contract/order-review procedure and a sample of review records - verify a review actually happens BEFORE the organization commits to an order, covering customer-stated requirements, implied/intended-use requirements, the organization's own requirements, and applicable statutory/regulatory requirements.
• Evidence the organization confirmed it can MEET the requirements before accepting - capacity, capability, lead-time, and any special-process checks - not just logged the order.
• Resolution of differences - records showing where an order differed from the quotation or prior understanding, the difference was identified and resolved with the customer before proceeding.
• Confirmation of requirements where the customer gives no documented statement (e.g. verbal/phone orders) - evidence the requirements were confirmed back before acceptance.
• For catalog/web sales where a per-order review is impractical, the product information made available to customers in lieu of an individual review.

• Major NC: Orders are accepted and worked without any review of requirements or feasibility, leading to commitments the organization cannot meet.
• Minor NC: Differences between the quotation and the final order are not identified or resolved, so the organization and customer proceed on different understandings.
• Minor NC: Statutory/regulatory requirements are not considered in the review - only customer-stated ones.
• Observation: Verbal orders are accepted without confirming the requirements back to the customer in a retrievable form.

Review contract review records for 3 recent orders of varying complexity. Verify all applicable checks were performed and documented.

• Walk me through your contract review process — what checks are performed before accepting an order?
• How do you resolve differences between quoted and ordered requirements?
• What records do you retain from the review process?

• Customer purchase orders reviewed
• Delivery requirements documented
• Post-delivery activity agreements
• Customer specification review records

• Customer requirements not documented
• Delivery requirements unclear or missing
• Post-delivery obligations not understood

Check 2-3 orders for evidence of capacity/capability review before acceptance, including delivery timeline feasibility.

• How do you verify your ability to meet delivery and post-delivery requirements before accepting an order?
• Have you ever had to decline an order because you couldn't meet the requirements?

• Review records showing unstated requirements identified
• Intended use analysis
• Industry standard requirements identified
• Safety requirements documentation

• Implicit requirements not considered
• Fitness for purpose not evaluated
• Industry norms ignored

Review 2-3 orders where customer requirements were clarified. Verify the clarification was documented and confirmed.

• How do you ensure requirements specified by the customer are clearly understood and documented?
• What happens when customer requirements are ambiguous or incomplete?

• Internal quality standards applied
• Organizational requirements documented in review
• Standard terms and conditions
• Quality specifications used

• Internal standards not applied to orders
• Organizational requirements inconsistent
• No documentation of organizational requirements

Look for orders where requirements changed between quote and order stage. Verify differences were identified and resolved.

• When requirements differ from those previously expressed (e.g., quote vs. order), how are differences resolved?
• Can you show me an example where a discrepancy was identified and resolved?

• Regulatory requirements checklist
• Compliance verification records
• Applicable standards identified
• Regulatory certification status

• Regulatory requirements not considered
• Non-compliant products accepted
• Legal requirements unknown

Verify that contract review records for 2-3 orders include confirmation that statutory and regulatory requirements were addressed.

• What applicable statutory and regulatory requirements are verified during contract review?
• How do you ensure regulatory requirements are checked for every order, not just new products?

• Quotation vs. order comparison
• Resolution of differences documented
• Change documentation
• Customer confirmation of resolution

• Differences between quote and order not identified
• Unresolved requirements differences
• Changes not communicated internally

If applicable, review a case where a new or modified product/service was requested. Verify how requirements were established.

• How are requirements for products/services not previously defined handled during review?
• What process exists for establishing new product/service specifications?

• Evidence that when product/service requirements change, the relevant documented information is AMENDED - updated specs, work orders, or job tickets reflecting the change.
• Evidence the affected PEOPLE are made aware of the changed requirements (acknowledgments, communications, re-briefing).
• A change-control mechanism (ECOs, change notices) tying the requirement change to the documents and people it affects.
• A check that production/service is not still running to the old requirements after a change.
• Approval of the change before it takes effect.

• Minor NC: Documentation is not amended when requirements change, so production runs to outdated specifications.
• Minor NC: Affected personnel are not informed of changed requirements, causing nonconformities.
• Observation: There is no controlled mechanism linking a requirement change to the documents and people it affects.
• Observation: Customer complaints trace to changes that were agreed but never implemented.

Review 2-3 order amendments or change orders. Verify documented information was amended and relevant persons were made aware.

• How do you handle changes to customer requirements after an order has been accepted?
• How do you ensure all affected parties are notified of requirement changes?

• The QMS scope (4.3) - confirm whether design is included or excluded; if excluded, verify the justification is real (the organization builds only to customer or established designs) and not a way to dodge design controls it actually performs.
• The design-and-development procedure or process description - verify it is appropriate to the organization's products/services (a software house and a machine shop need different rigor) and covers planning through to release (8.3.2-8.3.6).
• Design plans for actual projects - confirm the process is used in practice, with stages, reviews, and responsibilities defined per project, not just a procedure on the shelf.
• Design project records across the full lifecycle - inputs, outputs, reviews, verification, validation, and changes - showing the defined process was followed end to end on real work.
• Evidence design controls scale with risk and complexity - a simple modification and a novel product show appropriately different levels of control.

• Major NC: The organization performs design (configuring, developing, or adapting products/services) but has excluded design from its QMS scope, so design is uncontrolled.
• Minor NC: Design activities happen but there is no defined design process, so each project is handled ad hoc with inconsistent rigor.
• Minor NC: A design procedure exists but is not appropriate to the products/services - either far heavier than needed, or too light for the risk involved.
• Observation: The design process is documented but project records show it is not actually followed (missing reviews, no verification/validation evidence).

Review the design and development procedure. Select 1-2 recent design projects and trace through the full process.

• Describe your design and development process from concept through release.
• How do you ensure the design process is appropriate for the complexity and risk of the product/service?
• If design and development is excluded, what is the justification?

• The design plans for actual projects - verify planning accounts for the nature, duration, and complexity of the design work, and the required process stages and reviews.
• Evidence planning defines the required verification and validation activities and the responsibilities and authorities involved.
• Evidence planning addresses internal/external resource needs and the control of interfaces between the people involved (handoffs).
• Consideration of the customer/user involvement and the level of control interested parties expect over the design.
• Identification of the documented information needed to demonstrate design requirements were met.

