Thril — QMS Wiki for ISO 9001:2015

Standard

ISO 9001:2015 — clause breakdown

Each clause with its requirements, mandatory documentation, and what auditors look for. Click to expand.

Clause 4 — Context of the organization Mandatory

What it requires: Determine external/internal issues relevant to your QMS, interested parties and their requirements, define the QMS scope, and establish, implement, maintain, and continually improve the QMS including its processes.

4.1 — Understand the organization and its context (SWOT/PESTLE analysis)
4.2 — Understand needs and expectations of interested parties
4.3 — Determine the scope of the QMS (documented)
4.4 — QMS and its processes (process interaction map)

Mandatory: Scope of QMS Mandatory: Process interaction map Recommended: Context register

Auditor looks for: Evidence that you've identified relevant issues, interested parties, and that your QMS scope is accurate and justified. They'll ask for records of reviews.

Clause 5 — Leadership Mandatory

What it requires: Top management must demonstrate leadership and commitment, establish a quality policy, ensure quality objectives are set, assign QMS roles and responsibilities, and promote process approach and risk-based thinking.

5.1 — Leadership and commitment
5.2 — Quality policy (documented)
5.3 — Organizational roles, responsibilities and authorities

Mandatory: Quality policy Mandatory: QMS role assignments

Auditor looks for: Evidence of management review meetings, signed quality policy, communication records showing leadership engagement. The quality policy must be appropriate and communicated.

Clause 6 — Planning Mandatory

What it requires: Plan actions to address risks and opportunities, establish measurable quality objectives, and plan changes to the QMS when needed.

6.1 — Actions to address risks and opportunities (risk register)
6.2 — Quality objectives and planning to achieve them
6.3 — Planning of changes

Mandatory: Quality objectives (measured) Recommended: Risk register

Auditor looks for: Documented quality objectives with targets, evidence of risk assessment, action plans for risks/opportunities. Objectives must be monitored and communicated.

Clause 7 — Support Mandatory

What it requires: Ensure adequate resources, competent personnel, documented infrastructure and environment, measurement traceability, and documented information (document control).

7.1 — Resources (people, infrastructure, environment)
7.2 — Competence (training records)
7.3 — Awareness
7.4 — Communication
7.5 — Documented information (document control + records control)

Mandatory: Document control procedure Mandatory: Records control procedure Recommended: Training matrix

Auditor looks for: Training records, competence evaluations, document approval/change history, legible records. Clause 7.5 is a frequent finding area.

Clause 8 — Operation Mandatory

What it requires: Plan, implement, and control operational processes including product/service requirements, design/development, externally provided products/services, production/service provision, and release of products/services.

8.1 — Operational planning and control
8.2 — Requirements for products and services (contract review)
8.3 — Design and development (if applicable)
8.4 — Control of externally provided processes/products/services
8.5 — Production and service provision (including traceability, preservation)
8.6 — Release of products and services
8.7 — Control of nonconforming outputs (NCR process)

Mandatory: Nonconformity control procedure Mandatory: Records of nonconformities (NCRs) Recommended: Supplier evaluation records

Auditor looks for: Signed contracts/reviews, supplier evaluation records, traceability of product, NCR logs, corrective actions for nonconformities. This clause has the most process evidence.

Clause 9 — Performance evaluation Mandatory

What it requires: Monitor, measure, analyze, and evaluate QMS performance. Conduct internal audits at planned intervals and perform management reviews.

9.1 — Monitoring, measurement, analysis and evaluation (KPIs)
9.2 — Internal audit (audit program, audit records)
9.3 — Management review (review records, action items)

Mandatory: Internal audit procedure Mandatory: Internal audit records Mandatory: Management review records

Auditor looks for: Completed internal audit reports with findings, management review meeting minutes, KPI trend data. They will track closure of action items from previous reviews.

Clause 10 — Improvement Mandatory

What it requires: Determine and select opportunities for improvement, manage nonconformities and corrective actions, and continually improve the suitability, adequacy, and effectiveness of the QMS.

10.1 — Nonconformity and corrective action (root cause analysis)
10.2 — Continual improvement

Mandatory: Corrective action procedure Mandatory: Corrective action records (CARs)

Auditor looks for: Root cause analysis on nonconformities, corrective actions that actually prevent recurrence, evidence of continual improvement. This is where the PDCA cycle closes.

Assessment

Gap analysis toolkit

Score your organization against each ISO 9001:2015 requirement. Rate as Compliant, Partial, or Gap to identify where to focus implementation effort.

