The Order from Enquiry to Invoice: clause 8 in a small company

18 modules · about 98 minutes · final test with 40 questions, 32 correct to pass · certificate of participation as PDF

What this course is about

Clause 8 of ISO 9001 is the longest clause of the standard – and the only one that happens every day in the company: a customer enquires, someone checks whether it can be done, a quotation is written, the order is confirmed, material arrives, the work is done and checked, delivered, invoiced.

No registration needed. We only ask for your name and e-mail address before the final test – just for your certificate. Your progress is saved in this browser. You can stop at any time and continue later.

Module 1 of 18

Clause 8 in nine steps: the order as the common thread

Clause 8 is the longest in the standard — twelve pages — and at the same time the simplest if you read it as what it is: the description of an order from the first e-mail to the receipt of payment. Every auditor checks it the same way: “Let's take your last order” — and then he goes through the order file. Anyone who can present it completely has passed clause 8.

Only three mandatory records. The standard requires documented information on the order at exactly three places: the result of the review before the commitment (8.2.3.2), the release record with the releasing person (8.6) and the record of nonconformities (8.7.2). Add traceability (8.5.2) and customer property (8.5.3) where they apply. Everything else may sit in the templates the company uses anyway.

What auditors really want to see: an order file — folder or project directory — in which the documents of the nine steps lie together. Not nine forms, but one place. The download shows the list.

📄 The nine steps with clause, document, mandatory record and the auditor's question (German – English version to follow)

Modules 2 to 10 go through the steps one by one: what the standard requires, what the company does anyway, and which sheet demonstrates it. Modules 11 to 13 cover the special cases (sectors, customer property and traceability, capacity), module 14 the errors, module 15 the case study.

Module 2 of 18

Step 1: The enquiry — recording requirements, including the unstated ones

The enquiry is the step where in a small company most stays in the head — and where auditors most often ask for the evidence: “How did you know what the customer really wanted?” Clause 8.2.2 requires the requirements to be determined; 8.2.3.1 a) to d) names the four kinds that are reviewed before the commitment:

Add 8.2.1: communication with the customer about product, enquiries, changes, feedback, customer property and contingency actions — in a small company handled by e-mail, telephone and the quotation itself.

The enquiry sheet — five questions sales answers before the quotation:

1. What exactly does the customer want (service, quantity, quality, documents)?
2. By when, where to, how (deadline, place of delivery, packaging, installation)?
3. What does he expect without saying it (sector, previous supplier, use)?
4. Which laws, standards, customer specifications apply (drawing, specification, certificate)?
5. What is still missing — and whom do I ask?

The answers go on the enquiry itself (note in the margin, note in the e-mail, field in the system) — no separate form, unless the enquiry comes by telephone or at the counter. Then the enquiry sheet is the note of the conversation, and the confirmation e-mail to the customer (module 5) its evidence.

📄 Enquiry sheet with the five questions and feasibility note (for telephone and counter enquiries) (German – English version to follow)

What auditors ask: “Let's take your last enquiry with deviating requirements — special packaging, inspection specifications, a drawing in a foreign language: how did you clarify before the quotation what was meant?” Evidence: the enquiry with note, the query e-mail, the answer. Three documents every company has — if it files them.

Module 3 of 18

Step 2: Feasibility — deadline, capacity, material, qualification before the commitment

“The organization shall ensure that it has the ability to meet the requirements” — before committing (8.2.3.1). That is the feasibility review, and it takes place in every company — in the boss's head, with a look at the planning board, with a call to the workshop. The auditor wants to see that it takes place and that someone is responsible for it.

The four feasibility questions:

The note: one sentence on the enquiry or in the draft quotation: “Feasible by week 12, material 2 weeks lead time, milling machine free from week 10 — M. 3 Mar.” That is the evidence. No form, no round of signatures.

Capacity overview: in companies from five employees a table or planning board pays off: weeks in the columns, employees or machines in the rows, orders as bars. It answers the audit question “How did you decide at the last order peak what is done first, and whether you could promise delivery dates?” — one of the most frequent questions in production and trades.

