Quality Management Systems (ISO 9001 + industry derivatives) — Engineering Reference
1. At a glance
A Quality Management System (QMS) is a structured framework — processes, procedures, records, and responsibilities — for ensuring products and services consistently meet customer and regulatory requirements. The lingua-franca standard is ISO 9001:2015, against which more than 1 million organisations in ~190 countries are certified (ISO Survey 2023). Built on Deming’s PDCA cycle and post-2015 reframed around risk-based thinking, ISO 9001 is the baseline on top of which sector-specific QMSs add depth:
- IATF 16949:2016 — automotive supply chain (GM, Ford, Stellantis, Toyota, VW…). Adds PPAP, APQP, MSA, SPC, FMEA, 8D, control plans.
- AS9100D:2016 — aerospace and defence (Boeing, Airbus, Lockheed, Rolls-Royce…). Adds counterfeit-part controls, product-safety, configuration management, FAI (AS9102), special-process control.
- ISO 13485:2016 — medical devices. Risk-based design controls aligned with FDA 21 CFR 820 QSR and EU MDR Annex IX.
- ISO/TS 22163:2017 (IRIS) — rail rolling-stock and signalling.
- ISO/IEC 17025:2017 — test and calibration laboratories (measurement traceability, uncertainty budgets).
- TL 9000 — telecommunications.
- NADCAP — process-specific accreditation for heat treat, welding, NDT, coating, chemical processing in aerospace.
- FDA cGMP — 21 CFR 210/211 (pharma) and 820 (medical device); enforced through inspection rather than third-party certification.
Where it sits in the engineering stack: customer requirement → contract review (clause 8.2) → design controls (8.3) → supplier qualification + PPAP/FAIR (8.4) → production controls (8.5) → release (8.6) → nonconformance + CAPA (8.7, 10.2) → audit + management review (9.2, 9.3) → improvement (10.3). A QMS does not, by itself, produce quality output; it produces a system of evidence that quality output is the planned, repeatable result of disciplined work — and a paper trail traceable enough to survive a customer audit, an FDA 483 observation, or an NTSB investigation.
2. Why it matters
QMS certification is rarely optional in B2B and regulated work:
- Automotive: IATF 16949 is mandated by the OEMs as a condition of doing business. A tier-2 stamping shop without it cannot quote Ford or GM.
- Aerospace: AS9100D is mandated by Boeing, Airbus, Lockheed Martin, Northrop, Raytheon for any production supplier; NADCAP layered on top for special processes.
- Medical devices: ISO 13485 is referenced by EU MDR 2017/745 (mandatory in EU since 26 May 2021) and substantially aligned with FDA 21 CFR 820 (Quality System Regulation, harmonised to ISO 13485 via final rule Feb 2024, effective Feb 2026).
- Government / defence: contracts cite ISO 9001 or AS9100; US DoD adds CMMC for cybersecurity and ITAR/EAR for export control.
- Pharma: FDA cGMP 21 CFR 210/211 plus ICH Q7/Q9/Q10 quality systems.
Field cost of poor quality (COPQ) — internal scrap, rework, warranty, recall, liability, lost contracts — typically runs 15–40 % of revenue in immature operations and 1–5 % in mature (Juran 2017; Crosby 1979). Two case-study scale-points: Boeing 737 MAX MCAS recall cost >US$20 B direct; Takata airbag-inflator recall ~100 million units worldwide and a corporate bankruptcy. The QMS is the apparatus that converts process discipline into measurable defect reduction and into the documentary record that lets a regulator, a court, or an OEM auditor confirm it after the fact.
3. First principles
3.1 PDCA (Plan-Do-Check-Act)
Walter Shewhart’s iterative cycle (1939), popularised by Deming. Plan the change, Do it on a small scale, Check the result against the prediction, Act to standardise (if it worked) or revise (if it did not). Every clause group in ISO 9001:2015 maps to a PDCA quadrant: clauses 6–7 = Plan, clause 8 = Do, clause 9 = Check, clause 10 = Act.
3.2 Process approach
The organisation is modelled as a network of interacting processes, each with inputs, outputs, controls, and resources (often diagrammed as SIPOC — Supplier-Input-Process-Output-Customer — or its Latin-American cousin PEPSU). Process owners are accountable for performance (KPIs) and improvement. This is the structural ancestor of the Toyota value-stream view (see [[Engineering/lean-manufacturing]]).
3.3 Risk-based thinking (new in ISO 9001:2015)
The 2015 revision dropped the requirement for a “preventive action” procedure and replaced it with a system-wide expectation that risks and opportunities to QMS objectives are identified, evaluated, and addressed (clause 6.1). Risk methods are not specified — pragmatically: FMEA at the product level, ISO 31000 risk register at the strategic level, HAZOP / LOPA in process industries.
3.4 The seven quality-management principles (ISO 9000:2015)
- Customer focus — top of the list and unchanged across all sector standards.
- Leadership — top-management commitment, policy, resources.
