The Quality Manual in 5 Days: documentation the certification body recognises

17 modules · about 103 minutes · final test with 36 questions, 29 correct to pass · certificate of participation as PDF

What this course is about

This course shows how a company with 1 to 50 employees writes its ISO 9001 documentation in five working days – not as a mountain of paper, but as a combined company and process manual of 25 to 40 pages that the certification body recognises and that is really used in the company.

No registration needed. We only ask for your name and e-mail address before the final test – just for your certificate. Your progress is saved in this browser. You can stop at any time and continue later.

Module 1 of 17

What a quality manual is today — and what the standard really requires

Since 2015 ISO 9001 no longer requires a manual. It requires “documented information” — at around twenty places, sometimes as a document to be maintained (scope, policy, objectives), sometimes as a record (audit report, inspection result, complaint). Anyone who serves these twenty places individually ends up with twenty files that nobody finds. That is why small companies bundle them in one document: the combined company and process manual.

The structure that has proven itself (25 to 40 pages):

• Ch. 0 Cover sheet with status, approval and scope; table of contents and change register
• Ch. 1 The company: context, interested parties, scope and exclusions (ISO 9001 clause 4)
• Ch. 2 Quality policy with management's statement of commitment (ISO 9001 clause 5.2)
• Ch. 3 Organisation: organisation chart as a table, roles and deputies (ISO 9001 clause 5.3)
• Ch. 4 Objectives, risks and opportunities (ISO 9001 clause 6)
• Ch. 5 Resources: people, infrastructure, measuring equipment, knowledge (ISO 9001 clause 7)
• Ch. 6 Process map and process descriptions: management, value creation, support (ISO 9001 clauses 4.4 and 8)
• Ch. 7 Measurement and improvement: KPIs, audit, management review, actions (ISO 9001 clauses 9 and 10)
• Ch. 8 Documented information: control, filing, retention, list of mandatory records (ISO 9001 clause 7.5)

Every section answers three questions: What do we do? Who is responsible? Where is the record? The auditor needs no more — and nobody in the company reads more. The download shows the structure with page guide values and the reference to the standard per section.

📄 Manual structure with reference to the standard and page guide values (German – English version to follow)

Five days, one plan: day 1 questionnaire and documents · day 2 context and scope · day 3 processes · day 4 policy, objectives, organisation · day 5 document control, mandatory records, approval. Per day three to four hours of concentrated work by the boss or quality manager; the days may be spread over two weeks.

Module 2 of 17

The basic rule: only what is practised is described

The most frequent nonconformity in the certification audit of small companies is not “That is missing” but “That is in the manual but is not done”. The auditor reads: Suppliers are evaluated annually — and asks for the evaluation. If there is none, that is a nonconformity the company wrote for itself. That is why one single rule applies when writing: only what is practised in the company today is described. What is not yet practised goes into the chapter objectives as a quality objective with deadline — not into the manual as a claim.

The doorstep rule: stand at the door of your company and describe what happens behind it when an order comes in — not what should happen. Every sentence must be substantiable by a piece of paper, a screen or a person the auditor can ask.

Cutting back an overly thick manual: print the old manual and mark every sentence with one of three signs — ✔ is practised and substantiable, ✘ is not practised, ? nobody knows. Everything with ✘ and ? is deleted or becomes an objective. In practice 30 of 100 pages remain, and those withstand every audit.

How you notice that you are writing too much: you use words of the standard that nobody in the company uses (“conformity”, “interested parties”, “documented information”). Write as you talk — the reference to the standard goes in brackets after it: Complaints (clauses 8.7, 10.2).

Module 3 of 17

Day 1: The questionnaire — twelve sections from which the documentation emerges

Everything in the manual comes from answers to questions — and to the same questions in every company. That is why day 1 begins with a questionnaire: twelve sections, around 60 questions, two hours. Anyone who fills it in completely has 70 % of the manual in raw text.

Three rules when filling in: first, short answers — keywords, not sentences; the sentence is written on day 3. Second, “Don't know” is a permitted answer and marks a gap that goes into the manual as an objective. Third, note for every answer the document that exists for it (quotation template, supplier list, inspection record) — that becomes the column “record” in the process.

📄 Documentation questionnaire (Word, twelve sections) (German – English version to follow)

The questionnaire is fillable as a Word file. Anyone who hands it to a service provider gets the documentation made from it; anyone who writes himself works through it on days 2 to 5. Example of a completed questionnaire: module 15 (practice company Nordlicht).