#	Requirement	Your score	Priority
4.1	Context of the organization identified and reviewed	Partial	Medium
4.2	Interested parties and their requirements identified	Partial	Medium
4.3	QMS scope defined and documented	Gap	High
4.4	QMS processes and their interactions mapped	Gap	High
5.1	Top management leadership and commitment demonstrated	Partial	High
5.2	Quality policy established and communicated	Gap	High
5.3	Roles, responsibilities, and authorities assigned	Compliant	Low
6.1	Risks and opportunities identified and addressed	Gap	High
6.2	Quality objectives established with measurable targets	Partial	Medium
7.1	Resources (people, infrastructure, environment) adequate	Compliant	Low
7.2	Personnel competence ensured with training records	Partial	Medium
7.5	Documented information controlled (document/records control)	Gap	High
8.1	Operational planning and control implemented	Partial	Medium
8.2	Product/service requirements reviewed before commitment	Partial	Medium
8.4	External providers evaluated and controlled	Gap	High
8.7	Nonconforming outputs identified and controlled (NCR)	Gap	High
9.2	Internal audits conducted at planned intervals	Gap	High
9.3	Management reviews conducted with documented minutes	Partial	Medium
10.1	Nonconformities managed with corrective actions (CAR)	Gap	High
10.2	Continual improvement demonstrated	Partial	Medium

Gap = missing / not started Partial = in progress / partial compliance Compliant = fully met

↗ How to close a gap

Identify the specific clause requirement
Write a procedure or work instruction addressing it
Assign an owner and target completion date
Implement and train staff on the new process
Collect evidence (records, signed forms, audit trails)
Re-assess score after implementation

Audit checklist Templates Roadmap

Infrastructure

Systems & OS management

Server operating environment, remote management tooling, and maintenance cadence. Maps to ISO 9001 Clause 7.1 (resources) — infrastructure and monitoring are part of your QMS support systems.

Ubuntu 24.04 LTS

Version24.04.1 LTS (Noble Numbat)

Kernel6.8.x (generic/HWE)

Support windowApril 2024 – April 2029 (std) / 2036 (EOL, UA)

Patch cadenceSecurity: daily / Kernel: rolling HWE / Base: monthly

Config mgmtFleetDM + Ansible playbooks

CVE monitoringUbuntu Pro + FleetDM vulnerability feed

Security patches applied within 48 h of release (critical) / 7 d (high)
Kernel livepatch enabled — no reboot required for most vulns
Monthly compliance scan via FleetDM — CIS Level 2 benchmark
LTS upgrade planning starts 6 months before EOL

FleetDM

Management

DeploymentSelf-hosted (single host / HA pair)

Agentosquery (Fleet-managed)

CoverageAll production Ubuntu 24.04 hosts

Upgrade mgmtFleet-managed software update campaigns

Agent health check: every 60 s — alerts on stale nodes
Scheduled queries: CIS compliance, running services, open ports, package versions
Update campaigns: staged rollout (dev → staging → prod) with rollback on failure
Host inventory exported to QMS records monthly

Cockpit

Direct Control

AccessHTTPS :9090 (LAN / VPN only)

AuthLocal PAM + SSH key / SSO (via reverse proxy)

RoleDirect console — service mgmt, logs, terminal, updates

Used for ad-hoc troubleshooting and service restarts only
All routine changes go through FleetDM or Ansible (audit trail)
Session recording enabled — logged to /var/log/audit/
Access reviewed quarterly against QMS user register

Maintenance & update schedule

Task	Tool	Frequency	Owner
Security patch audit & apply (critical)	FleetDM + unattended-upgrades	Continuous / daily	Sysadmin
Security patch audit & apply (high)	FleetDM update campaign	Weekly	Sysadmin
Kernel livepatch status check	Cockpit + fleetctl	Weekly	Sysadmin
CIS compliance scan	FleetDM scheduled query	Monthly	QMS / Security
Host inventory export to QMS	FleetDM → CSV → Thril	Monthly	Sysadmin
Cockpit / FleetDM version upgrade	Ansible playbook	Quarterly	Sysadmin
Cockpit access review (user register)	QMS review record	Quarterly	QMS rep
Full OS patch window + reboot	FleetDM staged campaign	Monthly	Sysadmin
Disaster recovery drill	Manual restore test	Annually	IT / QMS
Ubuntu LTS base image refresh	Packer + FleetDM enrollment	Annually	Sysadmin

Continuous / daily automated — Weekly — Monthly — Quarterly — Annually

Audit checklist IT SOP template Clause 7 — Support

Infrastructure

Host inventory

Physical and virtual hosts in the QMS scope. Each entry documents purpose, OS, network, connected peripherals, and key services. Maps to Clause 7.1.3 (infrastructure).