- Engagement of people — competence (clause 7.2), awareness (7.3), empowerment.
- Process approach — see 3.2.
- Improvement — kaizen, CAPA, management review (10.3).
- Evidence-based decision-making — data over opinion; ties to SPC and MSA in
[[Engineering/six-sigma]]. - Relationship management — suppliers and partners as long-term collaborators, not arms-length vendors.
3.5 Documented information vs old “documents + records”
ISO 9001:2015 collapsed the old distinction into a single term — documented information — but the practical split persists: procedures, work instructions, forms (controlled by revision) and records / evidence (controlled by retention). Clause 7.5 governs both.
4. ISO 9001:2015 structure (Annex SL high-level structure)
The 2015 revision aligned ISO 9001 with Annex SL — the common 10-clause skeleton that all new management-system standards (ISO 14001, ISO 45001, ISO 27001:2022, ISO 50001) share. This makes integrated management systems much easier to deploy.
| Clause | Title | Key requirements |
|---|---|---|
| 1 | Scope | Applicability |
| 2 | Normative references | Refers to ISO 9000:2015 vocabulary |
| 3 | Terms and definitions | (per ISO 9000) |
| 4 | Context of the organization | Internal/external issues (4.1), interested parties (4.2), QMS scope (4.3), processes (4.4) |
| 5 | Leadership | Top-mgmt commitment (5.1), quality policy (5.2), roles + responsibilities (5.3) |
| 6 | Planning | Risks + opportunities (6.1), quality objectives (6.2), planning of changes (6.3) |
| 7 | Support | Resources (7.1), competence (7.2), awareness (7.3), communication (7.4), documented info (7.5) |
| 8 | Operation | Op planning (8.1), customer requirements (8.2), design + dev (8.3), externally provided (8.4), production + service (8.5), release (8.6), nonconforming output (8.7) |
| 9 | Performance evaluation | Monitor + measure (9.1), internal audit (9.2), management review (9.3) |
| 10 | Improvement | General (10.1), nonconformity + corrective action (10.2), continual improvement (10.3) |
Critical clauses in practice:
- 8.3 Design and development — only applies if the org designs; many job shops scope it out. Big in med-dev (ISO 13485 calls it design controls, mandatory).
- 8.4 Externally provided processes, products and services — supplier qualification, PPAP/FAIR, incoming inspection.
- 7.1.5 Monitoring and measuring resources — calibration + measurement traceability (overlaps ISO/IEC 17025).
- 8.5.6 Control of changes — engineering change control (ECN/ECO).
- 8.7 Control of nonconforming outputs — NCRs, MRB disposition.
- 10.2 Nonconformity and corrective action — CAPA process; 8D in IATF.
5. Sector-specific extensions
| Industry | Standard | Year | Core adds over ISO 9001 | Mandated by |
|---|---|---|---|---|
| Automotive | IATF 16949 | 2016 (+ SI 2023) | PPAP, APQP, MSA, SPC, FMEA, 8D, control plans, CSRs | GM, Ford, Stellantis, Toyota, Honda, VW, BMW |
| Aerospace + defence | AS9100D / EN 9100 / JISQ 9100 | 2016 | Configuration mgmt, counterfeit prevention, product safety, FAI (AS9102), special processes, risk mgmt | Boeing, Airbus, Lockheed, Northrop, Raytheon, RR, DoD primes |
| Aerospace special processes | NADCAP (PRI-administered) | continuously updated | Audit checklists for HT, welding, NDT, coating, chem-proc | Most aerospace primes |
| Medical devices | ISO 13485 | 2016 (+ Amd 1:2021) | Design controls, traceability, post-market surveillance, sterile + biocompat | FDA (via 21 CFR 820 harmonisation 2024), Notified Bodies (EU MDR), Health Canada, TGA, PMDA |
| Medical / pharma US | FDA 21 CFR 820 (QSR) | rev 2024 → 2026 | Harmonised to ISO 13485; design history file (DHF), DMR, DHR | US FDA inspection |
| Medical / pharma EU | EU MDR 2017/745, IVDR 2017/746 | 2017 (effective 2021/2022) | UDI, Eudamed, clinical evaluation, post-market clinical follow-up | EU Notified Bodies |
| Pharmaceutical | FDA cGMP 21 CFR 210/211; ICH Q7/Q9/Q10 | ongoing | API GMP, batch release, validation, deviation mgmt | FDA, EMA, PMDA via PIC/S |
| Rail | ISO/TS 22163 (IRIS rev 03) | 2017 | RAMS allocation, dependability, V-cycle artefacts | UNIFE members |
| Telecom | TL 9000 | r6.3 (2022) | Outage metrics, NPR/NPI counters | QuEST Forum |
| Test + cal labs | ISO/IEC 17025 | 2017 | Measurement uncertainty, traceability to SI, proficiency tests, impartiality | ILAC MRA signatories (A2LA, UKAS, DAkkS, NATA…) |
| Environmental | ISO 14001 | 2015 | EMS, aspects + impacts, compliance obligations | Voluntary; often customer-required |
| Occupational H+S | ISO 45001 | 2018 | Replaced OHSAS 18001; hazard ID, worker participation | Voluntary; insurer-driven |
| Information security | ISO/IEC 27001 | 2022 | Annex A controls (93 controls in 2022 revision) | Voluntary; SOC-2 alternative |
| US DoD cyber | CMMC 2.0 | rule 32 CFR Part 170 final 2024 | 3 maturity levels; NIST SP 800-171 r3 / SP 800-172 controls | DoD primes via DFARS 7012/7019/7020/7021 |
| Software (functional safety) | IEC 62304 | 2006+A1:2015 | SW safety classification A/B/C (matches ISO 13485 risk) | ISO 13485 design controls; FDA Premarket SW guidance |
| Pharma computer systems | GAMP 5 (ISPE) | 2nd ed 2022 | Cat 1–5 SW classification, V-model, CSV | FDA cGMP, EU Annex 11, ICH Q9 |
Customer-Specific Requirements (CSRs) in automotive deserve special attention: IATF 16949 + the OEM’s own CSR manuals (Ford “Q1”, GM “BIQS / BAQ”, Stellantis “PSCR”, Toyota “TSR”, Honda “Green Conformity”) form the contractual triangle. Auditors check all three on certification audits.