• Minor NC: Design projects are not planned, so stages, reviews, responsibilities, and resources are handled ad hoc.
• Minor NC: Interfaces between the people/functions involved in design are not controlled, so handoffs fail.
• Observation: Verification and validation activities are not planned up front, leading to gaps late in the project.
• Observation: Resource needs for the design are not planned, causing schedule or quality pressure.

Review design plans for 2 recent projects. Verify all elements (a-j) are addressed proportionate to complexity.

• How do you plan design and development activities for a new product or service?
• What factors determine the stages, reviews, and controls needed for a design project?

• Design project plan addressing complexity
• Risk assessment for design complexity
• Resource allocation based on project nature
• Timeline appropriate to complexity

• One-size-fits-all design process
• No consideration of project complexity
• Unrealistic timelines for complex designs

Compare design plans for a simple vs. complex project. Verify the level of planning is proportionate to risk.

• How do you define the nature, duration, and complexity of design activities?
• How does complexity assessment influence the level of control applied?

• Design process flow with defined stages
• Stage-gate criteria
• Design review schedule
• Phase completion checklists

• No defined design stages
• Skipping design reviews
• Unclear stage transitions

Review a design project timeline. Verify required reviews and verifications were planned and scheduled.

• What design stages are defined, and what gates or reviews occur between stages?
• How do you decide what reviews are needed at each stage?

• Verification and validation plan
• Test protocols planned at design start
• V&V resource allocation
• Acceptance criteria defined early

• V&V not planned upfront
• Verification or validation omitted
• Inadequate V&V resources

Check design V&V plans and records for 1-2 projects. Verify both verification and validation were planned and conducted.

• What verification and validation activities are required for your designs?
• How do you distinguish between verification (meets spec) and validation (meets use)?

• Design team organization chart
• RACI matrix for design activities
• Approval authority matrix
• Design responsibility assignments

• Unclear design responsibilities
• No designated design authority
• Approval confusion

Review project organization charts or responsibility matrices for 1-2 design projects.

• What are the defined responsibilities and authorities within the design team?
• How do you handle design decisions when team members disagree?

• Design resource plan
• Budget allocation for design
• External resource contracts
• Capacity planning for design team

• Under-resourced design projects
• No external resource planning
• Budget constraints impacting quality

Review resource allocations for a recent design project. Verify needed expertise was identified and provided.

• What internal and external resources are typically needed for design projects?
• How do you manage external design partners or consultants?

• Interface management plan
• Communication protocols
• Handoff checklists
• Cross-functional meeting records

• Poor communication between design groups
• No interface management
• Design handoff problems

For a design involving multiple teams, review how interfaces were managed (e.g., design review meetings, shared documents).

• How do you manage interfaces between different design team members or departments?
• What communication mechanisms ensure design information flows correctly between parties?

• Customer involvement plan
• Voice of customer inputs
• Customer design review participation
• User testing records

• No customer input to design
• Design isolated from end users
• Customer feedback ignored

Review evidence of customer/user involvement in 1-2 design projects (e.g., requirements workshops, prototype reviews, user testing).

• How do you involve customers and users in the design process?
• At what stages do you seek customer input or feedback on designs?

• Design for manufacturing reviews
• Serviceability requirements in design
• Production input to design
• DFM/DFA analysis

• Design without production input
• Manufacturing issues from poor design
• Service problems due to design

Check design reviews for consideration of manufacturability, serviceability, and post-delivery requirements.

• What requirements apply to subsequent production and service provision that must be considered during design?
• How do you ensure designs are producible and serviceable?

• Customer design control requirements
• Regulatory submission plan
• Customer approval points defined
• Third-party review schedule

• Customer control requirements not addressed
• Regulatory oversight missed
• Insufficient customer communication

Review contracts for customer-specified design control requirements. Verify these are reflected in design plans.

• What level of control is expected by customers and relevant interested parties over the design process?
• How do you accommodate customer design review requirements?

• Design documentation plan
• Design history file template
• Document requirements matrix
• Records to be maintained list

• No documentation planning
• Incomplete design records
• Documentation created after the fact

Review the design history file for a recently completed project. Verify it contains evidence that all requirements were met.

• What documented information do you retain to demonstrate design requirements have been met?
• How do you ensure the design file is complete before release?

• The documented design inputs for actual projects - verify they capture functional and performance requirements, applicable statutory/regulatory requirements, relevant standards/codes, and the consequences of failure appropriate to the product.
• Evidence inputs draw on information from previous similar designs - lessons learned, failure history, reusable elements - so the organization is not repeating past mistakes.
• Review/approval of the inputs before design proceeds - confirming they are complete, unambiguous, and agreed, not a moving target.
• Resolution of conflicting inputs - records showing where requirements clashed (e.g. cost vs performance, two standards) the conflict was identified and resolved before design work continued.
• Traceability from inputs forward into outputs and verification, so each input can be shown to have been addressed.

• Major NC: Applicable statutory/regulatory requirements are not captured as design inputs, so a compliance gap is designed in from the start.
• Minor NC: Design inputs are incomplete or ambiguous, leaving key requirements to be interpreted during design.
• Minor NC: Conflicting inputs are not identified or resolved before design proceeds.
• Observation: Inputs do not draw on lessons from previous similar designs, so known failure modes recur.

Review design input documents for 2 projects. Verify all five categories (a-e) are addressed and inputs are adequate.

• How do you ensure all necessary design inputs are identified and documented before design work begins?
• How do you resolve conflicting or ambiguous design inputs?

• Functional requirements specification
• Performance requirements document
• Technical specifications
• Customer technical requirements

• Vague functional requirements
• No measurable performance criteria
• Missing critical functions

Trace customer requirements through to design input specifications. Verify nothing was lost in translation.

• How do you translate customer needs into functional and performance requirements?
• How do you validate that design inputs accurately capture what the customer needs?

• Lessons learned from previous designs
• Reference to similar product designs
• Historical problem analysis
• Design reuse documentation

• Repeating past design mistakes
• Not leveraging previous experience
• No lessons learned review

Verify design inputs include applicable regulations (e.g., safety standards, environmental requirements). Cross-check against regulatory register.

• What statutory and regulatory requirements apply to your product designs?
• How do you stay current with changing regulations that affect design?

