ISO 9001:2015 for product organizations: process, risk, and audit sampling

Clause 4 context and interested parties should name actual customers, regulators, and suppliers. Clause 8 is the product realization path: requirements, design if you design, production or service delivery, and release. If those steps live in tools the manual never mentions, Stage 2 will follow the tools.

Documented information is whatever you need for the QMS to work. ISO 9001:2015 does not require a six-level procedure library. It does require that people can find the current way of working.

Outsourced design, cloud hosting, and contract manufacturers still need control if they affect conformity. “The vendor is certified” is a starting point, not the control.

For a product organization, clause 8 often maps to discovery, design, release, and support. If those names only exist in a RACI from 2019 while the team actually ships from GitHub and Intercom, rewrite the process around the tools — then control the tools. Registrars would rather see a short current process than a beautiful obsolete one.

Is 9001 the right standard? Medical devices want 13485. Automotive production wants IATF 16949. 9001 can be the base, but buyers in those sectors will not treat it as enough.

Scope of the QMS (which products, which sites) is a commercial decision. Certifying a side project while the revenue product sits outside scope will look odd in a tender.

Quality objectives without metrics fail management review. Pick a few: escape defects, on-time delivery, support reopen rate — then review them. Do not invent twenty KPIs for the audit week.

Decide whether design is in scope. Many SaaS firms exclude design and wonder why the registrar still samples how requirements become releases. If you change the product weekly, design-and-development thinking applies even when you do not call it “R&D.”

Internal audits that only check documents, not process effectiveness, teach the organization the wrong lesson and fail the registrar’s sample of clause 9.2.

Skipping risk-based thinking (clause 6) and treating 9001 as a documentation exercise produces a binder. Registrars will ask what changed when a customer complaint spiked.

Change control that exists for software releases but not for the QMS itself — uncontrolled templates, two “official” processes — is a frequent nonconformity in product companies.

Complaints that never become corrective action are the registrar’s favorite sample. If support closes tickets as “user error” with no trend review, clause 10 is theatre. Tie escape defects and complaint themes into management review with owners and due dates.

Walk it with operations and quality together, using live tickets as evidence, not the manual. Tick an item only when the process matches the floor or the sprint board.

If you already have ISO 27001, share leadership and improvement machinery where it is honest, but do not pretend information-security objectives are quality objectives.

Use a live complaint and a live release as the two samples while you work the checklist. If those stories cannot be told with the QMS vocabulary — requirement, nonconformity, corrective action — you are not ready for Stage 2, no matter how complete the document list looks.