6. Core tools and techniques
6.1 Audit (ISO 19011:2018)
Three audit types by independence:
- First-party (internal) — done by employees against own QMS. Clause 9.2 of ISO 9001 requires it on a planned schedule.
- Second-party (supplier) — done by customer (or its agent) at a supplier.
- Third-party (certification) — done by an accredited certification body (BV, DNV, TÜV SÜD, TÜV Rheinland, BSI, SGS, LR, DEKRA, NSF-ISR) under IAF Multi-Lateral Agreement (MLA) accreditation.
Audit findings classify as Major NC (system breakdown, regulatory non-conformance, or repeat issue), Minor NC (isolated lapse), Observation or Opportunity for Improvement (OFI). Auditor competence is itself audited (ISO 17021-1 governs certification bodies; IRCA / Exemplar Global certify lead auditors).
6.2 Document and record control
Clause 7.5. Practical kit: revision number, effective date, approver, retention period, access controls. Records management standard: ISO 30300 / ISO 15489. Med-dev DHF/DMR/DHR triplet; auto control plan + PFD + PFMEA triplet; aero work order + traveller + as-built-config triplet.
6.3 Calibration and measurement traceability (clause 7.1.5)
Every measurement that affects product conformity is traceable to a national metrology institute (NIST US, NPL UK, PTB Germany, NIM China, NMIJ Japan) through an unbroken calibration chain. Each link documents uncertainty (per JCGM 100 GUM). Calibration intervals are risk-based (drift history, criticality, environment) — ANSI/NCSL Z540.3 sets industry expectations. Out-of-tolerance (OOT) findings trigger a reverse-traceability investigation of every measurement made with that gauge since its last good cal.
6.4 Corrective and Preventive Action (CAPA) — 8D problem solving
Ford’s 8D (Eight Disciplines), 1987. The de-facto problem-solving template in IATF 16949:
| D | Step | Tool |
|---|---|---|
| D1 | Form team | Cross-functional, ≤ 8 people |
| D2 | Describe problem | 5W2H, Is / Is-Not |
| D3 | Containment | Sort, rework, recall, lot block, customer notification |
| D4 | Root cause | 5 Whys, Ishikawa, FTA, hypothesis testing |
| D5 | Permanent corrective actions | Verify each candidate before selection |
| D6 | Implement + verify effectiveness | Data over multiple lots |
| D7 | Prevent recurrence | Poka-yoke, FMEA update, control-plan update, design-rule change, training |
| D8 | Recognise team + close | Lessons-learned to knowledge base |
Cycle time: typically 30–90 days from issue notification to D8 closure. OEM scorecards penalise late or low-quality 8Ds (Ford Q1, GM SQ Track, Stellantis APW).
6.5 Nonconformance management
NCR (Non-Conformance Report) generated at point of detection. MRB (Material Review Board) — cross-functional disposition team (quality + engineering + manufacturing + customer rep if required) — selects one of: scrap, rework, repair (with concession), use-as-is (with deviation), return-to-supplier. Customer concession required for “use-as-is” on customer-controlled drawings.
6.6 Change management — ECN / ECO
Engineering Change Notice (the proposed change) → Change Control Board review → Engineering Change Order (the authorisation). Drives drawing rev, BOM rev, work-instruction rev, validation impact assessment, PPAP / FAI requirement. In med-dev, an ECO triggers design-change controls (21 CFR 820.30(i)) and possibly a regulatory filing.
6.7 Configuration management (ISO 10007:2017, MIL-HDBK-61A, NASA-STD-0005)
Four activities: identification, control, status accounting, audit. Especially heavy in aerospace and defence — ATA Spec 2300, EIA-649C, NPR 7120.5. As-designed → as-built → as-maintained baselines tracked separately. PDM/PLM systems (Teamcenter, Windchill, Aras, Enovia) implement this.