• Regulatory requirements checklist
• Applicable standards list
• Compliance matrix
• Regulatory affairs input

• Regulatory requirements missed
• Non-compliance discovered late
• No regulatory input to design

Check design inputs for reference to applicable standards. Verify the correct versions are cited.

• How do you leverage standards and codes of practice as design inputs?
• Which industry standards are routinely applied to your designs?

• Applicable standards list
• Customer-specified standards
• Industry code compliance
• Certification requirements

• Committed standards not in design inputs
• Standard compliance gaps
• Certification requirements missed

Look for evidence that lessons learned, warranty data, or field failure information were considered as design inputs.

• How do you capture lessons learned from previous similar designs?
• What mechanisms exist to feed failure data from existing products back into new designs?

• Failure modes and effects analysis (FMEA)
• Risk assessment for design
• Safety-critical requirements identification
• Design for reliability

• No failure consequence analysis
• Safety-critical functions not identified
• Inadequate safety margins

Review risk assessments or FMEAs associated with design projects. Verify consequences of failure were considered in design inputs.

• What are the potential consequences of failure for this design, and how are they addressed?
• Do you perform risk assessments (e.g., FMEA) as part of design input?

• Design-review records at the planned stages - verify reviews evaluate the design's ability to meet requirements, include the right cross-functional participants, and capture actions, not just a sign-off.
• Design-verification records - evidence the outputs were checked against the inputs ('did we build it right?') by analysis, test, or comparison, with traceability from each input to its verification.
• Design-validation records - evidence the resulting product/service meets the intended use ('did we build the right thing?'), validated under actual or simulated use conditions before full release.
• Records of actions taken on problems found during review, verification, or validation - showing issues were resolved and re-checked, not noted and ignored.
• The retained documented information of all these activities, demonstrating control over the design before it was released.

• Major NC: A product/service was released without design validation, so there is no evidence it meets the intended use - a common source of field failures.
• Minor NC: Verification and validation are conflated or one is missing; the organization checks the design against inputs but never confirms fitness for intended use (or vice versa).
• Minor NC: Design reviews are sign-offs with no evidence of genuine evaluation, cross-functional input, or resulting actions.
• Observation: Problems identified during review/verification/validation are recorded but their resolution and re-check are not evidenced.

Review design review, verification, and validation records for 1-2 projects. Verify each type of control was conducted at appropriate stages.

• What controls are applied during the design process to ensure outputs meet inputs?
• How are design reviews, verification, and validation distinguished and conducted?

• Design objectives documentation
• Success criteria definition
• Deliverables list
• Target specifications

• Undefined design goals
• No success criteria
• Unclear deliverables

Check that expected results were defined before V&V activities were conducted. Verify criteria were established in advance.

• What results are defined as required outcomes for design reviews, verification, and validation?
• How do you determine pass/fail criteria for design verification tests?

• Design review meeting records
• Review checklists
• Action items from reviews
• Participants and signatures

• No formal design reviews
• Reviews without action follow-up
• Key stakeholders missing from reviews

Review attendance records for 2-3 design reviews. Verify appropriate functions were represented (e.g., quality, manufacturing, customer).

• Who participates in design reviews, and how are participants selected?
• How do you ensure review participants have the right expertise?

• Design verification reports
• Test reports showing input compliance
• Requirements traceability matrix
• Verification test protocols and results

• No design verification
• Verification gaps
• Input requirements not traced to verification

Review verification records showing that outputs were checked against each input requirement. Look for traceability matrices.

• How do you verify that design outputs meet design input requirements?
• What verification methods do you use (analysis, testing, comparison to proven designs)?

• Design validation reports
• User acceptance testing results
• Field trial results
• Validation protocol and results

• No design validation
• Validation not representative of use
• User testing not performed

Review validation records (e.g., user acceptance testing, field trials, customer approval). Verify validation conditions represent intended use.

• How do you validate that the final design meets the needs of the intended use?
• Under what conditions is validation performed (e.g., simulated vs. actual use)?

• Design problem resolution records
• Action items tracking and closure
• Corrective actions for design issues
• Re-verification/re-validation records

• Design problems not addressed
• Actions not tracked to closure
• Repeated design issues

Review action items from 2-3 design reviews. Verify all were addressed and closed before proceeding to the next stage.

• How are actions from design reviews tracked to closure?
• Can you show me an example of a problem identified during design review and how it was resolved?

• Design history file
• Design review records
• V&V documentation
• Complete design record retention

• Missing design records
• Incomplete documentation
• Records not retained properly

Verify design review minutes, V&V records, and action logs are retained per the retention policy.

• What documented information is retained from design controls?
• How long are design records retained?

• The design outputs for actual projects - specifications, drawings, BOMs, process specs - verify each output requirement traces back to a design input (no input left unaddressed, no unexplained output).
• Evidence outputs are adequate for the downstream processes - enough detail for production/service provision to be carried out without re-interpreting the design.
• Acceptance criteria in or referenced by the outputs - so production and inspection know what 'good' looks like.
• Specification of the characteristics essential for the product's intended purpose and its safe and proper provision (critical-to-quality or safety characteristics flagged).
• Approval of outputs before release to production/service, confirming they were checked against inputs.

• Major NC: Design outputs do not specify the characteristics essential for safe and proper use, so safety-critical features are not controlled downstream.
• Minor NC: Outputs do not reference acceptance criteria, leaving production and inspection without a pass/fail basis.
• Minor NC: Outputs cannot be traced back to inputs, so it cannot be confirmed all input requirements were met.
• Observation: Outputs lack the detail the downstream processes need, forcing production to interpret the design.

Review design output packages for 1-2 products. Verify they contain all elements needed for production (drawings, specs, test methods, acceptance criteria).

• How do you ensure design outputs are in a form suitable for subsequent production and service operations?
• What approval process applies before design outputs are released?

• Requirements traceability matrix
• Design verification showing input compliance
• Design review confirming requirements met
• Design output specification vs. input comparison

• Outputs don't address all inputs
• No traceability
• Unverified requirements

Check a design traceability matrix or equivalent. Verify each input requirement maps to a specific output element.

• How do you demonstrate that design outputs meet design input requirements?
• Is there a traceability matrix linking inputs to outputs?

