ISO 9001:2015 clause 9: Performance evaluation

• The monitoring-and-measurement plan - verify it defines WHAT is monitored/measured (process performance, product/service conformity, objectives, supplier performance, etc.) with KPIs that actually indicate QMS health.
• Defined METHODS that produce valid, reliable results - measurement techniques, sampling, statistical methods - so decisions rest on trustworthy data.
• Defined timing - WHEN monitoring/measurement is performed and WHEN results are analyzed and evaluated - showing it is planned, not reactive.
• Actual records and reports demonstrating the plan is executed - data collected at the defined points, with dashboards or quality reports.
• Evidence the results are used to evaluate QMS performance and effectiveness (feeding analysis 9.1.3 and management review 9.3).

• Minor NC: QMS/process performance is not monitored or measured, so the organization has no objective basis to judge whether the QMS is working.
• Minor NC: Methods are not defined or not capable of producing valid results, so the data is unreliable.
• Minor NC: Data is collected but not analyzed or evaluated, so monitoring produces numbers without insight.
• Observation: Monitoring is reactive (only when problems surface) rather than planned at defined points and intervals.

Select two or three process-level KPI dashboards and trace back to the documented monitoring plan; verify the data collection method, frequency, and most recent analysis report.

• Can you walk me through how you decided which processes and outputs to monitor, and how often you revisit that list?
• Show me a recent example where monitoring data led to a specific decision or corrective action.
• How do you confirm that your measurement methods produce valid, repeatable results?

• List of metrics and KPIs
• Monitoring and measurement plan
• Performance dashboards
• Quality objectives with measures

• No defined metrics
• Only lagging indicators (no leading)
• Key processes not measured

Compare the documented list of monitored parameters against the process interaction map; look for processes with no assigned metric.

• How did you decide these are the right things to monitor rather than other possible metrics?
• Are there any key processes that currently have no defined KPI?

• Measurement procedures
• Data collection methods defined
• Statistical analysis methods
• Calibrated measurement tools
• Survey methodologies

• Methods not defined
• Invalid or unreliable data
• No verification of method validity

Pick one process KPI and trace the measurement method from procedure to data collection tool to calibration or validation record.

• How do you validate that your measurement methods are still producing accurate and reliable data?
• What happens when a measurement device or survey method is found to give inconsistent results?

• Monitoring schedule
• Inspection plans with frequencies
• Real-time monitoring systems
• Periodic review schedules

• Timing not defined
• Infrequent monitoring for critical items
• No schedule for data collection

Select a high-risk process and verify the documented monitoring frequency against actual data collection dates for the past quarter.

• How did you decide on the monitoring frequency for your highest-risk processes, and is it documented?
• Are there any metrics that are collected less often than the process cycle time would suggest?

• Analysis schedules
• Reporting frequency defined
• Threshold triggers for analysis
• Management review schedule

• Analysis timing not defined
• Data collected but not analyzed timely
• Delayed evaluation missing opportunities

Pick two metrics and verify the documented analysis schedule against the dates of the last three analysis reports; confirm conclusions are recorded.

• Who is responsible for ensuring analysis is performed on schedule, and what triggers analysis outside the regular cycle?
• Show me a recent instance where analysis of monitoring data was performed and the conclusions documented.

• The defined methods for obtaining customer-perception information - surveys, feedback portals, complaint analysis, NPS, customer scorecards, review meetings - confirm they are PROACTIVE (not relying only on complaints) and appropriate to the customer base.
• Actual results from those methods - survey returns, satisfaction scores, complaint data - over enough time to show a trend, not a single snapshot.
• Analysis of the data - evidence the organization interprets WHY satisfaction is where it is, not just collects scores, including by segment or product line where relevant.
• Action taken on the findings - improvement or corrective actions triggered by declining satisfaction or complaint themes, closing the loop.
• Management-review evidence that customer-satisfaction data is presented and acted on at leadership level (link to 9.3.2).

• Minor NC: Customer satisfaction is not monitored, or is inferred only from the absence of complaints (no proactive measurement).
• Minor NC: Surveys are conducted but results are not analyzed or acted on - data is collected for the audit, not used.
• Minor NC: Satisfaction is declining and no action has been taken in response.
• Observation: A single feedback channel is used (e.g. an annual survey with low response), giving an unrepresentative picture of customer perception.

