How to create a process for ISO 9001
ISO 9001 clause 4.4 asks for six determinable things about a process, and a flowchart carries three of them unaided. Where the criteria, the resources and the risks have to go instead.
A process for ISO 9001 is one whose inputs, outputs, sequence, interaction with the other processes, criteria and methods, resources, responsibilities and risks have all been determined.
The short version
- Sequence, interaction and responsibilities come free with the diagram; criteria, resources and risks do not.
- Criteria and measures are the ones auditors find missing: put them on the decision that applies them.
- Documented information is not a procedure document; a maintained chart and its records qualify.
- An interaction is an arrow crossing into another owner's lane, not a reference to another document.
- Clause 8.4 requires re-evaluation, so a supplier process loops rather than ending at first approval.
Clause 4.4 asks for six things, not a diagram
Clause 4.4 asks for six determinations per process and leaves the shape of the answer to the organisation, which is why an accurate flowchart can sit in a quality manual for two years and still attract a 4.4 finding. Three of the six a swimlane chart answers simply by existing. The other three (what the criteria are and how they are measured, what resources it needs, and what could go wrong with it) have to be put somewhere on purpose, and a chart is a better place than the paragraph they end up in.
A measure kept in a separate manual paragraph is a cross-reference nobody follows; the same threshold written on the decision that applies it is a criterion in use. That distinction is what decides whether the map survives an audit. "Performance meets threshold?" becomes auditable only once the threshold, its period and the data behind it are named on that row, and clause 7.5 asks for no procedure document to hold them, only the documented information the organisation determined it needs.
The example below is a clause 8.4 process (control of an externally provided product) because that is the clause where evaluation criteria, monitoring and re-evaluation are stated outright. "Persistent failure?" is where those criteria finally bite: "Extend plan" returns the supplier to "Agree improvement plan and milestones" instead of to an exit, while "Conditional" and "De-list" both still reach "Update the approved supplier list": the retained evidence 8.4 asks for, not the first approval.
The same supplier, re-evaluated on a cycle
Clause 8.4 supplier evaluation, criteria before data. "Confirm the KPIs and review period" is row 4, and each later gate decides against the criteria it set.
The criteria come first
"Evaluation cycle falls due" is the trigger and "Scheduled or event driven?" separates a calendar review from one an event provoked. Then "Confirm the KPIs and review period" fixes the criteria before a single measurement is collected, which is the order clause 4.4 implies.
Interaction, four lanes wide
Four routes leave "Confirm the KPIs and review period", labelled "Quality", "Delivery", "Cost" and "Service". Three cross into the Quality, Receiving and operations and Finance lanes and are therefore clause 4.4 interactions; "Rate service and responsiveness" stays in Procurement.
A threshold, not a discussion
The Supplier lane owns two rows here, "Respond to the draft scorecard" and "Implement the agreed corrective actions", which is how the chart admits a third party performs part of the process. "Performance meets threshold?" then sends "Below" into an improvement plan rather than to an exit.
Re-evaluation closes the loop
The cycle completes at "Improvement targets met?" and "Persistent failure?": "Extend plan" returns to the plan already agreed, while "Conditional" and "De-list" still write to "Update the approved supplier list". Clause 8.4 wants the re-evaluation retained, not only the first approval.
How it works
Determine the inputs, outputs and resources
Write what the process receives, what it has to produce and what it needs to run: a category and a contract in, an evaluated supplier and a scorecard out, and the analyst days, system access and data extracts the sequence quietly assumes. Expected outputs means an output with an acceptance condition attached rather than a noun.
Fix the criteria and the measures
For each gate, name the measure, the threshold and the period it covers. On-time delivery against the originally confirmed date and against the revised date are different numbers, and the argument about which one counts always happens at the review rather than before it. Settle it while nobody is losing it.
Type the steps into rows and join them up
Each row is a box: the sentence goes in Box text, and the routes out go in Line to as row numbers, comma separated where a step leads to more than one place. Because the connections are numbers rather than drawn lines, rewording a step later changes nothing about where it goes. Build the whole sequence before touching shapes.
Turn each criterion into a labelled decision
Any row that applies a criterion becomes a Decision in the Shape column, with its label rewritten as the question that criterion answers. Line text then carries one branch label per number in Line to, matched by position. Two unlabelled arrows leaving a diamond is precisely where a determined criterion quietly stops being one.
Put the owner in a lane, the resource in a note
The accountable function goes in the Vertical lane column, the phase in the Horizontal lane. Read that column back as a list: the distinct labels in it are the clause 4.4 determination of responsibilities and authorities, so one function typed two ways reads as two owners. A lane says who, not how many: competence goes in the Notes column.
Approve it, then read it as an auditor
Send the chart for approval, then check the result from the auditor's direction: pick one supplier scorecard and see whether the revision of this process that produced it can still be identified. Approvals and revisions live on the chart, so the link a supplier file cites resolves to the version that was in force, and to its approver.
Mistakes to avoid
Sequence with no criteria on it
The most common clause 4.4 finding is a complete, accurate flowchart on which nothing could fail. If no row states a measure or a threshold, the chart records what happens rather than what has to be true.
Writing an interaction as a cross-reference
"See procedure QP-08" beside a box is not an interaction. Draw the incoming arrow and put the other process's owner in a lane, or nobody notices the day the two descriptions stop agreeing.
One procedure document per clause
Clause 7.5 asks for the documented information the organisation determines it needs, and 4.4 for determinations. A procedure written per clause produces a manual nobody opens and still leaves the measures undefined.
Keeping the risks off the diagram
A risk register in its own spreadsheet is reviewed annually; a risk that reached the chart as a labelled branch is reviewed every time somebody follows the route. Put the ones with routes on the diagram.
Create your own ISO 9001 process map
Open the supplier evaluation example as your own chart, write in your own KPIs and thresholds, and send it for approval.
Related guides
Frequently asked questions
Does ISO 9001 require a process map?
No. Clause 4.4 requires an organisation to determine its processes and, for each, the inputs and expected outputs, the sequence and interaction, the criteria and methods, the resources, the responsibilities and the risks; it does not prescribe a form. Clause 7.5 then requires whatever documented information the organisation determines is necessary. Maps are popular with auditors because they make sequence and interaction checkable in one view, but a map alone does not satisfy 4.4: the criteria have to be on it.
What evidence does an auditor accept for ISO 9001 clause 4.4?
Whatever shows the determination was made and is in use. Three of clause 4.4's six are evidenced by the diagram itself: an auditor traces a route across a lane boundary and asks the owner on the far side about it. Criteria, resources and risk need something a diagram cannot hold: a criterion needs the measured result for the period it names, a resource needs the capacity or competence record behind the step, and a risk needs the action taken and what it changed. Determined and never sampled is the finding.
How do you show process interactions for ISO 9001?
Draw the arrow, not the reference. An interaction is a real handover (an output of one process becoming the input of another at a named point), so on a swimlane chart it appears as a route crossing into a different owner's lane. A lane per function is therefore more useful for clause 4.4 than a picture of boxes labelled with process names. In the supplier evaluation example three of the four data routes cross a lane boundary: defect data from Quality, delivery from Receiving and operations, cost from Finance.
What documented information does ISO 9001 clause 8.4 require?
Clause 8.4.1 requires criteria for the evaluation, selection, monitoring of performance and re-evaluation of external providers, and it requires the results of those activities to be retained. That is two obligations: the criteria in advance, and the evidence afterwards. In practice the retained evidence is the scorecard, the review record and the decision taken, including a de-listing and the reason behind it. An approved supplier list with no dated evaluations behind it is the version that fails.