6.8 Supplier qualification + onboarding
Audit → sample build → PPAP (auto) or FAIR (aero) → ramp. Performance scorecards (PPM, OTD, cost-of-quality, responsiveness) drive ongoing status. Tiered approval (preferred / approved / conditional / blocked).
6.9 Management review (clause 9.3)
Top-management cadence (quarterly typical; minimum annual). Inputs are spelled out (audit results, customer feedback, process performance, NC trends, CAPA effectiveness, supplier performance, risk-mitigation status, improvement opportunities, resource adequacy). Outputs are decisions and actions. The most-skipped clause in the standard; the first one auditors check.
6.10 Risk management (ISO 31000:2018, ISO 31010:2019)
Strategic risk register at corporate level. FMEA (IEC 60812:2018, AIAG-VDA FMEA 1st ed 2019) at design (DFMEA) and process (PFMEA) levels — see [[Engineering/reliability-engineering]]. HAZOP (IEC 61882) in chemical and process industries. Bow-tie for safety-critical event modelling. LOPA for SIL/ASIL allocation.
7. Worked examples
Example A — PPAP submission (automotive, AIAG PPAP 4th ed)
A tier-2 supplier launches a new injection-moulded clip for a Ford instrument panel.
18 PPAP elements required at submission level 3 (full PPAP with all elements):
| # | Element | Notes |
|---|---|---|
| 1 | Design records | Customer drawing, math data |
| 2 | Engineering change documents | If applicable |
| 3 | Customer engineering approval | If required |
| 4 | DFMEA | If supplier is design-responsible |
| 5 | Process flow diagram | PFD |
| 6 | PFMEA | Process FMEA |
| 7 | Control plan | Reactional + prevention controls |
| 8 | MSA studies | GR&R on each gauge |
| 9 | Dimensional results | All features per drawing |
| 10 | Material / performance test results | Spec callouts |
| 11 | Initial process studies (capability) | C_pk ≥ 1.67 on customer-designated significant chars; ≥ 1.33 on others; minimum 30 consecutive parts |
| 12 | Qualified laboratory documentation | 17025 accreditation or equivalent |
| 13 | AAR (Appearance Approval Report) | Cosmetic parts |
| 14 | Sample production parts | Customer retains |
| 15 | Master sample | Reference |
| 16 | Checking aids | Fixtures, gauges |
| 17 | CSRs | Ford-specific Q1 reqs |
| 18 | PSW (Part Submission Warrant) | Signed by supplier + customer SQE |
Capability study numbers: 30 consecutive parts, each measured at the SC (significant characteristic) — say a press-fit pin diameter Ø3.500 ±0.025 mm. Calculate x̄ = 3.498 mm, s = 0.0040 mm. P_pk = min[(3.498 − 3.475)/(3 × 0.0040), (3.525 − 3.498)/(3 × 0.0040)] = min[1.92, 2.25] = 1.92 ≥ 1.67 ✓.
Lead time: 90–120 days from order to PSW signature, with 30–60 day rework + resubmit cycles when elements fail. Resubmission triggered by any of: design change, process change, location change, supplier change of sub-tier, 12-month dormancy.
Example B — AS9102 First Article Inspection (aerospace)
A new machined titanium bracket goes into Boeing 787 production.
AS9102 Rev B (2014) requires three forms:
- Form 1 — Part Accountability: part number, rev, serial / lot, customer, supplier, drawing rev, FAI type (full or delta), authorisation signatures.
- Form 2 — Product Accountability + Material/Process: every raw-material cert, every special-process cert (heat-treat per AMS 2801, anodize per AMS 2470), every NDT cert (FPI per ASTM E1417). Each links to a NADCAP-accredited supplier.
- Form 3 — Characteristic Accountability: every dimension, note, geometric tolerance, surface finish, marking, and design-record characteristic on the drawing is listed, measured, recorded with the actual value and the gauge used, and dispositioned Accept / Reject.
Pin Ø3.500 ±0.025 mm on the bracket: Form 3 row reads “Char #47, Ø3.500 ±0.025, measured 3.512 by CMM-04 (cal due 2026-08-12), Accept.”
Recurring FAI required when: design change, process change, location change, > 2-year gap in production, or change in sub-tier supplier of a key process. Delta FAI covers only impacted characteristics; full FAI required if the change affects > 50 % of features.
Retention: AS9100 clause 8.5.4 + customer flowdown — typically life of program + 7 years for primary structure, often longer (40+ years for safety-critical).
Example C — 8D CAPA cycle (8 Disciplines)
Customer (OEM final-assembly plant) reports a field-quality issue: a connector housing cracks during clip-on, rate 1200 PPM (parts per million) — well above the 50 PPM contractual target.
- D1 Team: quality engineer (lead), product engineer, process engineer, customer SQE liaison, ops supervisor.
