Many organizations understand the clause but still lack a clear procedure. Requirements, process criteria, resources, controls, records, changes, and outsourced work often live in different places, or only in people's heads. Auditors notice.
This guide walks through what Clause 8.1 requires, how to structure a procedure, how to implement controls, what records to keep, and how to audit the result.
Key Takeaways
- Clause 8.1 turns customer, statutory, regulatory, and internal requirements into controlled processes.
- Process criteria and acceptance criteria are different things. Define both.
- ISO 9001:2015 needs no specific document title, but you must retain evidence of planned execution.
- Planned changes, unintended changes, and outsourced processes all fall under operational control.
What ISO 9001:2015 Clause 8.1 Requires
In plain language, Clause 8.1 says: plan the work, run it under control, and keep proof. It builds on the process approach, risk-based thinking, and the actions you planned under Clause 6. Those risk actions get carried into operations here.
The core requirements
Paraphrasing the ISO 9001:2015 text, the organization must:
- Determine requirements for its products and services
- Establish criteria for processes and for acceptance of products and services
- Determine the resources needed to achieve conformity
- Implement control of processes in line with those criteria
- Maintain and retain documented information to show processes ran as planned and products conform
Process criteria versus acceptance criteria
These get confused constantly. Process criteria describe how the work must run. Acceptance criteria describe what the output must meet before release.
A machining process might require a set spindle speed and tool-change interval (process criteria). The finished part must then pass a dimensional inspection (acceptance criteria).
A service version works the same way: client onboarding requires a kickoff checklist (process), while final acceptance is the client's written sign-off on deliverables.
Fit the plan to your organization
Planning output must suit your operations. Factor in:
- Size and complexity
- Product or service risk
- Workforce competence and technology
- Customer commitments
A ten-person firm and a multi-site manufacturer should not have identical plans.
Changes and outsourcing
Clause 8.1 closes with three obligations:
- Control planned changes
- Review unintended changes and mitigate adverse effects
- Keep outsourced processes under control per Clause 8.4
How to Structure an ISO 9001:2015 Clause 8.1 Procedure
Purpose, scope, and applicability
State the purpose plainly: products and services are delivered under planned, controlled conditions. Then define scope. Does it cover every QMS process, selected operational activities, multiple sites, or outsourced work? Say so explicitly.
Responsibilities and authorities
Assign roles by name or title:
- Top management: provides resources and supports the procedure
- Quality manager: maintains the procedure and reviews records
- Process owners: approve plans and own process performance
- Operations personnel: perform work and controls
- Purchasing or supplier management: control external providers
- Inspectors and testers: verify acceptance and handle deviations
Spell out who approves plans, who performs controls, who reviews records, and who handles deviations.
Inputs to operational planning
Planning should start from real information:
- Customer, statutory, and regulatory requirements
- Quality objectives and risk and opportunity actions
- Process maps and prior nonconformities
- Supplier requirements and available resources
- Lessons learned from earlier jobs
Determining requirements, criteria, and resources
The procedure should convert those inputs into clear planning outputs:
- Process criteria and acceptance criteria
- Resource needs, responsibilities, and timing
- Competence requirements
- Monitoring methods
- Documented information required
A simple planning form or checklist handles this well.
Implementing and reviewing operational controls
Define how people perform work under control:
- Use approved instructions
- Verify inputs before work starts
- Monitor performance during the process
- Complete inspections or service checks
- Address deviations when they occur
When criteria are not met, the procedure should say who gets notified and who decides.
Procedure outputs and review
Expected outputs vary by business:
- Operational plans and work orders
- Job packets and service delivery plans
- Inspection plans
- Production records and release records
Require periodic review whenever requirements, risks, resources, processes, or performance results change.
How to Implement Operational Controls in Practice
Determine requirements before committing to delivery
Identify customer specifications, delivery or service conditions, statutory and regulatory requirements, and internal requirements before accepting an order, contract, or project.
For example, a manufacturer receives a purchase order with a tighter tolerance than usual. Before accepting, it checks whether equipment can hold the tolerance, confirms material and staff availability, and asks the customer to clarify an ambiguous drawing note. Only then does work begin.
A service firm does the same with scope, timeline, and staffing. Industries differ, so adapt the review to yours.
Establish process and acceptance criteria
Make criteria measurable or otherwise verifiable. That covers process performance, inputs, outputs, inspections, testing, approvals, service milestones, and final acceptance.
Some acceptance rests on professional judgment or customer approval. That is fine, but define who decides, on what basis, and how the decision is recorded.
Two practical rules:
- Communicate criteria to the people doing the work
- Prevent obsolete specifications and instructions from reaching the point of use
Determine resources and competence
List what conformity requires:
- People, infrastructure, and equipment
- Monitoring and measuring resources
- Work environment, software, and materials
- Information, time, and external providers
Tie this to Clause 7.2. Where appropriate, keep records showing assigned personnel are qualified, trained, or otherwise competent for the work.
Implement controls and monitor performance
Suitable controls include:
- Approved procedures, work instructions, and checklists
- Inspections, testing, peer review, and validation
- Status identification, service checkpoints, and authorization before release
Choose monitoring methods that fit the risk. Review results against criteria, watch for process variation, and start correction or corrective action when requirements are not met.