PackIT shipping workstation

Workstation

IP10.20.0.109

Hostnamematt-QM9400H-9500H-6C-V3

OSUbuntu 24.04.4 LTS (Noble) / 6.17.0-35-generic

CPUIntel Haswell-ULT (4th gen)

Memory3.7 GB

Disk119.2 GB SSD (SCCTS-602-128G) — ZFS

WiFi10.20.0.109/24 (wlp1s0, DHCP)

Ethernet192.168.0.10/24 (enp2s0, static)

Gateway10.20.0.1 (WiFi) / 192.168.0.1 (eth)

PurposePackIT shipping label & weight station

Key servicesSSH :22, Cockpit :9090, CUPS :631

ManagementCockpit (https://10.20.0.109:9090)

Chrome kiosk at https://packit.thril-usa.com/count — shipping count & label printing
ATEN serial bridge for scale integration
H264 USB camera for package photography
Touch screen + barcode scanner for operator input
Requires restart (pending kernel update from 6.17.0-35)

SOP-SHIP-001 — PackIT operation SOP-SHIP-002 — Daily weight verification WI-SYS-001 — Workstation maintenance

Systems & OS Equipment profiles Audit checklist

Audit

3rd-party audit checklist

Pre-audit readiness assessment. Each item is what an external certification auditor will verify. Mark Yes (evidence exists), No (missing), Partial (some evidence), or N/A.

Clause 4 — Context of the organization

Has the organization identified external and internal issues relevant to its QMS? Partial —

Are interested parties and their requirements documented and reviewed? Yes —

Is the QMS scope defined, documented, and justified (including exclusions)? No No

Are QMS processes, sequence, and interactions mapped? No No

Clause 5 — Leadership

Does top management demonstrate leadership and commitment to the QMS? Partial —

Is a quality policy established, documented, and communicated to all personnel? No No

Are QMS roles, responsibilities, and authorities assigned and communicated? Yes —

Clause 6 — Planning

Has the organization determined risks and opportunities and planned actions to address them? No No

Are quality objectives established for relevant functions and levels with measurable targets? Partial —

Is there a documented process for planning QMS changes? Yes —

Clause 7 — Support

Are adequate resources (people, infrastructure, environment) provided for the QMS? Yes —

Is personnel competence determined and maintained (training records, certifications)? Partial —

Is there a documented document control procedure (approval, review, changes, versioning)? No No

Is there a documented records control procedure (identification, storage, retention, disposal)? No No

Clause 8 — Operation

Are customer requirements reviewed before commitment (contract review process)? Partial —

Are external providers evaluated, selected, and re-evaluated (supplier management)? No No

Is product/service traceability maintained where required? Yes —

Is there a documented process for controlling nonconforming outputs (NCR)? No No

Clause 9 — Performance evaluation

Are internal audits conducted at planned intervals (audit schedule, reports, findings)? No No

Is KPI data monitored, measured, analyzed, and evaluated? Partial —

Are management reviews conducted with documented minutes and action items? Partial —

Clause 10 — Improvement

Are nonconformities responded to, corrected, and root causes analyzed (CAR process)? No No

Is there evidence of continual improvement of the QMS? Partial —

Template: copy this checklist and populate with your actual status before the Stage 1 document review.

Clause details Gap analysis Templates

Governance

Document control guidelines

Clause 7.5 requires documented information to be controlled. These conventions ensure audit-ready documentation.

Naming convention

[TYPE]-[dept]-[number]-[version]
e.g. SOP-OPS-001-v2, POL-QMS-001-v1

Version control

Each document has a version history table: date, version, author, approver, change description. Major revisions increment the version number.

Approval workflow

Draft → Review by QMS rep → Approval by process owner → Publish. Electronic signatures or email approval records accepted.

Review cycle

All QMS documents reviewed at least annually (or when processes change). Review date tracked in the document register.

Document register

Master list of all QMS documents: title, ID, version, effective date, owner, review date, status (draft/active/obsolete).

Obsolete management

Obsolete docs are marked "superseded" and retained for records. Current versions are clearly distinguished from historical.

Retention

Records management & retention schedule

Mandatory records required by ISO 9001:2015 and recommended retention periods for audit traceability.

Record type	Clause	Retention	Format
QMS scope document	4.3	Current + 1 superseded version	PDF / wiki page
Quality policy	5.2	Current + 1 superseded version	PDF / wiki page
Quality objectives & performance data	6.2	3 years	Spreadsheet / dashboard
Risk register	6.1	3 years	Spreadsheet / wiki table
Training records & competency matrix	7.2	Employment + 3 years	HR system / spreadsheet
Document approval records	7.5	Life of doc + 3 years	Wiki history / email archive
Contract / order reviews	8.2	3 years	CRM / signed forms
Supplier evaluation records	8.4	3 years	Spreadsheet / procurement system
Nonconformance reports (NCRs)	8.7	5 years	Wiki page / forms
Corrective action reports (CARs)	10.1	5 years	Wiki page / forms
Internal audit reports & findings	9.2	5 years	PDF / wiki page
Management review minutes	9.3	5 years	PDF / wiki page

Resources

Template library

Pre-built templates aligned to ISO 9001:2015. Each includes prompts and examples to accelerate your documentation.