- D2 Problem description: “Housing PN 123-456 rev D cracks at retention-clip boss during installation at plant X. Started week 38, lots 240938-240942. Other plants unaffected (Is / Is-Not).”
- D3 Containment: 100 % visual inspection at supplier outgoing; sort customer in-transit inventory + plant stock; certified-stock label (red tag); customer notified within 24 h.
- D4 Root cause: 5 Whys leads to (a) process change — moulding-machine #4 swapped barrel heaters week 36, raised actual melt 12 °C above spec, increasing crystallinity and reducing impact toughness in the boss region. (b) Why undetected? — PFMEA control was “operator visual” rated D=3; should have been melt-temp SPC rated D=1.
- D5 Permanent corrective actions: barrel-heater PM procedure updated (new calibration after replacement); add melt-temp Type-K thermocouple with PLC interlock + chart recorder; PFMEA control plan upgraded.
- D6 Implement + verify: 5 production lots monitored; 0 cracks in 50 000 parts, melt-temp SPC C_pk = 1.85 stable.
- D7 Prevent recurrence: rolled the new heater-replacement procedure to all 6 moulding machines + 3 sister-plants; PFMEA library updated; lessons-learned to design-rule database (gate location near boss flagged for review at next platform).
- D8 Closure: team recognition; D8 report submitted to customer SQE; customer closes on scorecard.
Cycle time: D1–D3 in 24 hours (containment SLA); D4–D6 in 30 days; D7–D8 in 60 days total. Effectiveness verified at 90 days (3 months of clean shipments).
8. Audit lifecycle
8.1 The audit programme (ISO 19011 clause 5)
The audit programme — not just individual audits — is the unit of management. Annual schedule covers all clauses + all sites + all key processes at a frequency proportional to risk. High-risk processes (special processes, design changes, supplier issues) audited more often.
8.2 Audit competence
ISO 19011:2018 clause 7. Auditors trained, evaluated, calibrated against each other. Lead auditor certifications: IRCA (UK) and Exemplar Global (US). Sector-specific add-ons: AIAG IATF auditor pool; PRI for NADCAP.
8.3 Three audit-flavours by scope
- System audit — does the QMS as documented meet the standard, and is it implemented?
- Process audit — does this one process (e.g. injection moulding, design-change control) operate as planned and produce in-spec output? VDA 6.3 (auto) is the canonical process-audit method, scored.
- Product audit — does this finished product, sampled from shipped or near-shipped inventory, conform to the customer specification when measured by an independent inspector?
8.4 Surveillance + recertification cadence
| Audit | Frequency | Typical duration | Purpose |
|---|---|---|---|
| Stage 1 (readiness review) | Once before initial cert | 1–3 auditor-days | Documentation review, audit-readiness gap |
| Stage 2 (initial cert audit) | Once | 3–12 auditor-days (size-dependent) | On-site verification of implementation |
| Surveillance | Annual | 1–5 auditor-days | Maintain certification |
| Recertification | Every 3 years | 2–8 auditor-days | Full scope re-evaluation |
| Special / transition | Ad hoc | varies | Standard revision transition (e.g. ISO 9001:2008 → 2015) |
End-to-end clock for a green-field implementation: typically 6–18 months from kickoff to certificate depending on scope (single-site SME ~6 months, multi-site global ~18+ months).
8.5 Findings and consequences
- Major NC: certificate suspension within 60–90 days if not closed with verified containment + root-cause + corrective-action plan.
- Minor NC: closure required by next audit (usually with documentary evidence; on-site verification on surveillance).
- Observation / OFI: no closure required; tracked in continuous improvement.
For IATF 16949 specifically, any major NC → certificate decertification process unless a verified action plan is submitted within 60 days and on-site closure within 90 days. IATF maintains a global certificate database; decertified suppliers lose business overnight.
