1. ISO 9001:2015 Auditor / Registration Decision Lessons Learned
PRI Registrar
ISO 9001:2015
Auditor / Registration Decision
Lessons Learned

2. Audit Types
Clients may upgrade at Recertification, Surveillance, or Special Surveillance audits. PRI Registrar has developed overall checklists (RF-25 series) to cover the entire standard that is highlighted to show changes from last revision.

3. Audit Expectations
Upgrades may occur at Recertification, Surveillance or Special Surveillance Audits
Auditors are expected to complete both the overall RF-25 checklist as well as the Transition Report. Recommendation for upgrade to be indicated in the transition report.

4. REG-FRM 25 “Completion” Expectations
The RF 25 is meant to be a work sheet for the auditor. It contains the entire standard language for reference.
As the auditor is to be performing a process based audit, elemental commentary is not an expectation. Additional pages for notes may be added as necessary.

5. Management System Scope
The management system scope is not the same as the audit scope or the scope of certification; it may be considerably longer than either, and must be separately maintained and available upon request.
The MS scope document is the output of the requirements of clauses 4.1 and 4.2.
The MS scope document must take into consideration all of the following:
External and internal issues
The requirements of relevant interested parties
The products and services of the organization

6. Management System Scope
The MS scope must also discuss and justify any portion of the relevant standard that does not apply to the company’s management system. Any requirements not listed or justified here must be audited.
Any non-applicable requirements must not affect the organization’s “ability or responsibility to ensure the conformity of its products and services and the enhancement of customer satisfaction.”
Since the non-applicable clauses and their justifications appear in the MS scope, the clauses do not need to be listed in the scope of certification.
PRI’s policy, for consistency, is that scope of certification shall not list the non-applicable clauses.
In other words, the scope of certification should say what the organization does, not what it doesn’t do.

7. Process and Metrics
ISO 9001: The organization shall establish, implement, maintain and continually improve a quality management system, including the processes needed and their interactions, in accordance with the requirements of this International Standard. The organization shall determine the processes needed for the quality management system and their application throughout the organization, and shall: a) determine the inputs required and the outputs expected from these processes; b) determine the sequence and interaction of these processes; c) determine and apply the criteria and methods (including monitoring, measurements and related performance indicators) needed to ensure the effective operation and control of these processes; g) evaluate these processes and implement any changes needed to ensure that these processes achieve their intended results

8. Forms We will now review the following forms for transition audits:
QMS Matrix (RF-129)
ISO 9001:2015 Audit Checklist (RF-25 9k 2015)
ISO 9001:2015 Delta Checklist (RF-25 QMS 2015 Delta)
Audit Report (RF-22 QMS Transition Report)
Please review the transition audit process flows embedded below for how these forms are to be used.

9. QMS Matrix (RF-129) QMS Matrix RF-129
At least 90 days prior to the scheduled upgrade audit, the client is to submit the QMS Matrix to the lead auditor.
It is the lead auditor’s responsibility to ensure that they receive the completed QMS Matrix in sufficient time to create the audit plan. If the audit encounters difficulty, they should contact the office for assistance.
For ISO 9001:2015 audit, clients will be completing the RF-129 QMS Matrix, on which they will list all their processes and indicate which are considered critical processes.
When completing the Process Effectiveness Assessment tables in the RF-22 Audit Report, process titles should match those used in the RF-129.
Each process identified as critical on the RF-129 must have a Process Effectiveness Assessment table, with performance indicators and results listed.

10. QMS Matrix (RF-129) RF-129 QMS Matrix
Client organizations are responsible for determining critical processes; processes that directly affect the organization’s ability to ensure the conformity of its products and services and the enhancement of customer satisfaction are likely to be critical processes.
Processes deemed to be critical must be measured and monitored, and performance indicators must be available to the auditor at the time of the Stage 2 audit or the transition audit to ISO 9001:2015.

11. QMS Matrix (RF-129)
RF-129 (example)

12. QMS Matrix (RF-129)
After receiving the completed RF-129 from the client, the auditor shall use the identified processes to populate the Processes page in RMS.
These listed processes will allow the auditor to complete the audit plan.
Processes on the RF-129 must match with the processes listed on the audit plan, as well as with the critical processes described on the transition report.
If the list of processes must be modified as a result of the auditor’s onsite visit, the processes must be modified throughout the documentation.

