Quality Manager Training – quality management representatives under ISO 9001

18 modules · about 79 minutes · final test with 25 questions, 18 correct to pass · certificate of participation as PDF

What this course is about

The quality manager is the key role in most ISO 9001 companies — and is often handed to someone “on the side”, without a budget for a multi-day seminar. Yet since the 2015 edition the function is no longer mandatory in the standard: clause 5.3 requires top management to assign roles, responsibilities and authorities, and clause 7.2 requires the person to be competent for it and that this is demonstrated.

No registration needed. We only ask for your name and e-mail address before the final test – just for your certificate. Your progress is saved in this browser. You can stop at any time and continue later.

Module 1 of 18

The QM philosophy — describe instead of invent

“We describe what you do. We introduce nothing.” — Holger Grosser, QM-Dienstleistungen

Many companies are afraid of ISO 9001 because they think: “Now we have to turn everything upside down.” That is wrong. A good QMS is not a parallel universe. It reflects how you actually work — not how you theoretically should work. Whoever has been successful in the market for ten or twenty years is obviously doing a lot right. Exactly that is documented.

The standard itself supports this approach: under clause 7.5.1 the extent of documented information depends on the size of the organisation, the type of its activities and the complexity of its processes. A company with ten employees does not need a 200-page manual.

The goal of a good QMS

• Reflect reality — no theoretical wishful thinking
• Be simple and understandable — what is complicated, nobody uses
• Be practised by the employees — it must work in everyday life
• Make you fit for the audit — without needing the consultant for it

The biggest problem of many QM systems

They are inflated and nobody uses them. After certification the manual gathers dust on the shelf, the QMS becomes “paper for the auditor” instead of a tool. Our approach instead: as little as possible, as much as necessary.

The three principles of success

To remember

“You can manage that on your own, I always say. Otherwise we would have done something wrong if you needed us at the audit.” After more than 1,000 projects: the best QM systems are those whose companies pass the external audit confidently on their own.

Module 2 of 18

The normative frame — ISO 9001:2015 with the 2024 amendment and outlook on 2026

ISO 9001 is the most widespread standard for quality management systems worldwide. What the letters and numbers mean:

The national editions are identical in content: the same standard applies in your country and worldwide — a certificate is recognised internationally. It fits every sector and every size, from the three-person craft business to the group, for production as well as for services.

Status 2026: the climate change amendment already applies

Since February 2024 the amendment ISO 9001:2015/Amd 1:2024 is part of the standard. It adds two places: in 4.1 the organisation must determine whether climate change is a relevant issue for it; in 4.2 a note makes clear that interested parties can have climate-related requirements. Certification bodies have audited this since 2024. A “not relevant” is permissible — but only with a traceable reasoning.

Why companies certify

• The customer demands it — many large customers require a certificate from suppliers
• Tenders — often a prerequisite for public contracts
• Winning new customers — the certificate creates trust
• Securing knowledge — documented processes stay, even when employees leave
• Induction — new colleagues orient themselves by the procedures

Typical is the call: “A large customer asks whether we are ISO 9001 certified — otherwise we lose the order.” That is the most frequent reason and completely legitimate.

Outlook: ISO 9001:2026

The revised edition ISO 9001:2026 was published on 16 September 2026; the national adoptions usually follow a few months later. New are, among other things: quality culture and ethical behaviour as a leadership task, separate treatment of risks and opportunities and the firmly built-in climate question. For existing certificates to the 2015 edition a transition period of 36 months applies: they lose their validity on 30 September 2029 at the latest. Binding dates for your company are given by your certification body.

To remember

Until the transition the 2015 edition applies including the climate amendment of 2024. For the transition in detail there is the course “Transition to ISO 9001:2026” in the Academy.

Module 3 of 18

The role of the quality manager — what the standard requires today

The quality manager (quality management representative) is the key figure of the QMS in many companies. Nevertheless the role is no longer in the standard as such: up to the 2008 edition clause 5.5.2 required a “management representative”. Since the 2015 edition this mandatory function has been dropped.

What applies instead — clause 5.3

Top management must ensure that responsibilities and authorities for the relevant roles are assigned, communicated and understood. To be assigned explicitly is who

These tasks may be distributed among several persons — or bundled with one person who is still called “quality manager”. Both conform to the standard. The title is free; what matters is that the assignment is traceable, for example in the organisation chart, in a job description or in the manual.

What the quality manager cannot take over

Under clause 5.1 top management holds accountability for the effectiveness of the QMS. It can delegate tasks, not the responsibility. A QMS that “the quality manager does” while management keeps out of it is a typical audit finding.