Control changes and externally provided processes
Route planned changes through a defined path:
- Assess impact
- Approve
- Communicate
- Update documentation
- Review resources
- Verify after the change
Keep this separate from unplanned deviations such as a machine failure or a missing staff member. Review those for adverse effects and mitigate them.
For outsourced work, define requirements, evaluate suppliers, issue clear purchasing information, verify outputs, and monitor performance. You remain responsible for the conformity of what the customer receives.
Hypothetical cross-industry example
This is an illustrative scenario, not a real case.
A mid-size contract fabricator wins an order for 500 brackets with a specified coating.
- Requirement: drawing, coating standard, and delivery date are reviewed and confirmed
- Process criteria: welding parameters and a cure-time window for the coating
- Resources: a certified welder, a calibrated gauge set, and an outside coating supplier
- Controls: work instruction, first-article check, in-process inspection, supplier certificate review
- Change review: the customer shifts the delivery date, so capacity and supplier schedule are reassessed and the job packet updated
- Acceptance and release: final inspection results are recorded and an authorized person signs the release
Every step leaves evidence, and every step traces back to a requirement.
What Documented Information and Records Should You Maintain?
A required record versus a named procedure
Clause 8.1 does not mandate a document titled "Operational Planning and Control Procedure." ISO/TC 176 guidance confirms the standard does not require specific named document types. Procedures can add value, but you decide what you need.
What you must do is maintain and retain enough documented information to be confident that processes ran as planned and to show conformity. Consider:
- Process criteria and customer requirement reviews
- Operational plans and work instructions
- Inspection, testing, and service records
- Resource and competence evidence
- Change records and supplier controls
- Release approvals and nonconformity records
Evidence management and accessibility
Records should be identifiable, legible, retrievable, protected from unintended alteration, and available to authorized people. Set retention periods based on customer, legal, regulatory, contractual, and business needs.
Synergistic Systems supports this with modular documentation and training systems, plus a cloud-based Quality Management Intranet. The intranet hosts controlled documents and records, with permission levels set for each folder and records database.
Nothing in ISO 9001 requires a particular platform. Centralizing access this way is especially useful across multiple sites.
Avoiding over-documentation
Documentation should support control, not create paperwork. Scale records and approvals to your risks, complexity, customer requirements, and evidence needs. The same ISO guidance notes that documented information need not be extensive where conformity can be demonstrated otherwise.
How to Audit, Correct, and Improve the Procedure
Audit trail and evidence questions
Useful internal audit questions:
- Where were the requirements for this order identified and reviewed?
- What process and acceptance criteria were set?
- Were resources and competent people available?
- Which controls were applied, and what proves it?
- Who accepted the output, and on what evidence?
- Were changes assessed before implementation?
- How were outsourced activities verified?
Sample a product, service, project, or order and trace it backward: from final acceptance to the plan, process criteria, personnel, records, supplier inputs, and change history. ISO/IAF guidance on ISO 19011 audit practices notes that sampling affects confidence in audit conclusions, so choose samples deliberately.
Common weaknesses
Watch for:
- Vague or unmeasurable criteria
- Missing ownership
- Procedures that don't match actual work
- Incomplete acceptance records
- Outdated instructions
- Shallow change assessments
- Weak supplier controls
- Records that don't demonstrate conformity
A missing record and an ineffective process are not the same problem. A record may be absent while the work was done correctly, or records may exist for a process that fails.
Classification as major or minor depends on audit evidence and the certification body's evaluation, not on the clause alone. Published data is limited: DNV's 2022 audit findings list Clause 8.5.1 as its most common nonconformity, and that is one registrar's data, not a universal benchmark.
Corrective action and continual improvement
Pull patterns from:
- Audit results and customer feedback
- Process performance and nonconforming outputs
- Supplier performance and change outcomes
Feed those patterns back into the procedure. Connect findings to corrective action, then verify effectiveness. Bring results to management review and update risks, objectives, resources, criteria, or documented information as needed.
Frequently Asked Questions
What are the 5 C's of audit?
The labels vary by source. One common version, used in government auditing, is criteria, condition, cause, consequence, and corrective action. It is a reporting technique, not an ISO 9001 Clause 8.1 requirement.
What does ISO 9001:2015 Clause 8.1 require?
It requires planning and controlling operations: determining requirements, setting process and acceptance criteria, providing resources, implementing controls, and keeping documented information. It also covers changes and outsourced processes.
Is a documented procedure mandatory for ISO 9001 Clause 8.1?
No specific document title or format is required. You must maintain and retain enough documented information to show processes ran as planned and products or services conform.
What records can demonstrate compliance with Clause 8.1?
Examples include requirement reviews, operational plans, work instructions, inspection or service records, competence evidence, change records, supplier controls, and release or acceptance records.
How does Clause 8.1 address changes and outsourced processes?
Planned changes must be controlled. Unintended changes get reviewed and their adverse effects mitigated. Outsourced processes stay under QMS control through Clause 8.4 arrangements.