Module 4 of 17

Day 1: Collecting documents — what already exists is not written anew

The second biggest error after writing too much is writing twice: companies draw up a “QM quotation template” although the quotation template used for years is perfectly fine. The manual does not describe the template, it refers to it. That is why the second half of day 1 is pure collecting.

The collection list — available in almost every company:

Collection folder: create a folder QM with twelve subfolders, numbered like the list. Every document goes in as a copy (or link). What is missing is not created on day 1 — it is marked “missing” in the list and on day 5 it is decided whether it becomes an objective or whether the statement in the manual is deleted.

Rule of thumb: if more than four of the twelve documents are missing, the company is not yet ready for certification in five days — then first two weeks of tidying up the company, then writing.

The filing from this collection list becomes the filing structure of the manual on day 5 (module 12). Anyone who sets it up this way from the start saves the move.

Module 5 of 17

Day 2: Context and interested parties on one page

Clause 4 is the clause in which consultants write pages about “megatrends” and auditors leaf through pages. For a small company one page with two tables is enough. The standard wants to know: what influences your company from outside and inside (4.1)? Who makes requirements of you, and which (4.2)? Both must be “monitored and reviewed” — that happens once a year in the management review.

Table 1 — Context (4.1):

Table 2 — Interested parties (4.2):

Every row with “Yes” must be found again elsewhere in the manual: as a process, KPI, objective or risk. That is the test auditors do — they take a party and ask: “Where do you take care of that?”

📄 Context sheet: both tables to fill in with examples from four sectors (German – English version to follow)

The external and internal issues are at the same time the raw list for the risks and opportunities (clause 6.1) — for that there is the separate course “Objectives, Risks and Opportunities”. In the manual there is only the reference: Risks and opportunities are derived from the context and evaluated annually (list of risks and opportunities).

Module 6 of 17

Day 2: Wording scope and exclusions correctly

The scope is the one place where a sentence in the manual lands word for word on the certificate. It must be available as documented information (4.3) and name three things: which products and services, which locations, and which requirements of the standard are not applicable — with reasoning.

Sentence pattern for the scope:

“The quality management system applies to the [design,] manufacture and sale of [products] and [services] at the location [place]. Clause 8.3 (design and development) is not applicable, since products are manufactured exclusively to customer specification/catalogue.”

The certification body adopts the sentence; so check it for three things: does it contain only what you do today? Does it contain everything the customer wants to see on the certificate? Does it fit in two lines?

Exclusions — what works, what does not:

Two errors that certainly stand out in the audit: exclusion of 8.3 although the quotation contains “concept and planning” — then the quotation is the design. And: scope “services in the technical field” — too vague; the certification body demands something specific.

Retail companies: no own production process — therefore process validation and usually traceability are dropped; instead supplier evaluation, goods receipt, storage (8.5.4) and customer property (consignment goods, returns) gain weight. The manual says so expressly in the scope.

All exclusions are worded identically in the manual and in the application to the certification body. If they differ, the stage 1 audit begins with a discussion you do not need.

Module 7 of 17

Day 3: Process list and process map — three levels, at most 15 processes

Clause 4.4 requires you to “determine” your processes: with inputs and outputs, sequence and interaction, criteria and KPIs, resources, responsible persons, risks and improvement. That sounds like a consultant's year and for a small company is one afternoon — if you start with the right number: one value creation process, five management processes, seven support processes. A company with 50 employees has no more, fewer is possible in very small companies (merge, do not leave out).

The process map as a table (a graphic is permitted but not required — the table is easier to check in the audit):

The process list — one row per process, the most important document in the manual:

How to find your processes — in 30 minutes: take the last completed order and go through it from the first e-mail to the receipt of payment. Every handover from one person to another is a process step; everything that is needed “on the side” (supplier, employee, machine, measuring instrument) is a support process. Everything that happens once a year (audit, review, objectives) is a management process.

Objectives and KPIs, document control and organisation are not processes of their own but chapters of the manual (modules 10 to 13) — that keeps the process list short.

Interaction (4.4.1 b) is dealt with by the table: inputs of one process are outputs of another — the column “input/output” on the process page (next module) shows that. No arrow graphic needed.

The twelve management and support processes are so alike in small companies that you can adopt them as finished tables — module 8 and the download for it. The one process you really write yourself is V1.

Module 8 of 17

Day 3: The process description as a table — one page per process

Flowcharts with diamonds are pretty and are never updated. The process description that has worked in small companies for thirty years is a table on one page with four fields:

1 Master data: process no., name, category (M/V/S), responsible (role), status. 2 Flow:

3 Input and output: input: customer enquiry, drawing/description of services, material. Output: delivered product, inspection record, invoice, customer feedback. 4 Notes: special cases, interfaces, KPIs, risks (one line is enough).