• Manufacturing readiness review
• Process specifications
• Bill of materials
• Production documentation package

• Design outputs insufficient for production
• Manufacturing issues due to incomplete design
• Missing specifications

Show design outputs to a production team member. Verify they contain sufficient information for production without ambiguity.

• How do design outputs specify what is needed for production and service provision?
• Are production and inspection personnel able to work from the design outputs as provided?

• Inspection and test plan
• Acceptance criteria specifications
• Quality control plan
• Measurement requirements

• No acceptance criteria defined
• Unclear inspection requirements
• Missing measurement specifications

Review inspection and test plans derived from design outputs. Verify acceptance criteria are clear and measurable.

• How do design outputs reference or include monitoring and measuring requirements?
• Where are acceptance criteria specified in the design output package?

• Critical characteristics list
• Safety-critical feature identification
• Key product characteristics
• Special requirements documentation

• Critical characteristics not identified
• Safety features not specified
• Essential features unclear

Review critical-to-quality or critical-to-safety characteristics identified in design outputs. Verify they flow into production controls.

• How do design outputs specify characteristics essential for safe and proper use?
• What characteristics are identified as critical or safety-related?

• Design-change records (ECOs/change notices) - verify changes are identified, reviewed, and controlled, with the change and its authorization recorded.
• Impact assessment for design changes - evidence the effect on conformity and on already-delivered product was considered before the change.
• Verification/validation of the change as needed, so the change itself does not introduce a new defect.
• Updated design documentation reflecting the change, controlled per 7.5.
• Records of the actions arising from the change.

• Major NC: Design changes are made without review or control, risking conformity and affecting product already in production or the field.
• Minor NC: No impact assessment before a design change, so downstream consequences are not caught.
• Minor NC: Design changes are not recorded or authorized.
• Observation: Changes are not verified/validated, so the change introduces new issues.

Review 3-5 recent design change records. Verify impact assessment, review, approval, and communication to affected parties.

• How are design changes identified, reviewed, and controlled?
• Who has authority to approve design changes, and what reviews are required?
• How do you assess the impact of a design change on already-delivered products?

• The purchasing/supplier-control procedure and approved-supplier list - verify suppliers of products, services, and outsourced processes that affect conformity are selected against defined criteria, not just whoever is cheapest or incumbent.
• Initial evaluation/approval records for a sample of suppliers - showing each was assessed for capability before use (audit, certification, sample approval, history).
• Ongoing performance monitoring - scorecards or metrics (quality, on-time delivery, responsiveness) showing suppliers are tracked over time, with re-evaluation at defined intervals.
• Action records where a supplier underperformed - corrective-action requests to the supplier, escalation, or removal from the approved list - showing monitoring has teeth.
• Evidence outsourced processes are controlled as part of the QMS (not treated as someone else's problem), with the organization retaining responsibility for conformity.

• Major NC: Suppliers of critical products/services or outsourced processes are used with no evaluation or controls, and quality problems are traceable to them.
• Minor NC: An approved-supplier list exists but suppliers are never re-evaluated, so approval is a one-time event regardless of subsequent performance.
• Minor NC: Supplier performance is not monitored, so recurring supplier issues go unaddressed.
• Observation: Outsourced processes are excluded from QMS control on the assumption the supplier's own system is sufficient, with no verification.

Review the approved supplier list and evaluation records for 3-5 suppliers. Verify initial evaluation and ongoing monitoring.

• How do you evaluate, select, and monitor external providers?
• What criteria distinguish an approved supplier from a non-approved one?
• How often do you re-evaluate supplier performance?

• Approved supplier list for incorporated items
• Incoming inspection procedures
• Component specifications
• Supplier quality data

• Incorporated materials not from approved suppliers
• No incoming verification of critical components
• Supplier quality not monitored

Review controls for 1-2 outsourced processes. Verify they are defined, implemented, and monitored.

• How do you control externally provided processes that are performed under your control (e.g., on-site contractors)?
• What oversight do you maintain over outsourced processes?

• Service level agreements with providers
• Customer feedback on provider performance
• Provider performance monitoring
• Quality requirements for direct-to-customer services

• No oversight of direct-to-customer providers
• Customer complaints about external providers unaddressed
• Provider performance not monitored

Review incoming inspection records for 3-5 recent deliveries. Verify acceptance criteria and inspection results are recorded.

• How do you ensure purchased products and services meet your requirements before use?
• What incoming inspection or verification is performed?

• Outsourced process agreements
• Process specifications provided to outsource provider
• Verification of outsourced process outputs
• Outsource provider audits or assessments

• Outsourced processes not controlled
• No specifications provided to outsource provider
• Outputs not verified
• Organization unaware of outsourced process quality

If applicable, review how customer-directed suppliers are managed. Verify quality controls are maintained.

• When a customer specifies a particular external provider, how do you ensure quality requirements are still met?
• What controls apply to customer-directed suppliers?

• Evidence the level of control is risk-based - a documented basis (supplier risk tiering, criticality of the item) showing critical/high-impact supplies get tighter control than low-risk commodities.
• For critical external provision, the specific controls defined - on the PROVIDER (audits, certification, quality agreements) AND on the OUTPUT (incoming inspection, source inspection, certificates of conformity, first-article).
• Incoming-verification records for critical items - showing the defined verification is actually performed, not waived under schedule pressure.
• Consideration of the provider's own capability and controls when setting the level of verification - e.g. reduced inspection justified by a proven, certified supplier.
• Evidence the controls are reviewed when a supplier's performance or the item's risk changes.

• Major NC: A critical externally provided item with direct product or safety impact receives no verification, relying entirely on the supplier.
• Minor NC: All suppliers are controlled identically regardless of risk, so effort is wasted on trivial supplies and critical ones are under-controlled.
• Minor NC: Controls on the provider are defined (e.g. must be certified) but no controls on the resulting output (no incoming check), or the reverse.
• Observation: The basis for the chosen level of control is not documented, so verification intensity appears arbitrary.

Compare controls applied to critical vs. non-critical suppliers. Verify the level of control is risk-based.

• What type and extent of controls do you apply to external providers?
• How do you determine the appropriate level of control for different types of suppliers?

• Outsourced processes included in QMS
• Process controls defined for outsourced work
• Monitoring of outsourced process performance
• Integration of outsourced work in process maps

• Outsourced processes excluded from QMS
• No accountability for outsourced work quality
• Outsourced processes uncontrolled

Review supplier quality agreements or contracts for 2-3 key suppliers. Verify QMS requirements are defined.