13. Audit Checklist (RF-25 9k 2015)
ISO 9001:2015 Audit Checklist
RF25 9k 2015
Contains the language of the standard
Bolded text is new
Yellow highlighted numbers reflect former paragraph number
Reminder: once transitioned, don’t do an elemental audit: focus on processes. However, during transition audits, be sure to contain enough objective evidence to show compliance with new requirements.

14. Delta Checklist (RF-25 QMS 2015 Delta)
ISO 9001:2015 Delta Checklist
RF 25 QMS 2015 Delta
At the time that the client signs a contract or contract addendum confirming their upgrade audit days, PRI Registrar will provide them with a Delta Checklist.
The client is to complete this checklist prior to their upgrade audit. Completion of the checklist will involve references to objective evidence demonstrating conformance to the new or revised requirements.
PRI Registrar will instruct clients to send objective evidence, if possible, to support the references listed on the checklists; this will be particularly helpful in the case of small organizations.

15. Delta Checklist (RF-25 QMS 2015 Delta)
ISO 9001:2015 Delta Checklist cont’d
At least 90 days prior to the scheduled upgrade audit, the client is to submit the Delta Checklist (as well as any supporting evidence) to the lead auditor.
It is the lead auditor’s responsibility to ensure that they receive the completed Delta Checklist in sufficient time for review. If the audit encounters difficulty, they should contact the office for assistance.
The lead auditor is to review the Delta Checklist in order to determine conformance, where possible, prior to the upgrade audit. The auditor will indicate on the form whether the information provided indicates conformance, and may send the checklist back to the client to inform them of nonconforming items, or items that will require additional evidence of conformance.

16. Delta Checklist (RF-25 QMS 2015 Delta)
Please take the following into consideration:
The client must include sufficient detail to verify compliance with the standard, either by reference to documentation that can be validated on site, or through objective evidence that they submit with the form.
Small clients of 50 employees or fewer will not receive any additional onsite time for transition; as such, having the client send objective evidence along with the RF-25 QMS Delta will be particularly valuable.

17. Delta Checklist (RF-25 QMS 2015 Delta)
RF-25 QMS Delta cont’d
Please note the “Conforms Yes/No” column below:
It is expected that this column will be completed prior to the onsite audit, giving direction to the audit plan.
The completed form shall also be uploaded into the “Other Documents” section of RMS after the audit.

18. Transition Report (RF-22 QMS Transition)
Audit Report
RF22 QMS Transition Report
The report will be completed in much the same way as an ISO 9001:2008 report.
A Process Effectiveness Assessment table must be completed for each critical process, as defined by the client on the RF-129 QMS Matrix.
All process names are client-defined, and must match those processes listed both in the RF-129 and the client’s process interaction diagram.
The lead auditor shall provide a recommendation on whether the client is ready for transition to ISO 9001:2015.
If the recommendation is not to transition, the client organization shall maintain their certification ISO 9001:2008.

19. Transition Report (RF-22 QMS Transition)
Critical process performance indicators, objectives, and actual results must be listed in the transition report. Phrases like “goal met” are not acceptable.
Auditors also must take actions if process performance is not successful and no company action has occurred (e.g., NCRs).
Objective: word descriptors of the metric and the measurable goal indicating process effectiveness; all objectives should include units of measure
Actual: the actual performance measurement

20. Transition Report (RF-22 QMS Transition)
In the Narrative Summary, discuss the evidence of
risks throughout the processes and in the context of the organization.
the company’s understanding and use of the process approach
the company’s recognition of organizational boundaries
any items that support your final recommendation

21. Transition NCR Management
As of March 29, we’ve received the following opinion from the TAG 176:
An important item to note is that although transition could be combined with a surveillance, the revised requirements of ISO 9001:2015 cannot be sampled or partially met. A CB must confirm and have records to support that [a] certified organization meets all requirements of ISO 9001:2015 prior to issuing ISO 9001:2015 certificate.

22. Key Terms
1) Context of the Organization – combination of internal and external issues that can have an effect on an organization’s approach to developing and achieving its objectives. 2) Interested Party – stakeholder, person, or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity. 3) Documented Information – information required to be controlled and maintained by an organization and the medium on which it is contained.

23. Documented Information
Note that ISO 9001:2015 refers to both documents and records as “documented information.”
Documented information that is “maintained” refers to a document
Documented information that is “retained” refers to a record
A list of all clauses requiring documented information will be included in the meeting materials.

24. Questions?
Thanks for your attention and cooperation!