Review the most recent customer satisfaction survey results and complaint trend analysis; verify that the data was presented in the last management review and at least one improvement action was initiated.

• Beyond complaint handling, what proactive methods do you use to gauge customer satisfaction?
• How do you act on customer feedback that is positive but highlights an unmet expectation?
• Can you show me how customer satisfaction data has influenced a process change or product improvement?

• Analysis reports (not just raw data) - verify the organization applies appropriate methods (trend analysis, Pareto, statistics) to evaluate, at minimum: product/service conformity, customer satisfaction, QMS performance and effectiveness, planning effectiveness, risk/opportunity action effectiveness, and supplier performance (the 9.1.3 a-g topics).
• Evidence the analysis reaches conclusions and insights - what the data MEANS and where to act - not a dashboard with no interpretation.
• The link from analysis to decisions and improvement - actions, management-review inputs, or improvement initiatives traceable to the analysis.
• Appropriate analytical methods for the data - confirming the organization is not drawing conclusions from too little data or the wrong technique.
• Evidence all required evaluation topics (a-g) are actually covered, not just the convenient ones.

• Minor NC: Data is collected but not genuinely analyzed - results are presented as raw numbers with no evaluation or conclusions.
• Minor NC: One or more required evaluation topics (e.g. planning effectiveness or supplier performance) is never analyzed.
• Minor NC: Analysis is not used for decision-making, so it has no effect on the QMS.
• Observation: Analytical methods are superficial (averages with no trend or variation analysis), missing the signals that matter.

Select two evaluation topics (e.g., product conformity and supplier performance) and trace from raw data through analysis to management review input and resulting decision.

• Walk me through how raw monitoring data gets transformed into the analysis reports used for decision-making.
• For each of the seven evaluation topics (a-g), can you point me to the most recent analysis?
• How do you ensure analysis leads to action rather than sitting in a report?

• Product conformity analysis
• Defect rate trends
• Quality metrics reports
• Inspection result analysis

• Conformity not analyzed
• High defect rates unaddressed
• No trend analysis for quality

Pull the latest product or service conformity analysis (e.g., defect-rate trend chart, first-pass yield report) and verify it was reviewed and acted upon.

• What conformity metrics do you track, and how do you distinguish systemic conformity issues from isolated incidents?
• Show me the most recent conformity trend report and the actions triggered by any negative trends.

• Customer satisfaction trend analysis
• Complaint trend analysis
• Survey result analysis
• NPS or similar metric analysis

• Customer satisfaction not analyzed
• Declining satisfaction ignored
• No analysis of complaints

Review the most recent customer satisfaction analysis report; confirm it includes trend data over at least two periods and links declining scores to specific actions.

• How is customer satisfaction data segmented (by product line, region, customer type) in your analysis?
• What threshold or trend triggers a formal action when satisfaction declines?

• QMS performance reports
• Process metric analysis
• Objective achievement tracking
• System health assessments

• QMS effectiveness not evaluated
• No overall system analysis
• Performance issues unrecognized

Review the most recent QMS performance summary presented to management; verify it synthesizes individual metrics into an overall effectiveness conclusion.

• How do you determine whether the QMS as a whole is effective, beyond looking at individual process KPIs?
• What overall system-level health metric, if any, do you maintain?

• Plan vs. actual comparisons
• Project completion analysis
• Resource utilization reports
• Quality plan implementation status

• Planning effectiveness not analyzed
• Plans frequently missed without analysis
• No plan vs. actual comparison

Select a quality plan or project plan and compare planned milestones and targets against actual outcomes; verify that deviations were analysed.

• How do you compare planned versus actual results for quality plans or project milestones?
• When planning is found to be ineffective, how does that feed back into the next planning cycle?

• Risk mitigation effectiveness analysis
• Opportunity realization tracking
• Risk trend analysis
• Risk register updates with outcomes

• Risk action effectiveness not evaluated
• Same risks recurring
• Opportunities not tracked

Pull the risk register and select two risks with completed mitigations; verify that effectiveness was evaluated and the residual risk rating was updated.