Rules for the value creation process V1: at most nine steps (otherwise split: V1 sales, V2 execution), exactly one check point that demonstrates the release to the customer (8.6) — not five; anyone who writes down five inspections must show five records. Presentation gladly as a swimlane (rows = roles, columns = steps), the check point marked green; but the table is in the manual as well.

Adopting the twelve standard processes: M1 Management review, M2 Risks and opportunities, M3 Internal audit, M4 Action handling, M5 Training and competence, S1 Purchasing, S2 Goods receipt, S3 Customer satisfaction, S4 Customer complaints, S5 Supplier evaluation, S6 Maintenance of machines, S7 Monitoring of measuring equipment — as finished four-field pages. You change only the column “responsible” (your roles) and delete what you do not do. Retail companies and pure service providers delete S6 and S7 or reduce them to vehicles, IT and scales.

📄 The twelve standard processes M1–M5 and S1–S7 as four-field tables (German – English version to follow)

The test at the end of day 3: give the page V1 to an employee who does not process the order and let him explain what is checked at step 6 and where that is written. If he cannot, the row is too imprecise — not the employee.

Module 9 of 17

Day 3: Sector templates — what the value creation process looks like in 13 sectors

The value creation process is the only one you write yourself — but even that is not new in your sector. From more than 1,000 documentations typical sequences of steps can be derived for 13 sectors that serve as a starting point. You adapt what runs differently with you; usually that is two of nine steps.

How to use the template: take your sector, write the steps into the four-field table and check every row against the last real order. Two things almost always differ: who releases (with you perhaps the boss instead of production) and how the order comes in (telephone instead of e-mail). Change both — do not defend the template.

📄 Process descriptions V1 for 13 sectors as four-field tables (German – English version to follow)

Mixed companies (retail plus service, manufacturing plus installation) write two value creation processes V1 and V2 with one check point each — not one with eighteen steps.

Module 10 of 17

Day 4: Quality policy and objectives — one page of policy, one table of objectives

The quality policy is the document most often copied from the internet — and the auditor notices that in the first minute, because he asks the employee in production: “What is in your policy?” The standard requires the policy to be communicated, understood and applied (5.2.2). So: half a page, in your words, with four mandatory contents.

Below it management's statement of commitment — two sentences, place, date, signature of the owner or managing director. That is at the same time the evidence for 5.1.1 (leadership and commitment). Communication: notice in the break room or intranet, mention in the next meeting with a minutes line — no more.

Quality objectives (6.2): six to nine objectives — the six standard objectives of small companies (turnover, quotation hit rate, complaints, customer satisfaction, supplier evaluation, certification) plus one to three company-specific ones —, each with six items, as a table in the manual or as a sheet of its own (the manual then refers to it). Three example rows:

The third example shows the rule from module 2: what is not yet practised is an objective, not a claim. Every objective needs a number you can collect today already — otherwise it is a wish. The objectives are evaluated in the management review and set anew annually; for that there is the separate course “Objectives, Risks and Opportunities”.

📄 Quality policy: samples for four sectors, statement of commitment, organisation chart template (German – English version to follow)

What does not belong in the policy: environmental protection, occupational safety, data protection — unless you have that audited too. Every sentence that stands there is audited.

Module 11 of 17

Day 4: Organisation chart, roles and deputies — roles instead of names

Clause 5.3 requires responsibilities and authorities to be “assigned, communicated and understood”. A table is enough for that — and it lasts longer than a box organisation chart if you keep one rule: roles are in the manual, not names. Otherwise you have to re-approve the manual at every change of staff. The assignment person → role is on a sheet of its own that you maintain without a manual change.

Organisation chart as a table:

The five-person company: one person can have several roles — the boss is MD, sales and quality manager, the foreman is production and purchasing. That is permissible; only the deputy must always be a different person. With two persons in the company the deputy of the boss honestly reads: “external (accountant/partner company) for invoicing and customer contact; orders rest”. That is better than an invented deputy.

What the standard no longer requires: a management representative. The duties (5.3 a to e) must be assigned, but top management can keep them. In companies of up to ten employees the boss is usually the quality manager himself — then it says so.

Deputy rule as a sentence in the manual: “Every role has a named deputy (table). In case of absence of more than two weeks the deputy takes over all authorities of the role.” One sentence that really helps in the audit and in the company.

The job descriptions from day 1 (collection list no. 7) are only referenced in the table, not copied. Evidence of competence (7.2) is in the personnel file — the manual says that it is there.