9. Tools and software
| Category | Tool | Sweet spot | Notes |
|---|---|---|---|
| eQMS (broad) | MasterControl | Pharma, med-dev | Strong CSV story, validated |
| ETQ Reliance | Discrete manufacturing, multi-industry | Modular suite | |
| Veeva Vault QualityOne / Vault QMS | Life sciences | Multi-tenant cloud | |
| Sparta TrackWise / TrackWise Digital | Pharma | Long pedigree in deviations + CAPA | |
| Greenlight Guru | Medical device only | DHF/DMR/DHR built around 21 CFR 820 + ISO 13485 | |
| Qualio | SME med-dev / pharma | Lower-friction cloud | |
| ComplianceQuest | Salesforce-platform QMS | CRM-adjacent | |
| IsoTracker / Intelex / Ideagen Quality Management | Mid-market | Doc + audit + CAPA modules | |
| Document control | SharePoint, OpenText Documentum, Box, M-Files | Generic | Add QMS overlay (controlled rev, retention) |
| CAPA + audit | ETQ, TrackWise, Qualityze, AuditBoard | Standalone | Often integrated to ERP |
| Calibration mgmt | Beamex CMX, GAGEtrak, ProCalV5, Fluke MET/CAL, Crystal Reports XL | Cal labs + asset-mgmt | Beamex pairs with field-cal hardware |
| Risk + FMEA | APIS IQ-RM / IQ-FMEA, Plato Scio (now Quanos), ReliaSoft Xfmea / RCM++ (Hexagon), iQ-Robot, IQS | Auto + aero | APIS dominates VDA-aligned auto |
| Supplier QMS | SAP Ariba, Coupa, Workiva, Jaggaer, Ivalua | Indirect + supplier-mgmt | PPAP / FAIR workflow add-ons |
| Statistical | Minitab, JMP, ReliaSoft Weibull++, R (qcc, qicharts2), Python (statsmodels, pyspc) | DOE, SPC, capability | See [[Engineering/six-sigma]] |
| Configuration / PLM | Teamcenter (Siemens), Windchill (PTC), Aras Innovator, 3DEXPERIENCE / Enovia (Dassault), Oracle Agile PLM | Discrete + aero | ECN/ECO + BOM rev + as-built |
| Open-source | OpenKM, LogicalDOC, OpenProdoc, Quality.kit | SME | Validation evidence weaker; rare in regulated sectors |
| Audit specific | iAuditor (SafetyCulture), AuditBoard, Resolver, AuditFile | Field audits | Mobile checklists, photo evidence |
Implementation pricing rough orders: SaaS eQMS US200 k–2 M one-time plus 18–22 % annual maintenance; validated CSV implementation effort (med-dev / pharma) often dwarfs licence cost (US$300 k–2 M for installation qualification + operational qualification + performance qualification per GAMP 5 Cat 4–5).
10. Edge cases and gotchas
- Certification ≠ quality. ISO 9001 certification proves the process is documented and the documentation is followed. It does not prove the output is excellent. Bad designs and uncompetitive costs survive certification audits.
- Documentation bureaucracy. The trap of “process for the process.” Lean QMS pushes minimal but useful — every procedure earns its place. Toyota does not run a thick ISO QMS internally; lots of know-how lives in tribal practice and one-page A3s.
- Audit fatigue and the IATF “one-cert” answer. A tier-2 supplier to GM + Ford + Stellantis + Toyota could be 2nd-party audited four times a year by customer SQE teams, plus 3rd-party for cert. IATF 16949 was specifically designed so a single cert covers all OEM expectations (modulo CSRs) — but CSRs vary enough that 2nd-party audits persist.
- Sector-creep. A med-device contract manufacturer that machines parts for an aerospace customer ends up with ISO 13485 and AS9100 and ISO 9001 simultaneously. Integrated QMS (single procedure-set with sector annexes) saves significant overhead.
- Software in QMS. Computer-system validation (CSV) under FDA 21 CFR 11, EU Annex 11, GAMP 5 turns a 500 k validated deployment in pharma / med-dev. Risk-based approach (GAMP 5 2nd ed) tries to right-size this.
- Sampling plans. The old MIL-STD-105E was withdrawn in 1995; ANSI/ASQ Z1.4-2008 (R2018) for attributes, ANSI/ASQ Z1.9-2008 (R2018) for variables. AQL (Acceptable Quality Level), single / double / multiple sampling, switching rules (normal → tightened → reduced). Producer’s risk α and consumer’s risk β set by OC curve.
- 100 % inspection ≠ 100 % conformance. Operator visual inspection is empirically ~80 % effective (the “F-test” is a longstanding industrial-engineering exercise). Automated vision (Cognex, Keyence, MVTec Halcon) and poka-yoke jigs move the bar; serialisation + blockchain track-and-trace pushes traceability beyond sampling.
- Cybersecurity in QMS. ISO/IEC 27001:2022 (93 Annex A controls, down from 114 in 2013) and CMMC 2.0 (final rule 32 CFR Part 170, 2024) ride on the same Annex SL skeleton — increasingly integrated with ISO 9001. DoD primes already enforce CMMC Level 2 on suppliers via DFARS 7012/7019/7020/7021.
- AI + ML in regulated QMS. FDA’s Predetermined Change Control Plan (PCCP) framework (final guidance Dec 2024) addresses adaptive / continuously learning algorithms in medical devices; EU AI Act + EU MDR overlap creates a dual-regulatory landscape. ISO/IEC 42001:2023 AI Management System standard is the early structural answer.
- COPQ measurement traps. Reported COPQ undercounts because it omits external costs (warranty-administration overhead, lost-customer opportunity cost, brand damage). True COPQ is typically 2–3× the booked number; this is why Crosby’s “Quality Is Free” thesis works in practice.
- Quality 4.0. The marketing term for IoT + AI + cloud + connected SPC. Real implementations: Sight Machine, Hexagon Smart Manufacturing, PTC ThingWorx, Honeywell Forge, GE Digital Proficy. Risk: anomaly-detection ML overlaid on poorly-rationally-subgrouped data inherits the bad subgrouping.