📄 Capacity overview (Excel): weeks × employees/machines with utilisation formula (German – English version to follow)

Who decides: the organisation chart says who may release quotations up to which amount; the same person decides on feasibility. For large orders (more than 10 % of annual turnover) management decides — that is what the process description V1 says.

The most frequent error: the promise “Sure, we'll do it” on the phone before anyone has checked. No problem if the review follows afterwards and the confirmation e-mail goes out only after the review (module 5). A problem if the deadline is already promised and the milling machine is booked.

Module 4 of 18

Step 3: The quotation — service, price, deadline, exclusions, cooperation

The quotation is the document in which the requirements from step 1 and the feasibility from step 2 come together — and what applies later in a dispute. The standard does not name it, but requires that the requirements are determined and reviewed before the commitment. A quotation that contains the seven components meets that:

Exclusions and cooperation are the components most often missing in small companies — and the reason for most complaints: the customer expects what he did not order. Two lines in the quotation prevent that.

The quotation checklist — ten points the releasing person goes through in two minutes: items complete? Deadline checked (module 3)? Material enquired? Standards named? Exclusions in? Cooperation in? Payment terms? Validity? Price against calculation? Spelling and customer name?

📄 Quotation checklist with ten points and sample exclusion texts for six sectors (German – English version to follow)

Follow-up as a KPI: the quotation hit rate (orders ÷ quotations) is one of the six standard objectives. Anyone who follows up quotations by phone after five days raises it by five to ten points in our experience — and the auditor sees a company that steers its KPI (9.1.1).

Module 5 of 18

Step 4: Order and order confirmation — the mandatory record 8.2.3.2

Here lies the first of the three mandatory records of the order: 8.2.3.2 requires documented information on the results of the review and on any new requirements. In a small company a single document meets that — the order confirmation — if it is really sent and contains three things: reference to the quotation, deviations (or “as quoted”), deadline.

The flow:

1. The order arrives (e-mail, purchase order, signature on the quotation, phone call).
2. Comparison with the quotation: quantity, price, deadline, place of delivery, the customer's conditions (“our purchasing conditions apply”) — every deviation is clarified before the confirmation goes out (8.2.3.1: “differing … requirements are resolved”).
3. Order confirmation to the customer: “We confirm your order of … in accordance with quotation no. … with the following deviation: … Delivery date: week …”
4. Filing in the order file — that is the evidence.

Verbal orders (8.2.3.1, last paragraph): “When the customer does not provide a documented statement of their requirements, the customer requirements shall be confirmed by the organization before acceptance.” An e-mail “As discussed on the phone: 20 pieces type A, delivery Friday, 1,200 net” meets that — and is the order confirmation.

Changes after the order (8.2.4): the customer changes the quantity, the deadline, the colour. The standard requires that the documented information is amended and the persons concerned are made aware. In a small company: a change note in the order file (date, what, who agreed, effect on deadline and price), an e-mail to the customer, a word to the workshop. The most frequent audit finding here: the change is in an e-mail that nobody in the workshop knows — and the part is made in the old colour.

📄 Order confirmation (sample) and change note for the order file (German – English version to follow)

Framework orders and call-offs: the review takes place once for the framework contract (conditions, specification) and for each call-off only for quantity and deadline — a note on the call-off is enough. That is what the process description says, otherwise the auditor asks for the order confirmation for every call-off.

Retailers and service providers: the same rule. The online shop generates the confirmation automatically; the cleaning contract with the schedule of services is the confirmation for the contract term; every additional service gets a short confirmation.

Module 6 of 18

Step 5: Order file and planning — one place for everything (8.1)

Clause 8.1 requires the company to plan its processes: determine requirements, establish criteria for the processes and for the acceptance, provide resources and “retain documented information to the extent necessary to have confidence that the processes have been carried out as planned”. For a small company that is the order file — physical or as a directory — with an order number as the key under which everything lies.

