How to create a process for ISO 9001
ISO 9001 clause 4.4 asks for six determinable things about a process, and a flowchart carries three of them unaided. Where the criteria, the resources and the risks have to go instead.
A worked example, stage by stage
The criteria come first
"Evaluation cycle falls due" is the trigger and "Scheduled or event driven?" separates a calendar review from one an event provoked. Then "Confirm the KPIs and review period" fixes the criteria before a single measurement is collected, which is the order clause 4.4 implies.
Interaction, four lanes wide
Four routes leave "Confirm the KPIs and review period", labelled "Quality", "Delivery", "Cost" and "Service". Three cross into the Quality, Receiving and operations and Finance lanes and are therefore clause 4.4 interactions; "Rate service and responsiveness" stays in Procurement.
A threshold, not a discussion
The Supplier lane owns two rows here, "Respond to the draft scorecard" and "Implement the agreed corrective actions", which is how the chart admits a third party performs part of the process. "Performance meets threshold?" then sends "Below" into an improvement plan rather than to an exit.
Re-evaluation closes the loop
The cycle completes at "Improvement targets met?" and "Persistent failure?": "Extend plan" returns to the plan already agreed, while "Conditional" and "De-list" still write to "Update the approved supplier list". Clause 8.4 wants the re-evaluation retained, not only the first approval.
How it works
Determine the inputs, outputs and resources
Write what the process receives, what it has to produce and what it needs to run: a category and a contract in, an evaluated supplier and a scorecard out, and the analyst days, system access and data extracts the sequence quietly assumes. Expected outputs means an output with an acceptance condition attached rather than a noun.
Fix the criteria and the measures
For each gate, name the measure, the threshold and the period it covers. On-time delivery against the originally confirmed date and against the revised date are different numbers, and the argument about which one counts always happens at the review rather than before it. Settle it while nobody is losing it.
Type the steps into rows and join them up
Each row is a box: the sentence goes in Box text, and the routes out go in Line to as row numbers, comma separated where a step leads to more than one place. Because the connections are numbers rather than drawn lines, rewording a step later changes nothing about where it goes. Build the whole sequence before touching shapes.
Turn each criterion into a labelled decision
Any row that applies a criterion becomes a Decision in the Shape column, with its label rewritten as the question that criterion answers. Line text then carries one branch label per number in Line to, matched by position. Two unlabelled arrows leaving a diamond is precisely where a determined criterion quietly stops being one.
Put the owner in a lane, the resource in a note
The accountable function goes in the Vertical lane column, the phase in the Horizontal lane. Read that column back as a list: the distinct labels in it are the clause 4.4 determination of responsibilities and authorities, so one function typed two ways reads as two owners. A lane says who, not how many — competence goes in the Notes column.
Approve it, then read it as an auditor
Send the chart for approval, then check the result from the auditor's direction: pick one supplier scorecard and see whether the revision of this process that produced it can still be identified. Approvals and revisions live on the chart, so the link a supplier file cites resolves to the version that was in force, and to its approver.
Frequently asked questions
Does ISO 9001 require a process map?
No. Clause 4.4 requires an organisation to determine its processes and, for each, the inputs and expected outputs, the sequence and interaction, the criteria and methods, the resources, the responsibilities and the risks — it does not prescribe a form. Clause 7.5 then requires whatever documented information the organisation determines is necessary. Maps are popular with auditors because they make sequence and interaction checkable in one view, but a map alone does not satisfy 4.4: the criteria have to be on it.
What evidence does an auditor accept for ISO 9001 clause 4.4?
Whatever shows the determination was made and is in use. Three of clause 4.4's six are evidenced by the diagram itself: an auditor traces a route across a lane boundary and asks the owner on the far side about it. Criteria, resources and risk need something a diagram cannot hold — a criterion needs the measured result for the period it names, a resource needs the capacity or competence record behind the step, and a risk needs the action taken and what it changed. Determined and never sampled is the finding.
How do you show process interactions for ISO 9001?
Draw the arrow, not the reference. An interaction is a real handover — an output of one process becoming the input of another at a named point — so on a swimlane chart it appears as a route crossing into a different owner's lane. A lane per function is therefore more useful for clause 4.4 than a picture of boxes labelled with process names. In the supplier evaluation example three of the four data routes cross a lane boundary: defect data from Quality, delivery from Receiving and operations, cost from Finance.
What documented information does ISO 9001 clause 8.4 require?
Clause 8.4.1 requires criteria for the evaluation, selection, monitoring of performance and re-evaluation of external providers, and it requires the results of those activities to be retained. That is two obligations: the criteria in advance, and the evidence afterwards. In practice the retained evidence is the scorecard, the review record and the decision taken — including a de-listing and the reason behind it. An approved supplier list with no dated evaluations behind it is the version that fails.