Module 12 of 17

Day 5: Document control without stamps — filing, identification, change

Document control sounds like stamp, distribution list and revision number. The standard requires none of that. It requires (7.5.2) that documents are identified (title, date, author or number), have a suitable format and are reviewed and approved before use; and (7.5.3) that they are available, protected, distributed, changed, retained and disposed of — controlled. For a small company that means: one folder structure, one naming rule, one footer, one table.

The naming rule: Documentname_YYYY-MM-DD.docx — the date in the file name is the status. A revision number is not necessary; two files with different dates cannot be confused. The footer of every template carries the same status and the document name.

The folder structure (the twelve subfolders of the collection folder from day 1 are sorted in here):

Approval by filing: what is in the folder “02 Templates” is approved — because only the quality manager may write there. That is the whole approval rule; it is in the manual like that. For the manual itself: approval by the MD's signature on the cover sheet (PDF), the DOCX is the working version.

Change register: a table at the end of the manual — status, section, change, approval. Three rows a year are normal; zero rows in two years mean for the auditor: the manual is not alive.

External documents (7.5.3.2 d): customer drawings and standards must be “identified and controlled” — that means: you know which revision applies, and the old one is not at the inspection station. You own standards as a purchase or have access (national standards body, association); you should own ISO 9001 itself.

📄 Filing structure, naming rule, footer, change register and retention periods (German – English version to follow)

Paper or digital? Both are permitted; do not mix per document. Anyone who works digitally needs an answer to “Backup?” (protection, 7.5.3.1 b) — one sentence: “Daily backup to [NAS/cloud], restore tested annually.” And then really test it.

Module 13 of 17

Day 5: The mandatory records — what the standard wants to see retained

The standard distinguishes documented information to be maintained (documents that apply: scope, policy, objectives, processes) and to be retained (records that demonstrate: inspection results, audit reports, training records). Both together are around twenty places. Anyone who keeps them as a table in the manual has an answer with a place for every question “Show me …” in the audit.

📄 List of mandatory records ISO 9001:2015 with clause, document and place — to fill in (German – English version to follow)

Three observations from audits: first: 7.2 (evidence of competence) is missing most often — not the training, the record. A briefing record with two signatures is enough. Second: 8.2.3.2 is overlooked — the evidence that you checked the order against the quotation; the order confirmation meets that if it is really sent. Third: 8.5.3 customer property — anyone who is an IT service provider, cleaner or repair business constantly has customer property and needs a line on it.

What is not required: minutes of every meeting, distribution lists, read confirmations, form registers with revision status. Anyone who keeps such things keeps them for himself — not for the standard.

Module 14 of 17

Day 5: Review and approval — the manual test before the auditor

Before approval someone who did not write the manual checks it — in a small company the boss if the quality manager wrote it, or an employee from production if the boss wrote it. The check takes two hours and follows a list; the most important points:

A Completeness (standard): scope with exclusions and reasoning · context and interested parties · policy with four mandatory contents and signature · objectives measurable with deadline · organisation chart with deputies · process list and process pages for all processes · KPIs per process · audit, management review, actions described · document control with filing · list of mandatory records.

B Practised test (the rule from module 2): pick ten random sentences with “is”, “are”, “takes place” — for each the checker must find the evidence within two minutes. One sentence without evidence: delete or make it an objective. More than three sentences without evidence: the manual is not ready.

C Consistency: scope, exclusions and process list fit together (no process “design” with exclusion of 8.3; no measuring equipment list with exclusion of 7.1.5.2) · roles in the organisation chart = roles in the process pages · document names in the process pages = file names in folder 02 · KPIs in the process list = KPIs in the objectives.

D Form: no personal names · status in file name and footer · page numbers · table of contents · 25 to 40 pages · words of the standard only in brackets · change register with first row “first edition”.

📄 Manual checklist: 25 points in four blocks with rating column (German – English version to follow)

Approval: signature of management on the cover sheet of the PDF version, date = status. The PDF goes into folder 01, the DOCX becomes the working version. Communication: short presentation in the next meeting (20 minutes: process map, policy, “where do I find what”), minutes line with participants — that is the evidence for 5.2.2 and 7.3 (awareness).

30-day run-in: the manual is finished on day 5 but not yet proven. For four weeks the quality manager notes every sentence that does not match everyday reality on a sheet; after 30 days status 2 follows with these corrections. Only then should the stage 1 audit take place. Certification bodies like to see a manual with two statuses and a filled change register — it proves that it is used.