- Supplier consolidation vs risk concentration. Cost-driven sole-sourcing (one supplier for a critical component) cuts unit cost ~10–20 % but blows up the supply-chain-risk register. COVID + Suez + Ukraine + Red Sea exposed this; QMS now expected to include supply-chain disruption scenarios (ISO 22301 BCM ties in).
- Counterfeit electronics. AS5553 (EEE parts), AS6081 (distributors), AS6171 (test methods), plus AS9100D clause 8.1.4. DLA QSLD list, ERAI, GIDEP. Authentication tests: X-ray, DPA, decap, electrical fingerprinting.
- Audit cherry-picking (certifier shopping). Organisations sometimes shop for lenient certification bodies. IAF MLA accreditation (national accreditors A2LA, UKAS, DAkkS, ANAB, JAB, ENAC, COFRAC, etc., signatory to IAF MLA) is the regulatory backstop; certification bodies that grant non-compliant certs lose accreditation.
- Greenwashing in ESG-QMS integration. ISO 14001 + ISO 9001 + ISO 45001 + ISO 50001 + ISO 14064 stack increasingly used for ESG reporting (CSRD in EU, SEC climate rules in US). Risk: paper compliance without actual emissions / safety performance. Independent assurance (ISAE 3000, ISAE 3410) is the answer.
- Knowledge-management clause 7.1.6 (new in ISO 9001:2015). Often the most under-implemented clause — “organisational knowledge” is hard to make objective. Practical anchor: lessons-learned database, knowledge-handover procedures for retiring SMEs, captive technical libraries.
- Calibration interval extension. Common cost-cutting move. Driven by drift history (control charts on standards) per ANSI/NCSL Z540.3 method 5; auditors expect documented justification, not “we always did 12 months and we extended to 24 because we needed to.”
- NCR ageing. Open NCRs > 90 days are an audit red flag; auditors view long ageing as evidence the disposition + CAPA system is choked.
- “Use as is” without customer approval. Top-3 finding in second-party automotive audits. Concession + deviation paperwork must precede shipment, not follow it.
11. Cross-references
[[Engineering/six-sigma]]— sibling. CTQ definition, DMAIC, SPC, MSA, DOE all live in the QMS as clause-9 evidence.[[Engineering/reliability-engineering]]— sibling. FMEA (IEC 60812), FRACAS, warranty data, design-for-reliability are the engineering substance behind QMS clauses 6.1 (risk) and 8.3 (design controls).[[Engineering/lean-manufacturing]]— companion. Lean’s process-and-waste view structurally aligns with ISO 9001’s clause-4 process approach.[[Engineering/supply-chain-management]]— supplier qualification, PPAP, second-party audits, risk concentration.[[Engineering/ergonomics-human-factors]]— process and workstation design under clause 7.1.4; operator competence under 7.2.[[Engineering/project-management-engineering]]— APQP and stage-gate alignment with QMS.[[Engineering/bioinstrumentation]]— ISO 13485 design controls flow into med-dev instrumentation.[[Engineering/realtime-embedded]]— IEC 62304 software safety classification under med-dev QMS.[[Engineering/fpga-design]]— DO-254 design-assurance levels under aerospace QMS.[[Engineering/gnc]]— DO-178C / DO-254 / ARP4754A artefacts flow into AS9100 configuration management.[[Languages/Tier3/retail-supplychain]]— EDI 850/856/810/824/830 in the auto + retail supplier-customer interface; QMS-relevant for ASN and inspection records.
12. Citations
Core standards (ISO + IATF + sector):
- ISO 9001:2015 Quality management systems — Requirements (Amendment 1, 2024).
- ISO 9000:2015 Quality management systems — Fundamentals and vocabulary.
- ISO 9004:2018 Quality management — Quality of an organization — Guidance to achieve sustained success.
- ISO 10007:2017 Quality management — Guidelines for configuration management.
- ISO 14001:2015 Environmental management systems — Requirements with guidance for use.
- ISO 19011:2018 Guidelines for auditing management systems.
- ISO 22301:2019 Security and resilience — Business continuity management systems.
- ISO 31000:2018 Risk management — Guidelines.
- ISO 31010:2019 Risk management — Risk assessment techniques.
- ISO 45001:2018 Occupational health and safety management systems — Requirements with guidance for use.
- ISO/IEC 17025:2017 General requirements for the competence of testing and calibration laboratories.
- ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements.
- ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system.
- ISO 13485:2016 + Amd 1:2021 Medical devices — Quality management systems — Requirements for regulatory purposes.
- IATF 16949:2016 Quality management system requirements for automotive production and relevant service parts organizations + Sanctioned Interpretations (2018, 2023).
- AS9100D:2016 / EN 9100:2018 / JIS Q 9100:2016 Quality Management Systems — Requirements for Aviation, Space, and Defense Organizations.
- AS9102 Rev B:2014 Aerospace First Article Inspection Requirement.
- AS5553 Rev D:2022 / AS6081 Rev B:2023 / AS6171 (test methods) Counterfeit electronic parts.