Content of the order file (fixed order):

Anyone who has these eight tabs answers the audit question “Let's take your last order” in two minutes. Anyone who keeps them digitally (project folder with eight subfolders or fields in the ERP) likewise. The file is at the same time the design file if the order contains design (8.3) — then inputs, review note and test plan go in tabs 3 and 6.

Procurement for the order (8.4, overview): material and external services are ordered from listed suppliers; the purchase order names order number, specification, deadline and — if required — records (certificate, test report). Goods receipt and supplier evaluation are covered by the course “Suppliers, People, Measuring Equipment”. Outsourced processes (contract manufacturing, subcontractors, data centre) are part of the order and are commissioned with the same requirements; the record of their verification goes in tab 4 or 6.

📄 Order file: cover sheet with order data, deadline tracking and the eight tabs (German – English version to follow)

Deadline tracking: the cover sheet of the file carries deadline promised, deadline planned, deadline achieved. That is the source for the KPI on-time delivery — and the answer to “Let's take a project that was finished late: how did you notice in time and what did you tell the customer?” (e-mail in tab 2).

Module 7 of 18

Step 6: Execution under controlled conditions (8.5.1)

“Controlled conditions” sounds like a clean room. What is meant is: the person doing the work has the right thing in hand — the right drawing in the right revision, the right tool, the knowledge, and someone notices when something goes wrong. Clause 8.5.1 lists eight points; this is what they look like in a small company:

Drawing revision is the classic finding: revision B is at the workplace, revision C in the file. Rule: mark drawings with revision, withdraw old ones on change (the change note from module 5 triggers that).

Work instructions only where they are needed: for tasks that not everyone can do, that occur rarely or where an error is expensive. A company with twelve employees typically has three to six — not thirty. Everything else is briefing (7.2) and is in the briefing record.

Validation (f): only for processes whose result the final inspection does not show. Trades: welding, bonding, roof sealing. Services: data backup (restore test), disinfection. Retail: usually nothing — then the manual says “all outputs are verified by subsequent inspection”.

The test at the workplace: go with the order file to the workplace of the current order and check a) to g) in five minutes. That is exactly what the auditor does in stage 2.

Module 8 of 18

Step 7: The one check point — release with evidence (8.6)

The second mandatory record: 8.6 requires that the release to the customer takes place only after successful verification and that documented information contains evidence of conformity and traceability to the person authorising the release. Three questions the inspection record answers: what was checked? With what result? Who released?

Exactly one check point. The value creation process has one place where the release to the customer is decided. In-process checks by the operator are permitted and sensible (8.5.1 c), but they are not the check point and need no record. Anyone who writes five inspections into the process description must show five records — that is the most frequent self-inflicted audit finding in clause 8.

Scope of inspection: what is checked is determined beforehand (8.1 b: “criteria for the acceptance”): the characteristics of the drawing, the points of the bill of quantities, the test cases of the test plan. A record that only says “OK” without saying what was checked is not evidence.

What “successful” means: all characteristics within tolerance. If one is outside, it is not a release but step 8 (nonconformity) — or a concession with the customer's consent (module 9). A record with one red value and a tick “released” without a note is a nonconformity.

📄 Inspection record (manufacturing), acceptance record (trades/construction), function test (IT) and site check (services) as templates (German – English version to follow)

Traceability to the person: initials are enough if a list of initials exists; a signature is usual; a user name in the system likewise. What is not enough: “Production” as the releasing party — the standard wants a person.

Measuring equipment: whoever measures needs suitable, verified measuring equipment (7.1.5.1) and, where traceability is required, calibration (7.1.5.2). The record names the measuring equipment (number from the measuring equipment list). Retailers and service providers without measuring equipment exclude 7.1.5.2 — the record then names the method (visual inspection, function test, comparison with the order).

Module 9 of 18

Step 8: Nonconformity — block, correct, inform the customer, concession (8.7)

The third mandatory record: if the verification in step 7 was not successful — or a nonconformity is noticed before or after — 8.7 requires that the output is identified and controlled so that it does not go to the customer by mistake, and that documented information records: what was nonconforming, which action, which concession and who decided (8.7.2).