• How do you evaluate whether the risk treatments you implemented actually reduced the targeted risks?
• Can you show me a risk that was re-rated after the mitigation action was evaluated?

• Supplier performance analysis
• Supplier scorecard trends
• Quality and delivery metrics
• Supplier comparison reports

• Supplier performance not analyzed
• Poor suppliers not identified
• No trend analysis for suppliers

Review the supplier performance analysis report; verify trend data across at least two periods and evidence that underperforming suppliers were addressed.

• How do you analyse supplier performance trends, and what actions are triggered when a supplier falls below acceptable thresholds?
• Show me the most recent supplier scorecard or performance summary.

• Improvement opportunity analysis
• Gap analysis reports
• Benchmarking studies
• Priority improvement list
• Improvement proposals

• Improvement needs not identified
• No gap analysis performed
• Stagnant QMS with no improvements

Select an improvement initiative and trace it back to the analysis or evaluation that identified the need; verify the linkage is documented.

• How does the analysis of monitoring data feed into the identification of improvement needs?
• Can you show me a gap or weakness identified through analysis that led to an improvement project?

• The internal-audit records over the planned cycle - verify audits are conducted at planned intervals and actually check conformity to BOTH the organization's own requirements AND ISO 9001, plus effective implementation and maintenance (not just document existence).
• Audit checklists/working papers based on ISO 9001 and the organization's own requirements - showing audits test real performance, not just that a procedure exists.
• Coverage evidence - all QMS processes/areas audited across the cycle, with no significant area going unaudited.
• Findings that include both conformities and nonconformities, with objective evidence - confirming auditors are genuinely evaluating, not rubber-stamping.
• Evidence audits assess EFFECTIVENESS (are processes achieving results), not only conformity.

• Major NC: Internal audits are not conducted as planned, or major QMS areas have gone unaudited within the cycle, so the QMS is not being independently verified.
• Minor NC: Audits check only that procedures exist, not whether the QMS is effectively implemented and achieving results.
• Minor NC: Audits are not independent - auditors review their own area or work.
• Observation: Audits produce only nonconformities with no assessment of effectiveness or of what is working well.

Pull the current annual audit schedule and cross-check it against the list of QMS processes; verify at least two completed audit reports for scope coverage and follow-up evidence.

• How does the audit programme determine which areas receive more frequent audits?
• Can you show me an audit report that assessed QMS effectiveness, not just document conformity?
• What happens when an internal audit finding is not closed by the target date?

• Audit checklists covering internal procedures
• Audit reports verifying policy compliance
• Evidence of auditing against quality objectives
• Assessment of internal standard compliance

• Audits only against ISO 9001, not internal requirements
• Own procedures not audited
• Quality objectives not verified

Review an audit checklist for one process and verify it references both the relevant internal procedure and the applicable quality objective.

• Show me how your audit checklist references internal procedures and quality objectives, not just ISO 9001 clauses.
• How do you verify that recently updated internal procedures are reflected in audit criteria?

• ISO 9001-based audit checklists
• Audit coverage matrix for all clauses
• Audit reports with ISO 9001 references
• Evidence of clause-by-clause assessment

• Major ISO 9001 clauses not audited
• No systematic coverage of standard
• Superficial ISO 9001 audits

Request the audit coverage matrix; confirm every applicable ISO 9001 clause has been audited within the planned interval.

• How does your audit programme verify that the QMS meets ISO 9001 requirements clause by clause?
• Show me the coverage matrix that maps audit reports to ISO 9001 clauses over the last cycle.

• Audit reports assessing process effectiveness
• Evidence of objective achievement review
• Performance trend analysis in audits
• Assessment of QMS maintenance

• Audits only check document existence
• No effectiveness assessment
• QMS deterioration not detected

Review two audit reports and look for findings or observations related to process effectiveness, not just procedural compliance.

• Beyond conformity checking, how do your auditors assess whether a process is actually effective at achieving its intended results?
• Can you show me an audit finding that identified an effectiveness gap rather than a documentation gap?