- ISO/TS 22163:2017 Railway applications — Quality management system — Business management system requirements for rail organizations (IRIS rev 03).
Regulatory + statutory:
- US FDA 21 CFR 820 Quality System Regulation (Final Rule harmonising with ISO 13485 published Feb 2024, effective Feb 2026).
- US FDA 21 CFR 210 + 211 Current Good Manufacturing Practice for Drugs.
- US FDA 21 CFR 11 Electronic Records; Electronic Signatures.
- EU Regulation 2017/745 Medical Device Regulation (MDR).
- EU Regulation 2017/746 In Vitro Diagnostic Regulation (IVDR).
- EU GMP Annex 11 Computerised Systems.
- ICH Q7, Q9 (R1):2023, Q10 Pharmaceutical Quality System.
- ITAR 22 CFR 120–130; EAR 15 CFR 730–774.
- DoD CMMC 2.0 final rule, 32 CFR Part 170 (2024); DFARS 252.204-7012 / -7019 / -7020 / -7021.
Industry-specific tools and frameworks:
- AIAG-VDA FMEA Handbook, 1st ed, 2019.
- AIAG PPAP — Production Part Approval Process, 4th ed, 2006.
- AIAG APQP — Advanced Product Quality Planning and Control Plan, 2nd ed, 2008.
- AIAG SPC Reference Manual, 2nd ed, 2005.
- AIAG MSA Reference Manual, 4th ed, 2010.
- Ford CQI-23 / GM BIQS / Stellantis PSCR / Toyota TSR customer-specific requirements.
- VDA 6.3:2023 Process audit.
- IEC 60812:2018 Failure modes and effects analysis (FMEA and FMECA).
- IEC 61025:2006 Fault tree analysis.
- IEC 61882:2016 Hazard and operability studies (HAZOP) — Application guide.
- IEC 61508:2010 Functional safety of E/E/PE safety-related systems.
- IEC 62304:2006+A1:2015 Medical device software — Software life cycle processes.
- ISO 26262:2018 Road vehicles — Functional safety.
- ISPE GAMP 5, 2nd ed, 2022 A Risk-Based Approach to Compliant GxP Computerized Systems.
- ANSI/ASQ Z1.4-2008 (R2018) attribute sampling.
- ANSI/ASQ Z1.9-2008 (R2018) variables sampling.
- ANSI/NCSL Z540.3-2006 (R2013) calibration system requirements.
- JCGM 100:2008 (GUM) Evaluation of measurement data — Guide to the expression of uncertainty in measurement.
- NADCAP audit checklists (PRI, Performance Review Institute), continuously updated.
- ATA Spec 2300 / EIA-649C / MIL-HDBK-61A / NASA-STD-0005 configuration management.
- ARP4754A:2010 / ARP4761A:2023 (avionics safety + reliability process).
- DO-178C / DO-254 / DO-326A (avionics software, hardware, cybersecurity).
- TL 9000 r6.3:2022 (telecom).
Canonical books and historical works:
- Juran, J.M. (ed). Juran’s Quality Handbook, 7th ed., McGraw-Hill, 2017 (canonical encyclopedic reference).
- Deming, W.E. Out of the Crisis, MIT CAES, 1986 (System of Profound Knowledge, 14 Points, PDSA).
- Crosby, P.B. Quality Is Free, McGraw-Hill, 1979 (COPQ, “zero defects”).
- Shewhart, W.A. Economic Control of Quality of Manufactured Product, Van Nostrand, 1931 (foundational SPC).
- Feigenbaum, A.V. Total Quality Control, McGraw-Hill, 1961 (TQC, predecessor of TQM).
- Ishikawa, K. Guide to Quality Control, JUSE, 1968 / What Is Total Quality Control? The Japanese Way, Prentice-Hall, 1985.
- Taguchi, G. Introduction to Quality Engineering, Asian Productivity Organization, 1986 (Taguchi methods, S/N ratios, loss function).
- Akao, Y. Quality Function Deployment, Productivity Press, 1990 (QFD, house of quality).
- ASQ Certified Manager of Quality / Organizational Excellence Handbook (CMQ/OE), 5th ed, 2021.
- ASQ Certified Quality Engineer Handbook (CQE), 4th ed, 2018.
- ASQ Certified Quality Auditor Handbook (CQA), 5th ed, 2019.
Industry analyses:
- ISO Survey 2023 (annual certification statistics — ISO 9001, 14001, 13485, 27001, 45001, etc.).
- Warranty Week annual report (warranty accruals + claims across industries).
- BCG, McKinsey, Deloitte Quality 4.0 reports (2018–2024).
- IPC J-STD-001 / IPC-A-610 / IPC-WHMA-A-620 (electronics workmanship — quality-driven assembly standards).
Tier 2 deep-dive reference. Maintained under the Engineering library schema ([[Engineering/_schema]]). Companion notes: [[Engineering/six-sigma]], [[Engineering/reliability-engineering]], [[Engineering/lean-manufacturing]], [[Engineering/supply-chain-management]].