The four reactions (8.7.1 a to d):

The blocking note in a small company: a red tag or sticker (“BLOCKED — order 2026-114 — reason — date — initials”) and a place that counts as the quarantine area (shelf, box, folder “blocked” in the system). No more identification is needed; everyone just has to know it. For services the “quarantine area” is the ticket status or a note in the duty roster: “Site X — re-cleaning before invoice”.

Who may decide (8.7.1: “authority”): the organisation chart says who may block and release products — in a small company head of production or management. The concession additionally needs the customer's consent if a customer requirement is affected; an internal tolerance may be released by the authorised person alone.

Internal nonconformity or complaint? Both are 8.7; the complaint comes from the customer and additionally triggers 10.2 (cause, corrective action). One form for both is enough: nonconformity sheet with origin “internal / customer”. The course “Complaints, KPIs, Customer Satisfaction” covers the complaint in detail.

📄 Blocking note (tag to print out) and nonconformity sheet under 8.7.2 with the four reactions (German – English version to follow)

What auditors ask: “Let's take your last blocking: how can one trace why it was blocked, who decided that and what the customer learned?” Evidence: nonconformity sheet, blocking note, e-mail to the customer, renewed inspection record. A company that says “We had no nonconformities” gets the question how it knows that — zero defects is less credible in the audit than three documented ones.

Module 10 of 18

Step 9: Delivery, invoice, after-sales (8.5.4, 8.5.5)

The order is verified and released; now it has to arrive at the customer intact, be invoiced — and after that the company is not finished. Three clauses regulate this.

Preservation (8.5.4): product and service output must be protected up to handover — identification, handling, packaging, storage, transport, for data: integrity and protection. In a small company: packaging instruction on the order (“edge protection, flat”), storage place with order number, transport insured, data handover encrypted. The evidence is the delivery note with date, item, quantity, signature of the recipient — or the handover record for installation and IT.

Invoice: not a topic of the standard, but every auditor sees it as the close of the file — and the tax authority requires mandatory details. The invoice checklist: invoice = order confirmation + change notes? Delivery note referenced? Mandatory details under your national VAT law (name and address of both parties, tax or VAT number, date, consecutive invoice number, service, date of supply, amount, tax rate, tax amount)? Payment term? That goes in tab 8.

Post-delivery activities (8.5.5): the standard requires the extent to be determined — according to statutory requirements (warranty, recall, product monitoring), risks, customer requirements and feedback. In a small company:

📄 Delivery note and handover record (sample), invoice checklist with mandatory details (German – English version to follow)

Feedback as a KPI: the follow-up after delivery (“Everything all right? Grade 1 to 6?”) feeds customer satisfaction (9.1.2) without a questionnaire campaign. A column “feedback” on the cover sheet of the order file is enough — at year end the average goes in the management review.

Module 11 of 18

The nine steps in six sectors: where they differ

The nine steps are the same in every sector — but three of them look different each time: how the requirements are determined (step 1), what the check point is (step 7) and what comes after delivery (step 9). Anyone who describes these three correctly for his sector has the value creation process.

Two value creation processes when two services with different check points are offered: manufacturing and installation, retail and repair, project and support. Each with at most nine steps and one check point; steps 1 to 4 may be shared.

📄 The nine steps for six sectors as a four-field table with document per step (German – English version to follow)

Where 8.3 comes in: whenever the company determines how something is done instead of doing it to specification — design, concept, recipe, planning, training concept. Then step 3 (quotation) becomes a design step with inputs (8.3.3), review (8.3.4) and outputs (8.3.5), and the order file carries them in tabs 3 and 6. That does not change the nine steps — it fills them.

Module 12 of 18

Customer property and traceability: the two forgotten records (8.5.2, 8.5.3)

Two short clauses that are regularly overlooked in small companies — and that auditors like to check, because the answer shows whether the company knows its standard.