Competence of the quality manager — clause 7.2

Whoever holds a QM role must be competent for it, and the organisation must demonstrate this as documented information: education, training or experience. This training with certificate is such evidence.

To remember

The standard does not require a quality manager — it requires that someone carries out the tasks from 5.3 and that management stands behind it. Whether you call this person quality manager is your decision.

Module 4 of 18

Terms of the standard explained plainly

ISO 9001 uses its own technical language. The translation into plain workplace language:

The former term “management representative” has disappeared since 2015 — see the module on the role of the quality manager.

Important abbreviations in everyday QM

Why the language is so complicated

The standard must fit all sectors worldwide — from the hospital in Japan to the joinery in Bavaria. Annex A.1 makes explicitly clear: you do not have to adopt the terms of the standard. “Complaint” instead of “nonconformity” is perfectly fine.

Do I have to buy the standard?

Not necessarily. The standard is available for a fee from ISO or your national standards body. In consulting practice more than 90 % of audits have worked without the company's own copy — the consultant has it and explains what matters.

Practical tip for the audit

If the auditor uses a term you do not understand: ask. Auditors appreciate honest questions more than guessing.

Module 5 of 18

Process approach and PDCA cycle

ISO 9001 thinks in processes: activities that turn inputs into outputs. Clause 4.4 requires that you determine your processes — with inputs and outputs, sequence and interaction, responsible persons, resources, criteria and KPIs, risks and opportunities.

The most important process: an order

Example Müller Engineering, mechanical engineering: the Schmidt car dealership calls and wants a vehicle lift serviced. This is how the order runs through the company:

Every step has a responsible person and leaves evidence. The process approach requires no more — often a flowchart is enough.

The PDCA cycle (Deming cycle)

Clause 0.3.2 of the standard builds the whole system on this cycle:

The clauses of the standard follow this cycle: planning (6), support and operation (7, 8), performance evaluation (9), improvement (10).

To remember

“Never explain theoretically — always show practically.” Whoever can demonstrate his order process on a real order has understood the process approach.

Module 6 of 18

Documented information — which documents you really need

ISO 9001 requires “documented information” — that does not mean you need a filing cabinet full of paper. The standard distinguishes two kinds:

Under 7.5.1 this includes what the standard requires and, in addition, what you yourself consider necessary for effectiveness. Much evidence you have long had: quotations, invoices, e-mails, delivery notes, employment contracts.

No mandatory manual any more

Since the 2015 edition the standard no longer prescribes a quality manual (Annex A.6). Many companies keep a lean company manual as the “constitution” of their system — 10 to 30 pages are enough. That is sensible, but your own decision.

Which instruction for what?

Control — clauses 7.5.2 and 7.5.3

Documents need identification (title, date or version), approval and must be available where they are needed. Outdated versions must not be used by mistake.

The pragmatic approach

“As little as possible, as much as necessary.” Document what makes sense — not what looks impressive.

Module 7 of 18

Risks and opportunities — risk-based thinking

Since the 2015 edition risk-based thinking is a core element of ISO 9001. That sounds complicated but is simple: what can go wrong — and what can we do about it? And: where are the opportunities?

Where the risks come from

Clause 6.1 builds on the context (4.1) and the interested parties (4.2). Since the 2024 amendment this includes the question of whether climate change is relevant for your company — for instance through heat, heavy rain, supply chains, energy prices or customer requirements for CO₂ data.

How a simple risk analysis works

The standard prescribes no method (Annex A.4). What has proven itself:

1. Determine risks — what could cause us problems?
2. Estimate probability (1 low, 2 medium, 3 high)
3. Estimate impact (1 minor, 2 medium, 3 severe)
4. Rating = probability × impact
5. For high risk define actions and evaluate their effectiveness (6.1.2)

Typical risks

Skills shortage and loss of key persons, supplier failure, IT failure and data loss, defective products at the customer, changes in the law, climate consequences.

Do not forget opportunities

New markets, new technologies, partnerships, better processes — the standard requires opportunities just as much as risks. ISO 9001:2026 treats both in separate sub-clauses (6.1.2 risks, 6.1.3 opportunities).

To remember

The risk and opportunity analysis is updated at least annually and flows into the management review (9.3.2 e).

Module 8 of 18

Quality objectives and process KPIs

ISO 9001 requires quality objectives that are consistent with the quality policy. Clause 6.2.1 demands: they must be measurable, monitored, communicated and updated as appropriate. What you cannot measure you cannot improve.