• The internal-audit programme/schedule - verify it covers all QMS processes and ISO 9001 clauses over its cycle, with frequency that is risk-based (more often for critical or problem areas, less for stable ones), not a flat 'everything once a year'.
• For a sample of completed audits: the audit plan, checklist/working papers, and report - showing defined criteria and scope, objective evidence gathered, and findings classified.
• Auditor objectivity and competence evidence - auditors do not audit their own work, and are trained/qualified to audit.
• Reporting to relevant management and the corrective actions raised from findings - with evidence findings are followed up and closed, not just logged.
• Evidence the programme reflects the importance and PRIOR RESULTS of the areas audited - areas with past findings get more attention - plus the retained records of the programme and results.

• Major NC: There is no functioning internal-audit programme, or whole processes/clauses have not been audited within the cycle, so the QMS is not being independently checked.
• Minor NC: Auditors audit their own work or their own area, compromising objectivity.
• Minor NC: Audit findings are raised but not followed up to closure with corrective action.
• Observation: Audit frequency is flat and not risk-based, and prior audit results do not influence the programme.

Select three recent audit reports spanning different processes; verify defined scope and criteria, auditor independence records, timely corrective actions, and management communication of results.

• How do you adjust audit frequency when a process has had repeated findings or significant changes?
• Walk me through how auditor independence is ensured for small teams where everyone is involved in most processes.
• Show me evidence that corrective actions from the last two audits were verified for effectiveness.

• Annual internal audit schedule
• Audit programme procedure
• Risk-based audit frequency justification
• Audit programme reviews and updates

• No documented audit programme
• Programme not maintained
• Frequency not risk-based

Compare the current audit schedule against the previous year; verify at least one frequency adjustment driven by risk, change, or prior findings.

• How do you factor in process importance, recent changes, and previous audit results when setting audit frequency?
• Show me where a process that had findings last year received a higher audit frequency this year.

• Individual audit plans with criteria and scope
• Audit criteria documentation
• Scope definition for each audit
• Audit checklists based on criteria

• Audits without defined criteria
• Scope unclear or too narrow
• Ad-hoc auditing approach

Pull two individual audit plans; verify each defines specific criteria (standard clauses and internal procedures) and a clear scope boundary.

• Show me the audit plan for a recent audit and explain how the scope and criteria were determined.
• How do you handle a situation where the defined scope turns out to be too narrow during the audit?

• Auditor assignment records showing independence
• Auditor competency records
• Conflict of interest declarations
• Use of external auditors when appropriate

• Auditors auditing their own work
• Unqualified auditors
• Conflicts of interest not addressed

For two recent audits, verify the auditor was independent from the area audited; check auditor competency records and any conflict-of-interest declaration.

• How do you assign auditors in a small organization where most people are involved in multiple processes?
• Show me the conflict-of-interest check for the most recent audit.

• Audit reports distributed to management
• Management review including audit results
• Evidence of timely reporting
• Distribution list for audit reports

• Audit results not communicated
• Management unaware of findings
• Delayed reporting

Check distribution records or email evidence for two audit reports; verify timely delivery to relevant management and inclusion in management review inputs.

• How quickly are audit results communicated to the management of the audited area after the audit closes?
• Show me evidence that top management received a summary of internal audit results.

• Corrective actions for audit findings
• Timelines for corrective action
• Follow-up verification records
• Closure of audit findings

• Findings not addressed
• Long delays in corrective action
• No follow-up verification

Pull the corrective action log for audit findings from the last cycle; verify timeliness of response, root-cause analysis, and effectiveness verification for at least two findings.

• What is your target time frame for completing corrective actions on audit findings, and how often is it met?
• Show me a finding from the last audit cycle and walk me through the corrective action to closure.

• Complete audit programme records
• Audit reports with evidence
• Corrective action documentation
• Auditor competency records

• Missing audit documentation
• Incomplete records
• Cannot retrieve audit history

Request the complete record set for one completed audit (programme entry, plan, checklist, report, corrective actions, closure); verify completeness and accessibility.

• Where are audit records stored, and how do you ensure they remain retrievable for the required retention period?
• Show me the complete documentation trail for one audit from programme entry through to finding closure.