• How do you ensure externally provided processes remain under the control of your QMS?
• What contractual requirements ensure supplier processes meet your standards?

• Supplier control requirements documented
• Incoming inspection procedures
• Supplier audit program
• Quality agreements
• Verification plans

• No controls defined for suppliers
• No verification of supplier outputs
• Controls not documented

Review purchase orders and supplier agreements for clarity of requirements and controls specified.

• How do you define and communicate the controls you apply to external providers and those applied to outputs?
• How do suppliers know what you expect from them?

• Risk assessment of suppliers/supplies
• Supplier criticality classification
• Supplier certification status
• Quality history with supplier
• Impact analysis documentation

• All suppliers treated same regardless of risk
• No consideration of impact
• Supplier capability not assessed
• Critical items not identified

Review supplier risk assessments. Verify that higher-risk suppliers receive more stringent controls.

• How do you consider the potential impact of externally provided items on your ability to meet customer and regulatory requirements?
• How does supplier risk feed into your control decisions?

• Incoming inspection procedures
• Verification plans by item/supplier
• Test procedures for incoming items
• Source inspection records
• Sample inspection plans

• No verification of externally provided items
• Critical items not inspected
• Verification activities undefined
• Non-conforming items not detected

Review supplier performance data (delivery, quality, nonconformances). Verify corrective actions are taken for underperformance.

• How do you determine the effectiveness of controls applied to external providers?
• What metrics or KPIs do you track for supplier performance?

• A sample of purchase orders/agreements - verify they communicate the requirements clearly and completely: the product/service/process to be provided, with specifications, drawings, revisions, and quantities.
• Communication of approval requirements (product/service approval, methods, processes, equipment) and of personnel competence/qualification where relevant.
• Evidence requirements were confirmed ADEQUATE before being sent to the provider (reviewed for completeness), not issued with gaps the supplier must guess at.
• Communication of how the organization (or its customer) will verify or validate at the provider's premises, and of the provider's required interactions (reporting, change notification, escalation).
• Communication of how the provider's performance will be controlled and monitored (metrics, audit rights, scorecards).

• Minor NC: Purchase orders lack specifications, revisions, or quality requirements, so the supplier is left to interpret what is needed.
• Minor NC: Verbal orders are placed without documented requirements, creating disputes over what was agreed.
• Minor NC: Approval or competence requirements (e.g. for special processes or qualified personnel) are not communicated to the provider.
• Observation: Requirements are sent to suppliers without first confirming they are adequate and complete.

Review 3-5 recent purchase orders. Verify they specify product requirements, approval methods, and competence requirements as applicable.

• What information do you communicate to external providers regarding your requirements?
• How do you ensure purchase orders contain complete and accurate requirements?

• Purchase orders with specifications
• Drawings and technical documents provided
• Quality requirements in orders
• Delivery schedules communicated

• Purchase orders lack specifications
• Requirements not communicated
• Supplier unclear on requirements

Check purchase orders for clear product/service descriptions including specifications, drawings, and standards referenced.

• How do you communicate the processes, products, and services to be provided?
• How do you ensure suppliers understand what is being ordered?

• First article inspection requirements
• Sample approval procedures
• Process approval requirements in contracts
• Release documentation requirements

• No approval requirements specified
• Supplier releases without approval
• Process changes not approved

Review purchase orders for approval requirements. Verify first-article or qualification requirements are specified where appropriate.

• What approval requirements do you specify for supplier products, methods, or equipment?
• Are first-article inspections or process approvals required?

• Personnel qualification requirements in contracts
• Certification requirements specified
• Training requirements communicated
• Supplier personnel records reviewed

• Competence requirements not specified
• Unqualified personnel doing critical work
• Required certifications not verified

Check contracts for competence requirements (e.g., certified welders, trained inspectors). Verify compliance evidence.

• What competence requirements do you specify for supplier personnel?
• Do you require suppliers to use qualified personnel for critical operations?

• Communication protocols defined
• Contact information provided
• Escalation procedures in place
• Problem reporting requirements

• No communication protocols established
• Supplier doesn't know who to contact
• Problems not reported timely

Review supplier agreements for audit rights, access provisions, and communication requirements.

• How do you communicate your supplier interaction and control requirements?
• What access do your personnel have to supplier facilities for monitoring?

• Performance monitoring requirements in contracts
• Metrics and KPIs defined
• Right to audit clauses
• Reporting requirements communicated

• Supplier unaware of performance monitoring
• No metrics or KPIs defined
• Right to audit not established

If applicable, review source inspection records. Verify planned verification activities were conducted at supplier premises.

• What verification or validation activities do you perform at the supplier's premises?
• How do you decide whether source inspection is needed?

• Source inspection requirements communicated
• Customer verification rights in contracts
• Witness point requirements
• Audit scheduling arrangements

• Verification activities not communicated
• Supplier not expecting inspections
• Access denied at supplier premises

Review receiving inspection procedures and records for 3-5 recent deliveries. Verify appropriate checks were performed.

• What verification activities do you perform on receipt of externally provided products/services?
• How do you handle materials received without certificates of conformity?

• For a sample of operations, the documented information that defines what to do and the results to achieve - work instructions, specs, drawings, parameters - available and current AT the point of use, not buried in a system.
• Suitable, calibrated monitoring and measuring resources in use, and competent, authorized people performing the work (tie to 7.1.5 and 7.2).
• In-process and final monitoring/measurement records at the defined stages, showing acceptance criteria are checked during production, not only at the end.
• For special processes (where output cannot be fully verified later - welding, heat-treat, sterilization, coating), the validation/revalidation records and controlled parameters.
• Evidence of actions to prevent human error (mistake-proofing, checklists, visual controls) and of release, delivery, and post-delivery controls as applicable.

• Major NC: A special process whose output cannot be verified afterward is run without validation, so conformity cannot be assured.
• Minor NC: Work instructions for complex operations are missing or not available at the point of use, so the work depends on individual memory.
• Minor NC: In-process monitoring at defined stages is not performed or not recorded, so nonconformities are only caught (if at all) at final inspection.
• Observation: No actions to prevent human error on operations where a single mistake produces nonconforming output.

Observe a key production or service delivery process. Verify controlled conditions (a-i) are implemented as documented.