For every objective you define under 6.2.2: what will be done, what resources are needed, who is responsible, by when and how the result is evaluated.

The annual sequence

1. Evaluate the objectives of the previous year — achieved? If not, why not?
2. Define new objectives with concrete actions
3. Determine responsible persons
4. Review regularly — not only at year end

Good objectives are SMART

Examples: keep the complaint rate below 2 % (currently 2.5 %) · customer satisfaction above 90 % in the next survey · on-time delivery above 95 % · reduce lead time by 10 % · scrap rate below 1 %.

Poor objectives: “improve quality” or “make customers more satisfied” — without a number nobody can say whether the objective has been achieved.

Practical tip

A missed objective is no drama if you can explain it. “Sales objective not achieved because of a cyber attack at the main customer” is an acceptable reasoning — it belongs in the management review.

Module 9 of 18

Supplier evaluation — controlling external providers

ISO 9001 requires that you control your external providers — suppliers, service providers, subcontractors. The reason: if the supplier delivers poorly, your customers suffer.

Clause 8.4.1 requires criteria for evaluation, selection, monitoring of performance and re-evaluation of external providers. The results are to be retained as documented information. The standard names no fixed rhythm; in practice once a year has proven itself, and auditors expect that too.

How to proceed

1. Determine the essential suppliers — not every stationery dealer
2. Choose a method: grade scale, A-B-C classification or points system
3. Define criteria
4. Evaluate regularly
5. In case of a poor result: talk, agree an action, change supplier if necessary

A simple table is enough. What matters is that evaluation takes place and that there is a reaction to problems.

If a supplier scores poorly

Do not change immediately. Talk first, give a chance to improve and document the conversation. Only if nothing changes: look for an alternative.

Module 10 of 18

Competence, training and qualification matrix

ISO 9001 requires that persons whose work affects quality are competent — through education, training or experience. Under clause 7.2 you must also evaluate the effectiveness of the actions taken and retain evidence of competence.

The training process

1. Determine needs — who needs which training? (e.g. from the qualification matrix)
2. Plan — when, where, by whom?
3. Carry out
4. Retain records — certificates of attendance, certificates
5. Evaluate effectiveness — can the person apply what was learned? (7.2 c)

The qualification matrix

It is the most important tool for competence management. It shows who can do what, where competence is missing, where risks lie (only one person can do something) and who deputises for whom.

✓✓ = expert · ✓ = can do it · – = not qualified

Awareness — clause 7.3

All employees must know the quality policy, the objectives relevant to them, their contribution to effectiveness and the consequences of errors.

Effectiveness check — often forgotten

Attendance alone is not enough. Note for example: “Effectiveness checked by supervisor on [date] — employee applies the new knowledge successfully.” If that is missing, it is a frequent audit finding.

Module 11 of 18

Determining and using customer satisfaction

Under clause 9.1.2 the organisation must monitor how its customers perceive the fulfilment of their needs and expectations. You define the method yourself — the main thing is that you do it and evaluate it.

“Your most unhappy customers are your greatest source of learning.” — Bill Gates

Methods

With positive feedback

Be pleased — and use it: ask satisfied customers for a review or a reference letter.

With negative feedback — do not ignore

1. Analyse the cause — why is the customer dissatisfied?
2. Initiate an action — what do we change?
3. Document — in the action plan
4. Let it flow into the management review (9.3.2)

The pragmatic approach

You do not have to survey every customer. A representative sample is enough — or you rate your twenty most important customers yourself by objective criteria such as repeat purchases, complaints and payment behaviour.

Module 12 of 18

Nonconforming outputs, corrective actions and action plan

Errors happen. The standard does not require that there are none — it requires a regulated way of dealing with them. There are two clauses for that.

Clause 8.7 — the nonconforming output itself

A nonconforming output (defective part, deficient service) must be identified and controlled so that it is not used or delivered by mistake. Possible under 8.7.1:

To be retained under 8.7.2: what the nonconformity was, what was done, which concession was granted and who decided on the action.

Clause 10.2 — the cause

In case of a nonconformity, also from a complaint, you react: correct the error, determine the cause, check whether similar cases exist or could exist, implement a corrective action and check its effectiveness. The correction removes the error — only the corrective action removes its cause.

The action plan

Every action needs: What? · Who? · By when? · Status (open, in progress, done) · Effectiveness (did it work?).

The biggest problem

If nothing happens after the audit, QM loses its meaning in the company. If an action is not implemented, document the reason — “not implemented because budget not approved” is better than no explanation at all. Auditors accept reasoned decisions.

