12.2 Quality Management Systems, ISO Standards & Registration

Quality Management Systems, ISO Standards & Registration

A Quality Management System (QMS) is the documented set of policies, processes, and records an organization uses to consistently deliver conforming products and services. For supply management, the QMS is the mechanism that converts a quality promise made during sourcing into a quality capability that survives after award. Exam 2 tests whether you know what certification does and — more often — what it does not do.

---

The ISO 9000 Family

The family is small and the exam expects you to keep the members straight:

The critical exam point: ISO 9001 certifies that a supplier has a documented, implemented, and audited system. It does not certify the product, does not guarantee zero defects, and does not substitute for your own supplier qualification, first-article approval, or process capability verification. A registered supplier can and does ship nonconforming material.

Current Edition and Revision Status

• The valid edition is ISO 9001:2015.
• ISO 9001:2015/Amd 1:2024 (published February 2024) added climate-change considerations to Clause 4.1 (context of the organization) and Clause 4.2 (needs and expectations of interested parties). It took effect immediately, with no transition period; registrars check it during regularly scheduled surveillance audits.
• ISO/TC 176/SC 2 published the Draft International Standard in August 2025 and has since issued the Final Draft International Standard. ISO 9001:2026 is expected to publish in September 2026, with an expected three-year transition running to approximately September 2029. Anticipated emphases include quality culture and ethical behaviour under Clause 5.1.1, a strengthened link between the quality policy and strategic direction under Clause 5.2, and the folded-in climate requirements — an evolutionary refinement rather than a structural overhaul.

When a scenario asks which edition governs a supplier contract signed today, the answer is ISO 9001:2015 (as amended in 2024) until the 2026 edition publishes and the supplier transitions.

---

The Seven Quality Management Principles (ISO 9001:2015)

1. Customer focus — meet and exceed customer requirements.
2. Leadership — top management establishes unity of purpose and direction.
3. Engagement of people — competent, empowered people at all levels.
4. Process approach — manage activities as interrelated processes in a coherent system.
5. Improvement — continual improvement is a permanent objective.
6. Evidence-based decision making — decisions rest on analysis of data.
7. Relationship management — manage relationships with interested parties, explicitly including suppliers.

Principle 7 is the hook for supply management: ISO 9001 obliges the certified organization to control externally provided processes, products, and services (Clause 8.4), which is precisely the supplier evaluation, selection, monitoring, and re-evaluation work owned by procurement.

---

Annex SL and Risk-Based Thinking

ISO management system standards share the Annex SL harmonized structure — a common 10-clause skeleton (scope, normative references, terms, context, leadership, planning, support, operation, performance evaluation, improvement). This is why ISO 9001, ISO 14001, and ISO 45001 can be operated as one integrated management system with a single internal audit program and a single management review.

The 2015 revision also replaced the old "preventive action" clause with risk-based thinking woven through the whole standard. The organization must determine risks and opportunities affecting conformity and customer satisfaction and plan actions to address them — the QMS equivalent of the supply risk register.

---

Sector-Specific and Companion Standards

Exam trap: Baldrige is an award framework and ISO 31000 is guidance — neither is something a supplier can be "certified to." Items that offer "require Baldrige certification of the supplier" are always wrong.

---

The Registration and Audit Cycle

Certification is granted by an independent third-party registrar (certification body) that is itself accredited by a national accreditation body under the International Accreditation Forum. The cycle a supply manager should expect:

1. Gap analysis and documentation — the supplier builds the QMS against the standard.
2. Stage 1 audit (readiness review) — the registrar reviews documentation and audit readiness.
3. Stage 2 audit (certification audit) — on-site verification that the QMS is implemented and effective. Findings are graded as major nonconformity (system breakdown, blocks certification until corrected), minor nonconformity (isolated lapse), or opportunity for improvement.
4. Certification issued — typically valid three years.
5. Surveillance audits — usually annual or semi-annual, sampling parts of the system.
6. Recertification audit — a full audit before the three-year certificate expires.

First-, Second-, and Third-Party Audits

• First-party (internal) audit: the organization audits itself.
• Second-party audit: the customer audits the supplier — this is the procurement-owned supplier audit, and it is the one you commission when certification alone is insufficient.
• Third-party audit: an independent registrar audits for certification purposes.

---

How Supply Management Uses QMS Status

• In the sourcing decision: certification is a screening criterion (a gate) rather than a differentiating criterion. Because every shortlisted supplier in a mature category is typically certified, the weighted evaluation model should score demonstrated capability — process capability indices, first-pass yield, corrective action responsiveness — not the certificate itself.
• In the contract: require notification of any change in certification status, grant right-of-audit and right-of-access to sub-tier suppliers, and specify the quality documents (control plan, certificate of analysis, certificate of conformance, first-article inspection report) that must accompany shipments.
• In supplier development: for a strategic supplier whose system is weak, funding a QMS implementation is normally cheaper than resourcing the category — the make-versus-develop-versus-switch trade-off Exam 2 likes to pose.
• In multi-tier risk: ISO 9001 Clause 8.4 obliges your supplier to control its suppliers, giving you contractual leverage to flow quality requirements down the chain.