Quality Manual

Gap analysis checklist

Internal audit checklist

Quality policy

Corrective action (CAR)

Nonconformance (NCR)

Risk register

Management review minutes

Training record

Supplier evaluation

KPI dashboard

SOP template

Operations

Equipment & machinery profiles

Register of production and shipping equipment. Each profile links to associated SOPs, maintenance schedules, calibration records (Clause 7.1.5), and training requirements.

PackIT Shipping & Weight Station

Shipping

ModelPackIT PS-200

LocationShipping bay A

Serial #PKT-2410-058

Calibration due2026-09-15

Calibration frequencyQuarterly

Last maintenance2026-05-20

Maintenance intervalMonthly

SOP-SHIP-001 — PackIT operation SOP-SHIP-002 — Daily weight verification REC-CAL-001 — Calibration log

Advanced Machine Poly Bagger T1000

Packaging

ModelPoly Bagger T1000

LocationPackaging line 2

Serial #AMB-1123-442

Film width range4"–14"

Bagging speedUp to 45 bags/min

Last maintenance2026-06-01

Maintenance intervalWeekly (operator) / Quarterly (tech)

SOP-PKG-001 — T1000 setup & operation SOP-PKG-002 — Film changeover procedure WI-PKG-003 — Daily jam-clearing & safety check Label printing guide

Fortress Pancake Compressor

Air supply

EquipmentFortress pancake compressor

RelationshipSeparate equipment from the poly bagger

Daily checksStart-of-day and end-of-day safety checks

Compressor instructions

See also: Poly bagger label printing guide · Assembly procedures · Maintenance log template

Operations

Poly Bagger — label printing system

UPC barcode label printing pipeline for the Advanced Poly T-1000 bagger: .docx → ZPL → Zebra ZTC 110Xi4-203dpi thermal transfer printer.

Dedicated Poly Bagger guide

Full documentation on a separate page: machine setup & controls, operator certification checklist, label printing workflow, rebagging procedure, and a dedicated troubleshooting section for label placement variance.

Open Poly Bagger guide

Scan for mobile access

Full guide Machine setup Compressor setup Change bag End of day Label printing Rebagging Seal troubleshooting

Production

Assembly procedures & work instructions

Step-by-step assembly and building procedures for product lines. Each procedure references associated equipment, quality checkpoints, and required training (Clause 8.5 — production and service provision).

Micros — final assembly

Board mounting, connector seating, firmware load, and functional test for the Micros product line.

Mount mainboard to chassis — 4× M3 screws @ 6 in·lb
Seat ribbon cable connectors J1–J4 — verify latch click
Install I/O shield plate — torque to spec on label
Load firmware via JTAG — verify checksum match
Run functional test script ft_micros_v2
Inspect solder joints under magnification — 9× minimum

BOM-MIC-A2 WI-ELEC-001 QCP-MIC-001 Training: ASSY-100

KV9 — chassis build & wiring

Chassis assembly, harness routing, power supply installation, and continuity test for the KV9 enclosure.

Install standoffs and backplane into chassis
Route power harness per routing diagram KV9-WD-003
Secure PSU bracket — 2× M4 screws
Terminate DC lines to backplane — torque to 4 in·lb
Perform continuity and isolation test — log results
Install front bezel and label with serial number

BOM-KV9-B1 WI-MECH-002 QCP-KV9-001 Training: ASSY-200

General mechanical build — all product lines

Common mechanical assembly procedures applicable across Micros, KV9, and custom builds.

Verify all components against BOM and revision level
Inspect fasteners for correct thread pitch and length
Apply thread-locker (blue Loctite 242) to all M3+ threaded joints
Torque to spec — use calibrated torque driver only
Verify ground bond < 0.1 Ω per QCP-GEN-002
Complete build record and pass to QC inspection

WI-MECH-001 QCP-GEN-002 Training: ASSY-001

Custom build — per work order

Non-standard assemblies, prototype builds, or customer-specific configurations. Each follows a unique work order packet.

Pull work order packet from QMS — verify BOM and rev
Stage components on ESD-safe work surface
Follow work-order-specific step sequence (appended to packet)
Photograph critical assembly steps for traceability
QC inspect per QCP-GEN-003 before sealing

WI-GEN-001 QCP-GEN-003 Template: work order packet

See also: Equipment profiles · SOP template · Clause 8 — Operation

Roadmap

Implementation roadmap

A proven 6-phase plan from gap analysis through ISO 9001:2015 certification.