Module 13 of 18

The internal audit

The internal audit is the self-check of your QMS — before the external auditor comes. Clause 9.2 requires internal audits at planned intervals and an audit programme. The standard names no fixed rhythm; because the certification body comes every year and wants to see the result, at least once a year has become established.

Types of audits

Rules for internal audits

• Do not audit your own area — 9.2.2 c) requires objectivity and impartiality. The head of sales does not audit sales.
• Open questions — “How does that work with you?” instead of “Do you do it this way?”
• Do not criticise — the audit looks for improvements, not for culprits
• Document — retain audit programme and results (9.2.2 f), report results to management — in an audit report of 2 to 4 pages

Audit findings

The classification major/minor comes from the practice of certification bodies (ISO/IEC 17021-1), not from ISO 9001 itself.

To remember

“An audit is successful when you learn something — not when the auditor is satisfied.” The internal audit is your dress rehearsal.

Module 14 of 18

The management review

The management review is the annual report of top management on the QMS. Clause 9.3.1 requires that top management reviews the system at planned intervals — in practice once a year, before the external audit.

Inputs — what must go in under 9.3.2

Outputs — what comes out under 9.3.3

Decisions on opportunities for improvement, on necessary changes to the QMS and on resource needs. The output is to be retained as documented information.

Need not be long

Three to five pages are enough. Proven structure:

• Cover sheet with date, version and approval
• Summary of the most important points
• KPIs compared with the previous year
• List of the new actions
• Conclusion, e.g. “The QMS is suitable, adequate and effective.”

To remember

The standard requires no signature — it requires that top management itself reviews. Approval by the managing director, for instance by signature, is the simplest evidence of that. The quality manager prepares, management reviews.

Module 15 of 18

External audit and certification cycle

An ISO 9001 certificate is valid for three years. Nevertheless the certification body comes every year.

Under ISO/IEC 17021-1 surveillance audits take place at least once per calendar year; the first at the latest twelve months after the certification decision. The recertification audit must be completed in good time before expiry of the certificate — colloquially “in the fourth year”, in fact at the end of the third. Then the cycle begins anew.

What is always checked in the surveillance audit

Currency of the company manual or documentation · internal audit report · management review · action plan · two to three processes in depth. The surveillance audit is shorter, often half a day — but the basic requirements are the same.

What auditors really check — and what not

Briefing for your employees

“The auditor will ask: how does an order run? Who does what? What happens in case of problems? Just show what you do every day. No fear of honesty — the auditor wants to see that we do good work, not that we are perfect.”

Module 16 of 18

Practice case: presenting an order in the audit

The auditor says: “Please show me a completed order.” Now the preparation pays off.

The preparation — two to three orders

Example folder “Order 2026-0815”

• Enquiry (e-mail of 15 March)
• Quotation QU-2026-0815
• Order confirmation OC-2026-0815
• Work report and delivery note
• Invoice IN-2026-0815
• If applicable, complaint with solution and corrective action

The professional's trick: show it backwards

Invoice → delivery note → order → quotation → enquiry

Whoever immediately finds the original enquiry for every invoice proves complete traceability (8.5.2) and a working filing system (7.5.3). That convinces more than any process description.

What can go wrong in the case

• The quotation is missing because it was agreed by phone → a phone note or order confirmation with scope of service suffices.
• The complaint is settled but noted nowhere → add it: what, who, which solution, which cause.
• The employee explains at length instead of showing → “Never explain theoretically — always show practically.”

Module 17 of 18

Procedure in our company

Your company completes this module. The general part ends here — what follows now, only your company knows.

For management

What most often remains unclear is the deputy of the quality manager. If he is absent before the audit, someone else must know where the internal audit report and the management review are.

Module 18 of 18

Records and annual duties

Finally, what makes this training and your QMS verifiable.

The annual checklist

These records are retained (7.5.3), best in a fixed place with the date in the file name — then the deputy finds them too.

This certificate as evidence

Clause 7.2 d) requires retaining the competence of persons in QM roles as documented information. The certificate of participation documents name, date, result and the complete list of topics. File it with the training records, enter it in the qualification matrix and note the effectiveness check, for example after the next internal audit.

You are now ready

The QMS is there for you, not the other way round. It should help you get better — not create additional work. As little as possible, as much as necessary.

Final test

25 questions, one correct answer each. You need 18 correct answers to pass (70 %). Scoring happens on the server — there is no answer key on this page.

Your result