Traceability (8.5.2): the standard requires identification of outputs “where necessary” and — when traceability is a requirement — unique identification with records. It is a requirement when the customer demands it (automotive, rail, medical), a law (food, medical devices, pressure equipment) or the company's own decision (make a recall possible). In a small company this is then enough: batch or serial number of the material on the inspection record and the delivery note, order number as the key between everything. The question “Show me which material batch this part is from” is answered with two documents. Anyone who needs no traceability writes it in the manual: “Traceability via the order number; batches are recorded only at the customer's request.”

Customer property (8.5.3): everything that belongs to the customer and is with the company — exercise care, identify, verify, protect, and on loss, damage or unsuitability report to the customer and record. The standard expressly names materials, components, tools, premises, intellectual property and personal data. That is why almost every company has customer property:

One sentence in the manual and one line in the process description V1 (“Customer property is identified; loss or damage is reported to the customer immediately and documented on the nonconformity sheet”) meet 8.5.3. Excluding 8.5.3 can almost never be justified — anyone who tries gets the question about customer data in the stage 1 audit.

Preservation of customer property (8.5.4) belongs to it: store free-issue material like your own, back up customer data like your own.

Module 13 of 18

Capacity, deadlines and order peaks: delivery promises that hold

On-time delivery is the KPI by which customers judge small companies — and the audit question that almost always comes in production and trades: “Show me how you decided at the last order peak which orders are made first, and whether you could promise delivery dates.” The answer needs three things:

1. A capacity overview that shows what is booked when. Planning board on the wall, Excel table (download from module 3), calendar or ERP — the form does not matter, the status must be current. Weeks × employees or machines; every order a bar; holidays and maintenance entered. In companies up to five employees the order list with deadline and estimated hours is enough.

2. A rule for the order of priority that is in the manual or in V1 — for example: promised deadline before date of receipt; regular customers before new customers at the same deadline; orders with contractual penalty first; decision in case of conflict by management. Without a rule, whoever calls loudest decides — and the auditor knows that.

3. Buffer and communication: the order confirmation names the deadline with a buffer (week instead of day, “expected by”); if it nevertheless becomes uncertain, the customer learns of it before the deadline, not afterwards (8.2.1 — communication about changes). The e-mail is in tab 2 of the order file and is the evidence for “Let's take a project that was finished late: how did you notice in time and what did you tell the customer?”

Deadline tracking: the cover sheet of the order file carries three dates — promised, planned, achieved. The source of the KPI on-time delivery (share of orders with achieved ≤ promised) and of the standard objective “on-time delivery ≥ 95 %”.

What to do when capacity is not enough: the honest answer is one of four: postpone the deadline (with the customer), contract manufacturing or subcontractor (8.4 — listed supplier), overtime (within the working time law of your country!), decline the order. All four are permissible; only “promise and hope” is not.

Module 14 of 18

The ten most frequent audit findings in clause 8 — and the sentence that prevents them

Ten findings that together make up the largest part of the findings on clause 8 — each with the clause, the evidence by which the auditor recognises it, and the rule that prevents it.

The ten-minute check before the audit: pull three orders of the last three months — a large one, a small one, one with a nonconformity — and check the ten points per file. What is missing is caught up in an hour (sending a confirmation retrospectively does not work — but the rule from tomorrow does).

📄 Thirty audit questions on the order from real audits with the respective evidence (German – English version to follow)

What is not a finding: a documented nonconformity with blocking note, customer information and re-verification. That is the proof that 8.7 works — auditors note it as a strength.

Module 15 of 18

Case study: Waldner Joinery — order file 2026-164 with three errors

Waldner Joinery (fictitious) makes with 14 employees windows and front doors, interior fit-out and made-to- measure furniture for private and commercial customers, developers and architects — workshop with CNC under a foreman, two installation teams, office with sales, work preparation and administration. Order 2026-164: a tax adviser orders a reception counter to an architect's drawing, oak veneer, with a glass top supplied by the customer; installation on site; deadline before the opening of the practice.