Module 15 of 17

Case study: Nordlicht IT Service writes its manual in five days

Nordlicht IT Service (fictitious) in Flensburg, Germany, looks after about 60 small companies in the region with nine employees: network, servers, workstations, Microsoft 365 set-up, maintenance contracts, hotline. A customer from medical technology demands an ISO 9001 certificate by the end of June 2023. In January 2023 the managing director (at the same time sales and quality manager) blocks five mornings.

Day 1 — questionnaire and collection list: questionnaire in 90 minutes. Collection list: 10 of 12 documents available or dropped with reasons; the supplier list has no evaluation yet, briefing records are missing. Decision: supplier evaluation and briefing record become objectives; there is no measuring equipment (only diagnostic software that demonstrates no conformity) → exclusion of 7.1.5.2 examined.

Day 2 — context and scope: external issues: skills shortage, cyber attacks on customers, manufacturer certifications. Interested parties: customers (response time, data security), manufacturers (partner status), legislator (data protection — relevant because customer data = customer property). Scope: “IT services: planning, installation, operation and support of IT infrastructures for small and medium-sized companies at the location Flensburg.” Decision 8.3: not excluded — the “planning” (concepts for customers) is design of a service; Nordlicht describes it as step 2 in V1 with concept review. 8.5.3 customer property: applicable (customer data, access data, loan devices).

Day 3 — processes: process list with V1 project order (9 steps, check point “function test and handover record”), V2 maintenance and support (ticket → processing → solution → customer feedback → invoicing, check point “customer confirms solution”), five M and six S processes (S7 monitoring of measuring equipment deleted, S6 limited to vehicles and IT). KPIs: hotline response time, share of tickets solved within 8 hours, project on-time delivery, complaints.

Day 4 — policy and organisation: policy in six sentences; six quality objectives O1–O6 (three of the six standard objectives plus three company-specific); organisation chart with seven roles for nine persons (MD = sales = quality manager; two technician teams; hotline; administration). Deputy MD: lead technician.

Day 5 — control, mandatory records, approval: filing in the existing document management, naming rule with date, list of mandatory records with 19 rows (8.3 applicable, 7.1.5 excluded), check by the lead technician, three corrections, approval.

Exercise — three hidden errors in the draft: in the sample manual draft (download 10) there are three errors as they would stand out in the audit. Find them before you open the approved sample manual (download 11). Hints: one concerns module 2, one module 6, one module 11.

📄 Nordlicht: completed questionnaire, collection list and manual draft with three hidden errors (German – English version to follow)

📄 Sample manual Nordlicht IT Service — approved version with resolution of the three errors (German – English version to follow)

Time balance Nordlicht: 5 × 3.5 hours MD + 2 hours check + 1 hour meeting = 20.5 hours. Stage 1 audit six weeks later without document nonconformity; stage 2 with two minor nonconformities (training record hotline, supplier evaluation not yet begun — the objective was set, but without interim status). Certified since May 2023.

Module 16 of 17

Records: What remains from the five days — and how the certification body reads it

At the end of the five days ten things are available — and exactly these ten the auditor picks up in the stage 1 audit. Stage 1 is the document review: he reads the manual, checks scope and exclusions, looks whether policy, objectives, processes, audit and management review are described, and decides whether stage 2 (the audit in the company) can take place. A manual according to this course usually passes stage 1 without rework.

Maintenance in the annual rhythm: the manual is not “maintained”, it is used — and once a year, before the management review, reviewed in two hours: process list still right? Roles still filled? KPIs still the ones you measure? Every change into the change register, new status, signature. No more is necessary; less stands out in the surveillance audit.

What you have now and what is still missing: with the manual the QMS is described — not operated. The next courses of the Academy fill the parts the manual refers to: objectives, risks and opportunities (M2), the order from enquiry to invoice (V1 in detail), suppliers, people, measuring equipment (S1, S2, S5, M5, S7), complaints and KPIs (S3, S4), internal audit (M3), management review (M1, M4).

📄 Rating grid: rate your manual yourself in 20 criteria (mature / almost / not yet) (German – English version to follow)

The rating grid is at the same time the exercise for the course close: rate your own manual or the sample manual Nordlicht. Below 14 of 20 points “mature” the stage 1 audit should not yet be booked.

Module 17 of 17

Procedure in our company

Your company completes this module. The general part of the training ends here; what follows, only your company knows:

Companies with a company account of the Academy receive this module with their own details; participants then see the names, dates and filing locations of their company. Without customisation: ask your management or your quality manager where these details are laid down in your company — usually in the quality manual.

Final test

36 questions, one correct answer each. You need 29 correct answers to pass (80 %). Scoring happens on the server — there is no answer key on this page.

Your result