• The management-review schedule and records - verify reviews happen at planned intervals with TOP MANAGEMENT genuinely participating (not delegated to the quality manager), at a cadence appropriate to the organization.
• Evidence the review evaluates the QMS's continuing suitability, adequacy, effectiveness, AND alignment with strategic direction - the four things 9.3.1 actually asks for.
• Attendance records confirming the right decision-makers are in the room, so the review can actually commit resources and changes.
• Evidence the review is substantive - decisions and direction set, not a presentation received and filed.
• Link to inputs (9.3.2) and outputs (9.3.3) - the review draws on the required inputs and produces the required outputs.

• Major NC: No management review is conducted, or top management does not participate, so there is no leadership oversight of the QMS.
• Minor NC: Reviews are irregular or skipped, breaking the planned-interval requirement.
• Minor NC: The review does not evaluate suitability, adequacy, effectiveness, and strategic alignment - it is a status meeting, not a review.
• Observation: Management review is effectively delegated to the quality function, with top management signing off rather than engaging.

Review the last two management review meeting records; confirm top-management attendance, coverage of suitability/adequacy/effectiveness/strategic alignment, and traceable action items.

• Which members of top management attend the review, and what evidence shows they actively participate rather than just receive a report?
• How do you ensure the management review evaluates alignment with strategic direction, not just operational metrics?
• If the review identified a resource gap last time, can you show me the action that was taken?

• The management-review agenda/inputs package - verify it covers ALL the required inputs: status of prior actions, changes in external/internal issues, performance and effectiveness data (customer satisfaction, objectives, process/product conformity, nonconformities, audit results, supplier performance), adequacy of resources, effectiveness of risk/opportunity actions, and improvement opportunities.
• The actual data presented for each input - confirm it is analyzed information (trends, performance against targets), not raw numbers on a slide, so management can make decisions.
• Evidence the review considers context CHANGES (4.1) and interested-party shifts, not just internal metrics.
• Customer-satisfaction and nonconformity/CAPA summaries as inputs - tying the review to the voice of the customer and the system's actual failures.
• Attendance/agenda showing the review happens at the planned interval with the right people, with no required input category routinely skipped.

• Minor NC: One or more required input categories is routinely missing from the management review (e.g. supplier performance or risk-action effectiveness never covered).
• Minor NC: Inputs are present but superficial - raw data with no analysis - so the review cannot produce informed decisions.
• Minor NC: Status of actions from the previous review is not followed up, so review decisions do not carry forward.
• Observation: Context changes (4.1) and resource adequacy are not genuinely discussed, making the review inward-looking.

Obtain the management review input package for the most recent review; check off each required input (a-f) and verify supporting data exists, especially customer satisfaction trends and external-provider performance.

• Can you show me the data package prepared before the last management review and confirm it covers all seven performance sub-topics (c1-c7)?
• How are changes in external context captured between reviews?
• Which input category has historically been the weakest, and what have you done about it?

• Action item tracking log
• Status report from previous review
• Completion evidence for closed items
• Escalation of overdue items

• No follow-up on previous actions
• Actions chronically overdue
• No tracking of action status

Obtain the previous management review minutes and the current action tracker; verify each open item has a status update and responsible owner.

• Can you show me the action log from the previous management review and the current status of every open item?
• What escalation mechanism exists when actions remain overdue across multiple review cycles?

• Context change analysis
• Regulatory update reports
• Market analysis updates
• Organizational change summary

• Context changes not considered
• Operating in outdated context
• External changes ignored

Check the management review agenda or input report for an explicit section on context changes; verify at least one specific change is cited with an associated response.

• What process do you use to capture regulatory, market, or organizational changes between management reviews?
• Can you give a recent example of an external change that was brought into the review and the resulting action?

• Performance dashboard
• Customer satisfaction report
• Quality objectives status
• Nonconformity summary
• Audit summary
• Supplier performance report

• Performance data missing categories
• No trend analysis
• Incomplete performance picture

Walk through the management review presentation or data pack; verify that all seven sub-topics have quantitative data with trend analysis, not just narrative summaries.