The file contains: architect's enquiry e-mail with drawing rev. A · site measurement sheet from the site visit · foreman's feasibility note · quotation with exclusions and cooperation · customer's order with change request (cable grommet) · order confirmation · drawing rev. B · purchase order veneer and fittings · delivery note glass top (free issue) · CNC routing card · workshop inspection record · installation order · acceptance record · nonconformity sheet (scratch on glass top) · delivery note · invoice · customer feedback.

Your task (60 minutes):

1. Go through the file along the nine steps (download 12) and enter for each step which document demonstrates it and which clause is met.
2. Find the three errors an auditor would note as findings. Hints: one concerns module 5, one module 8, one module 12.
3. Write the process description V1 for Waldner as a four-field table (at most nine steps, one check point) — template in the download.

📄 Waldner: the complete order file 2026-164 (17 documents) with three hidden errors (German – English version to follow)

📄 Waldner: model solution — document per step, the three errors with clause, process description V1 (German – English version to follow)

The places where most participants deviate: the site measurement sheet is the determination of requirements (8.2.2), not the architect's drawing alone · the glass top is customer property (8.5.3) — its scratch belongs in step 8 and as a report to the customer · the workshop inspection record is an in-process check; the check point is the acceptance at the customer.

Time balance Waldner: keeping the file costs about 20 minutes more per order than without a system — and saves many times that at the first dispute about “that was not ordered”. In the stage 2 audit clause 8 was checked on this file in 25 minutes.

Module 16 of 18

Records: The order file as evidence for clause 8 — and the link to 9 and 10

At the end of the course there is a single result: the order file that demonstrates each of the nine steps. It is the evidence for clause 8 — and the source for three further clauses.

Retention: ten years (business records, product liability — check the periods of your country) — as folders in the archive or directory with backup. The file is at the same time the answer to every later question: warranty, recall, repeat order (“How was that back then?”).

Checklist for your own file — 18 criteria, 0 to 2 points each:

📄 Checklist: rate your own order file in 18 criteria (mature / almost / not yet) (German – English version to follow)

Below 24 of 36 points: go through three orders according to module 15, introduce the templates from this course, check again after four weeks. From 30 points clause 8 is audit-proof.

What follows: the file shows suppliers (tab 4), people (tab 5) and measuring equipment (tab 6) — the topics of the course “Suppliers, People, Measuring Equipment”. And it supplies nonconformities and feedback — the topics of the course “Complaints, KPIs, Customer Satisfaction”.

Module 17 of 18

Legal framework: contract, acceptance, invoice — what the standard does not regulate, but the law does

ISO 9001 regulates that requirements are clarified, releases demonstrated and nonconformities documented. What applies in a dispute is regulated by the law — and the documents of this course are at the same time those that count in court. The rules differ by country; the table shows the principles with Germany as the example. No legal advice; but five check points every small company should know — with the figures of your own country.

The acceptance is both for trades, construction, IT and plant engineering: the check point of the standard (8.6) and the legal act of the contract for work. An acceptance record meets both — if it contains a defect list (even if empty) and both sides sign. Without the customer's signature it is a handover record, not evidence of acceptance.

What is not checked in the audit: whether the contract is legally valid, whether the terms and conditions are incorporated, whether the warranty period is right. That is the business of the company and its lawyer. What is checked is whether the requirements — including the statutory ones (8.2.2 a) — are known: the list of standards and laws names the civil code, construction contract rules, VAT law and product liability law of your country if they apply to the company.

Status of the information: October 2026. Periods and mandatory details change; the list of standards and laws is reviewed annually.

Module 18 of 18

Procedure in our company

Your company completes this module. The general part of the training ends here; what follows, only your company knows:

Companies with a company account of the Academy receive this module with their own details; participants then see the names, dates and filing locations of their company. Without customisation: ask your management or your quality manager where these details are laid down in your company — usually in the quality manual.

Final test

40 questions, one correct answer each. You need 32 correct answers to pass (80 %). Scoring happens on the server — there is no answer key on this page.

Your result