• How do you ensure production and service provision occurs under controlled conditions?
• What controls are in place to prevent errors during production or service delivery?
• How do you handle special processes where output cannot be verified by inspection alone?

• Work instructions at point of use
• Process specifications
• Product/service specifications
• Standard operating procedures (SOPs)

• No documented work instructions
• Outdated specifications
• Instructions not accessible to workers

Check 2-3 workstations for availability of current work instructions. Verify they describe both characteristics and activities.

• What documented information defines product/service characteristics and activities to be performed?
• Are work instructions available at point of use for critical operations?

• Quality objectives for production
• Output requirements documentation
• Target specifications
• Acceptance criteria

• Unclear quality targets
• No defined acceptance criteria
• Ambiguous output requirements

Verify monitoring equipment at 2-3 workstations is identified, calibrated (current sticker/record), and appropriate for the measurement.

• What monitoring and measurement resources are available and used during production?
• How do you ensure monitoring equipment is suitable and calibrated?

• Monitoring and measuring equipment list
• Calibration records
• Equipment availability at workstations
• Equipment suitability verification

• Missing measurement equipment
• Out-of-calibration equipment in use
• Equipment unsuitable for task

Review in-process and final inspection records for 2-3 products. Verify checks were performed at defined stages per the control plan.

• At what stages are monitoring and measurement activities performed?
• How do you verify that acceptance criteria are met before releasing product?

• Inspection and test plans
• In-process inspection records
• Final inspection records
• Quality control checkpoints

• No inspection points defined
• Skipping required inspections
• No verification before release

Check environmental monitoring records for controlled areas. Verify conditions are within specified limits.

• How do you ensure the infrastructure and environment are suitable for production?
• What environmental conditions are monitored (temperature, humidity, cleanliness)?

• Facility suitability assessments
• Environmental monitoring records
• Workspace organization (5S)
• Infrastructure maintenance records

• Inadequate facilities for work
• Environmental conditions affecting quality
• Poor workspace organization

Verify operator qualifications for 2-3 workers in critical processes. Check training records against competence requirements.

• How do you ensure personnel performing production or service delivery are competent?
• What qualification requirements exist for special process operators?

• Training records for production personnel
• Competency assessments
• Certifications and qualifications
• Personnel authorization records

• Untrained personnel performing work
• Missing required certifications
• No competency verification

Identify special processes (e.g., welding, heat treatment, sterilization). Review validation records and revalidation schedules.

• How do you validate special processes where outputs cannot be verified by subsequent inspection?
• What revalidation criteria apply to validated processes?

• Special process validation protocols
• Process validation reports
• Revalidation schedule and records
• Equipment and personnel qualification for special processes

• Special processes not identified
• No validation performed
• Revalidation not scheduled or performed

Review error-proofing measures in 2-3 processes. Ask operators what safeguards prevent mistakes.

• What actions are implemented to prevent human error in production?
• How have you applied error-proofing (poka-yoke) principles?

• Error-proofing implementations
• Poka-yoke devices
• Verification checklists
• Standard work documentation

• Recurring human errors
• No error prevention measures
• Confusing work instructions

Review release authorization records for 2-3 recent shipments. Verify authorized personnel signed off before release.

• What release, delivery, and post-delivery activities are defined?
• How do you authorize product release, and who has this authority?

• Release procedures
• Delivery verification records
• Post-delivery activity procedures
• Customer handover documentation

• No formal release process
• Delivery issues not controlled
• Post-delivery activities neglected

Review error/rework data trends. Verify error prevention actions are implemented and effective.

• What actions are in place to prevent human error during production and service provision?
• How effective have your error prevention measures been?

• The identification and traceability procedure and its use on the floor - verify outputs (materials, components, product) are identified by suitable means where conformity depends on it, so the right item is used and mix-ups are prevented.
• Status identification - tags, stamps, color codes, or system status showing the monitoring/measurement (inspection/test) status of product, so unverified or rejected product cannot be mistaken for accepted.
• Traceability records where required (by contract, regulation, or risk) - serial/lot/batch systems that allow product to be traced back to production conditions and forward to customers (essential for recall).
• For a sampled item, an actual traceability exercise - trace a finished item back through its records to materials and process data, and confirm the chain is unbroken.
• Segregation/identification keeping conforming and nonconforming product distinct (link to 8.7).

• Major NC: Traceability is required (regulatory/contractual) but is not maintained, so affected product cannot be identified in a recall or containment.
• Minor NC: Inspection/test status is not identified, so unverified or rejected product can be (or has been) mixed with accepted product.
• Minor NC: Product/material identification is missing where conformity depends on it, risking the wrong item being used.
• Observation: A traceability exercise reveals broken links (e.g. lot records that do not reconcile), so the system would not perform in an actual recall.

Select a finished product and trace backwards through production stages to raw material receipt. Verify identification is maintained throughout.

• How do you identify products and their status throughout production?
• How far back can you trace a product — to raw materials, process parameters, and operators?
• Is traceability required by contract or regulation?

• The customer/supplier-property register and procedure - verify property under the organization's control is identified, verified on receipt, and protected.
• Receipt/verification records showing property is checked when it arrives, so problems are caught early.
• Storage/handling controls keeping customer property distinct from the organization's own stock and protected from damage.
• Evidence that loss, damage, or unsuitability of customer property is REPORTED to the owner and recorded.
• Protection of intangible property too - intellectual property, designs, and personal data provided by customers.

• Minor NC: Customer/external-provider property is not controlled - not identified, verified, or protected while in the organization's care.
• Minor NC: Loss, damage, or unsuitability of customer property is not reported to the owner.
• Minor NC: Customer property is mixed with the organization's own stock, risking misuse.
• Observation: Intangible customer property (IP, data) is not recognized or protected.

Review the customer/external provider property register. Inspect storage conditions for 2-3 items. Verify reporting process for damage/loss.

• What types of customer or external provider property do you handle?
• How do you identify, protect, and safeguard such property?
• What do you do when customer property is lost, damaged, or found to be unsuitable?

• Evidence outputs are preserved during production and service provision to the extent needed for conformity - identification, handling, packaging, storage, and protection.
• Storage conditions and controls appropriate to the product (environment, contamination control, segregation).
• Handling and packaging methods that prevent damage in process and transit.
• Where relevant, shelf-life/expiration and FIFO controls so product is not used past its usable life.
• A floor check that product is actually preserved as specified, not just in the procedure.