• For each of the seven performance areas (c1-c7), can you point me to the specific data presented at the last review?
• Which performance area showed the most negative trend, and what action resulted?

• Resource assessment report
• Staffing analysis
• Infrastructure evaluation
• Resource request justifications

• Resource adequacy not discussed
• Known gaps not addressed
• No resource planning

Check the management review minutes for a dedicated agenda item or slide on resource adequacy; verify at least one resource decision is documented.

• How does the management review evaluate whether current resources are sufficient to achieve quality objectives?
• Can you show me a resource gap identified in a review and the decision that followed?

• Risk register status
• Risk mitigation effectiveness analysis
• Opportunity tracking
• Emerging risks report

• Risk actions not reviewed
• Recurring risks not addressed
• Opportunity management absent

Review the risk register status report presented at the last management review; verify at least two risk actions have documented effectiveness assessments.

• How does the management review assess whether risk treatments implemented after the last review actually worked?
• Can you show me an opportunity from the risk register that was successfully captured since the last review?

• Improvement proposals list
• Benchmarking reports
• Efficiency improvement ideas
• Innovation suggestions

• No improvement opportunities identified
• Stagnant improvement pipeline
• Good ideas not captured

Check the management review outputs for a list of improvement opportunities discussed; verify at least one has a follow-up action item with an owner and due date.

• How does the management review differentiate between improvement opportunities that require investment and those that are quick wins?
• Can you show me an improvement opportunity identified in a review that was subsequently implemented?

• The management-review records/minutes - verify they capture DECISIONS AND ACTIONS, not just discussion, covering improvement opportunities, any need to change the QMS, and resource needs.
• Action items with owners and due dates - showing the review produced assignable, trackable outputs.
• Follow-up evidence - that actions from the review are tracked to completion and revisited at the next review (link to 9.3.2 'status of previous actions').
• Evidence the outputs drove change - improvement initiatives launched, QMS/process changes approved, or resources allocated as a result of the review.
• Records signed/approved by top management, confirming leadership ownership of the decisions.

• Minor NC: Management review produces no decisions or actions - it is a discussion or a presentation with no documented outcomes.
• Minor NC: Outputs are generic and not actionable, or actions have no owner or due date.
• Minor NC: One or more required output categories (improvement, QMS change, resource needs) is consistently absent.
• Observation: Actions from management review are recorded but not tracked, so the same issues reappear review after review.

Obtain the management review output record; verify it contains specific decisions on improvement opportunities (a), QMS changes (b), and resource needs (c), each with assigned owners and target dates.

• Can you show me the documented decisions and action items from the last management review, including owners and due dates?
• How do you track management review actions to closure, and what happens when an action is overdue?
• Give me an example of a QMS change that was decided in a management review and subsequently implemented.

• Improvement initiatives approved
• Improvement action items assigned
• Project approvals for improvements
• Resource allocation for improvements

• No improvement decisions made
• Improvement opportunities discussed but not actioned
• No resources committed to improvement

Check the management review output for a specific improvement decision; trace it to the project plan or initiative record and verify progress or completion.

• What criteria does top management use to prioritize which improvement opportunities to fund?
• Can you show me an improvement initiative that was approved in a management review and the resulting outcome?

• QMS change decisions documented
• Process change approvals
• Policy revision decisions
• System update action items

• No decisions on QMS changes
• Needed changes not addressed
• QMS stagnant despite issues

Identify a QMS change decision from recent management review outputs; trace it through the change planning process (6.3) to implementation and verify effectiveness.

• Can you give me an example of a QMS change that was decided in a management review and subsequently planned and implemented?
• How do you assess whether a change to the QMS has been effective after implementation?

• Resource allocation decisions
• Budget approvals
• Hiring decisions
• Investment approvals
• Training budget allocation

• No resource decisions made
• Resource needs identified but not addressed
• Budget requests not decided

Check management review outputs for resource allocation decisions; trace one decision to evidence of fulfilment (e.g., purchase order, hiring record, training completion).

• How does the management review translate identified resource needs into budget approvals or hiring decisions?
• Can you show me a resource decision from a recent review and evidence that it was fulfilled?