• Minor NC: Product is damaged or deteriorating in storage or handling because preservation controls are inadequate.
• Minor NC: No defined storage conditions for product that needs them (environment, contamination control).
• Observation: Shelf-life/expiration controls are absent for product that has a usable-life limit.
• Observation: Packaging or handling methods do not prevent in-transit damage.

Inspect storage areas for proper identification, FIFO, environmental conditions, and protection. Check for expired or deteriorated materials.

• How do you ensure products are preserved during internal processing and delivery?
• What preservation methods are used (packaging, handling, storage, protection)?
• How do you manage shelf life or expiration dates?

• The defined post-delivery activities (warranty, servicing, support, recall) and evidence they are delivered to the extent required by contract, regulation, and the product's risk.
• Evidence the EXTENT of post-delivery activity was determined considering statutory/regulatory obligations, potential undesired consequences, product nature/use/lifetime, customer requirements, and customer feedback - not set arbitrarily.
• A functioning recall/field-action capability where the product's risk warrants it - procedure plus evidence it could be executed (traceability, contacts, mock or actual recall).
• Service/maintenance and warranty records showing obligations are actually met and tracked, not just promised.
• Post-delivery feedback fed back into the QMS - field issues informing improvement, design, or risk (link to 9.1.2/10).

• Major NC: A product whose risk warrants a recall/field-action capability has none, so the organization could not act on a serious post-market issue.
• Minor NC: The extent of post-delivery activity was not determined against the required considerations (statutory, consequences, lifetime, customer needs).
• Minor NC: Warranty or servicing obligations are not consistently met, with customer complaints about after-sales support.
• Observation: Post-delivery/field feedback is not fed back into the QMS, so recurring field issues do not drive improvement.

Review post-delivery obligations (warranty, maintenance, support). Verify activities are defined and records maintained.

• What post-delivery activities are applicable to your products/services?
• How do you determine the extent of post-delivery activities needed?

• Regulatory requirements analysis for post-delivery
• Compliance with product liability laws
• Recall procedures where required
• Legal post-delivery requirements documentation

• Regulatory post-delivery requirements not identified
• Non-compliance with legal obligations
• No recall process when required by law

Check regulatory requirements for post-market activities (e.g., safety reporting, recalls). Verify compliance processes exist.

• What statutory and regulatory requirements apply to post-delivery activities?
• How do you ensure compliance with product safety and reporting requirements after delivery?

• Risk assessment for product use
• Safety monitoring procedures
• Incident tracking and response
• Post-market surveillance

• Safety risks not considered
• No monitoring for product issues
• Incidents not tracked

Review risk assessments for post-delivery scenarios. Verify mitigations are in place for identified risks.

• What potential undesired consequences have been identified for your products after delivery?
• How are known risks communicated to customers?

• Product lifetime documentation
• Maintenance requirements
• Spare parts strategy
• End-of-life planning

• Product life not considered
• No maintenance support for durable goods
• Spare parts unavailable prematurely

Verify product lifetime specifications. Check that warranty periods and spare parts availability align with intended lifetime.

• What is the nature, use, and intended lifetime of your products?
• How do these factors influence your post-delivery support?

• Customer warranty agreements
• Service level agreements
• Training delivery records
• Customer support procedures

• Customer requirements not met
• SLAs not honored
• Customer complaints about support

Review contracts for post-delivery requirements (SLAs, maintenance, training). Verify fulfillment records.

• What specific customer requirements exist for post-delivery activities?
• How do you track and fulfill contractual post-delivery obligations?

• Customer feedback on post-delivery services
• Satisfaction surveys for support
• Analysis of field issues
• Improvements based on feedback

• Customer feedback ignored
• No systematic feedback collection
• Field issues not analyzed

Review customer feedback on service/support activities. Verify it is analyzed and improvement actions taken.

• How is customer feedback on post-delivery activities collected and used?
• What improvements have been made based on post-delivery experience?

• Change-control records for production/service changes - verify changes are reviewed and controlled to the extent needed to keep conformity, with the change authorized.
• Impact assessment before the change, so the effect on product/service conformity is understood.
• Records identifying the person(s) who authorized the change and the results of the review.
• Verification that conformity is maintained after the change.
• Updated documentation reflecting the changed process/parameters.

• Minor NC: Production/service changes are made without review or control, causing conformity issues.
• Minor NC: No impact assessment before changing a process, so consequences are discovered in the product.
• Minor NC: The authorizing person and the review results are not recorded.
• Observation: Documentation is not updated after a production change, so people work to the old method.

Review 3-5 recent production/process change records. Verify review, authorization, and post-change verification were conducted.

• How do you control changes to production or service provision?
• What review and authorization is required before implementing a change?
• How do you verify that changes do not adversely affect conformity?

• The planned verification arrangements (from 8.1) and final-inspection/test records - confirm product/service requirements are verified at the right stages before release, against defined acceptance criteria.
• Release records that include evidence of conformity to acceptance criteria AND traceability to the person(s) who authorized release.
• Evidence that release is WITHHELD until the planned checks are satisfactorily completed - check for any product shipped before inspection was finished.
• Where release proceeds before verification is complete, the documented customer or relevant-authority approval (concession) for doing so.
• For a delivered sample, traceability from the shipment back through the release record to the inspection/test data.

• Major NC: Product/service is released and delivered without the planned verification being completed, so conformity is not demonstrated at the point of release.
• Minor NC: Release records do not identify who authorized release, so accountability for the release decision is missing.
• Minor NC: Release records confirm shipment but not conformity to acceptance criteria.
• Observation: Early release ahead of full verification occurs without a recorded concession/authorization.

Review final inspection/test records for 3-5 recent releases. Verify all planned checks were completed and authorized personnel approved release.

• At what stages do you verify that product/service requirements have been met?
• Who has authority to release products, and under what conditions?
• How do you handle release when planned arrangements have not been satisfactorily completed?

• Final inspection records
• Test reports and certificates
• Verification checklists
• Certificates of conformity
• Measurement and test data
• Quality release documentation

• No evidence of conformity documented
• Inspection records missing or incomplete
• Products released without test results
• Acceptance criteria not clearly met

Review certificates of conformity or test reports for 3-5 released products. Verify they reference specific acceptance criteria.

• What evidence do you retain to demonstrate conformity with acceptance criteria?
• Are inspection and test results recorded with traceability to the product?

• Signed release documents
• Electronic approval records
• Release authorization with names/dates
• Signature log for release approvals
• Quality release sign-offs

• Unclear who authorized release
• No signatures on release documents
• Release by unauthorized personnel
• No traceability to release authority

For 3-5 released products, verify the authorizing person(s) can be identified from records.

• How is traceability maintained to the person(s) authorizing release?
• Can you identify who released each batch or lot of product?

• The nonconforming-output procedure and a sample of nonconformance records - verify nonconforming outputs (in-process, at receipt, at final, and after delivery) are IDENTIFIED and CONTROLLED to prevent unintended use or delivery.
• Physical/system evidence of control - segregation or quarantine areas, status tagging/labelling, or system holds - confirming nonconforming and conforming product cannot be mixed.
• Disposition records (rework, scrap, use-as-is/concession, return) showing each nonconformity was dispositioned by an appropriate authority, with concessions properly authorized.
• Re-verification records after correction/rework - confirming corrected output was re-checked against requirements before release.
• Evidence that significant or recurring nonconforming outputs trigger the corrective-action process (link to 10.2), and that customers were informed where nonconforming product was delivered.

• Major NC: Nonconforming output is not segregated or marked and can be (or has been) shipped or used unintentionally alongside conforming product.
• Minor NC: Nonconforming product is accepted under concession without proper authorization (or without customer approval where required).
• Minor NC: Reworked/corrected product is not re-verified against the original requirements before release.
• Observation: Nonconforming outputs are dispositioned individually but never analyzed for systemic causes, so the same nonconformity recurs (link to 10.2).

Review 5-10 recent nonconformance records. Verify segregation, disposition decisions, and closure. Check for repeat nonconformances.

• How do you identify and control nonconforming outputs to prevent unintended use or delivery?
• Walk me through what happens when a nonconformance is detected during production.
• How do you handle nonconformances detected after delivery?

• Rework procedures
• Rework records
• Re-inspection records after correction
• Verification of corrected product

• Rework not properly documented
• Corrected product not re-verified
• Repeated rework indicating systemic issues

Review 2-3 corrected nonconformances. Verify re-verification was performed and results documented.

• How are nonconforming products corrected and re-verified?
• What re-inspection or re-test is performed after correction?

• Segregation/quarantine areas
• Nonconforming material tags or labels
• Return to vendor records
• Service suspension records
• Scrap records and authorization

• Nonconforming product not segregated
• Mixed with conforming product
• No quarantine area or process

Inspect quarantine/hold areas. Verify nonconforming materials are clearly identified and physically segregated.

• How do you segregate, contain, or suspend nonconforming products?
• What physical or system controls prevent nonconforming items from being used?

• Customer notification records
• Communication with customer about nonconformity
• Customer response and agreement
• Field correction or recall records

• Customer not informed of delivered nonconformities
• No process for customer notification
• Safety issues not communicated

Review recent customer notifications for nonconformances. Verify timeliness and completeness of communication.

• Under what circumstances would you notify the customer of a nonconformance?
• How do you handle customer notification for nonconformances detected after delivery?

• Concession or deviation authorizations
• Customer approval for concessions (if required)
• Justification documentation
• Material Review Board (MRB) records
• Risk assessment for concessions

• Concessions granted without proper authorization
• Customer not consulted when required
• No justification documented
• Excessive concessions indicating quality issues

Review 2-3 concession/deviation records. Verify proper authorization and customer approval where required.

• Who has authority to accept nonconforming product under concession?
• What conditions must be met for a concession, and is customer approval required?

• The nonconformity records - verify each describes the nonconformity, the actions taken, any concessions obtained, and identifies the authority that decided the disposition (the 8.7.2 a-d elements).
• Evidence the records are complete and retrievable (link to 7.5), not scattered or missing fields.
• Authorization evidence - the decision-maker for each disposition is identified, with concessions properly authorized.
• Trend analysis of nonconformity data, so recurring issues are visible (link to 9.3/10.2).
• A sample check that the records reconcile with the physical/disposition actions actually taken.

• Minor NC: Nonconformity records are incomplete - missing the nature, the actions, the concession, or the deciding authority.
• Minor NC: The authority that decided the disposition is not identified, so accountability is missing.
• Minor NC: Nonconformity records cannot be retrieved when requested.
• Observation: Nonconformity data is recorded but never analyzed for trends.

Review 5 nonconformance records for completeness — they should describe the NC, actions taken, concessions obtained, and authority who decided.

• What documented information do you retain on nonconforming outputs?
• How complete are your nonconformance records?

• Nonconformance reports (NCRs)
• Rejection tags with descriptions
• Inspection reports noting nonconformities
• Test failure reports

• Nonconformity description vague or missing
• Cannot understand what was wrong
• No details on extent or impact

Check 3-5 nonconformance forms. Verify descriptions are specific enough to identify the product, defect, and quantity.

• How do you document the description of nonconformities?
• Is there a standard format for recording nonconformances?

• Disposition recorded on NCRs
• Rework or scrap documentation
• Re-inspection records
• Containment action records

• Actions not documented
• Unclear what was done
• No record of disposition

Review disposition records (rework, scrap, use-as-is, return). Verify actions were documented and completed.

• How are actions taken on nonconforming outputs documented?
• Are disposition decisions recorded with rationale?

• Concession/deviation requests and approvals
• Customer concession approvals
• MRB meeting records
• Justification documentation

• Concessions not documented
• No justification for use-as-is decisions
• Customer approval not obtained when required

Review concession records. Verify written approval from appropriate authority (and customer where required).

• How are concessions documented and tracked?
• What records show customer or relevant authority approval for concessions?

• Signed NCRs or disposition records
• Electronic approval records
• MRB attendee lists and signatures
• Authorization matrix for decisions

• Decision authority not identified
• No signatures on disposition decisions
• Decisions made by unauthorized personnel

Check 3-5 nonconformance records for clear identification of the person who authorized the disposition.

• How is the identity of the person authorizing the disposition decision recorded?
• Can you trace every nonconformance disposition to an authorized individual?