To write a QMS manual for ISO 9001:2015, build it clause by clause around what auditors actually check: the scope of your system, your quality policy, measurable objectives, the processes that run your organization and how they interact, your approach to risk, and the controls that keep documents and records trustworthy. Describe how work really flows, not how it should flow in theory. Keep the manual itself short by pushing procedural detail into standard operating procedures and work instructions below it.
One thing to settle before you start. ISO 9001:2015 removed the explicit requirement to maintain a quality manual and replaced it with the broader concept of “documented information.” You are not forced to produce a manual at all. Most organizations still do, because a single document that pulls scope, policy, process interactions, and risk treatment into one place saves time in audits and gives new employees one place to look.
Start With the Scope
The scope statement is the first thing an auditor reads, and a weak one creates problems that ripple through everything else. Clause 4.3 requires you to define the boundaries of your QMS: which products, services, locations, and processes fall inside it. The scope has to account for the external and internal issues affecting your organization and the requirements of interested parties such as customers, regulators, and suppliers. It must be maintained as documented information and made available to anyone who needs it.
You can exclude requirements of the standard that don’t apply to your operations, but only if the exclusion doesn’t compromise the conformity of your products or services or reduce customer satisfaction. A software consulting firm that doesn’t design physical products can reasonably exclude clauses on product design verification. State the exclusion in writing and justify it.
Write the Quality Policy and Objectives
Clause 5.2 requires top management to establish a quality policy that fits the organization’s purpose, provides a framework for setting objectives, commits to meeting applicable requirements, and commits to continual improvement. It must be maintained as documented information, communicated throughout the organization, and made available to relevant interested parties. This is not a wall poster. It governs the rest of the manual.
Objectives flow from the policy. Under clause 6.2, they must be measurable, consistent with the policy, and relevant to the conformity of your products and services. For each objective, document the resources you’ll use, who owns it, when it’s due, and how you’ll evaluate results. “Improve quality” fails the clause. “Reduce customer complaint rate by 15% within 12 months” meets it, because it can be measured and assigned.
Describe Your Processes and How You Address Risk
ISO 9001:2015 is built on the process approach. Clause 4.4 requires you to determine the key processes in your organization, their inputs and outputs, how they interact, and who owns them. Many organizations use flowcharts or process maps for this. The standard doesn’t require any specific format, only that the sequence is clear and that you keep enough documented information to support and monitor the processes.
Risk-based thinking is woven across the standard rather than isolated in a single clause. Clause 6.1 requires you to identify risks and opportunities related to QMS performance and plan actions to address them. The standard does not require a formal risk management methodology or a documented risk assessment process. The level of formality depends on your context; a ten-person machine shop and a multinational pharmaceutical manufacturer face very different risk landscapes.
Even without a formal requirement, the manual is a natural place to describe your approach to risk. Top management must promote awareness of risk-based thinking under clause 5, and you must evaluate the effectiveness of actions taken to address risks under clause 9. Organizations that treat risk as an afterthought struggle in audits, because auditors look for evidence of it across multiple clauses.
Set the Documentation Layers Beneath the Manual
The manual sits at the top of a hierarchy. Below it are standard operating procedures that explain how specific processes work. Below those are work instructions that give employees step-by-step directions for individual tasks. The manual sets policy. The SOPs describe the method. The work instructions walk someone through execution. Keeping the layers distinct is what prevents the manual from ballooning into something nobody reads.
ISO 9001:2015 distinguishes between documented information you must maintain (policies, procedures, the scope) and documented information you must retain (records that prove you followed your own system). Mandatory records include training and competence records, management review results, internal audit results, corrective action records, calibration records for monitoring and measuring equipment, and records demonstrating product or service conformity. Without these, you cannot prove the system is running, and an auditor will flag it.
Build In Document Control From the Start
Clause 7.5 sets the requirements for controlling documented information. When creating or updating documents, you must ensure proper identification (titles, dates, revision numbers), appropriate format, and review and approval for suitability. For controlling existing documents, you must address distribution, access, retrieval, storage, preservation of legibility, version control, and retention periods.
The practical goal is to stop employees from working off outdated documents. Every document needs a clear revision history, and the current version must be readily accessible to anyone who needs it. Obsolete versions should be removed from active use or clearly marked. Digital document management systems handle this well by routing documents for approval automatically and restricting access to superseded versions. Physical binders still work for smaller operations but take more manual effort to keep current.
Documents that originate outside your organization, such as customer specifications, regulatory standards, or supplier certifications, also fall under your document control requirements if they’re necessary for planning or operating your QMS.
Cover the Clauses That Prove the System Runs
Three clauses generate most of the records that prove your manual is more than paper: corrective action, internal audits, and management review. The manual needs to describe how each works and point to the procedures that run them.
Corrective Action and Nonconformity
When something goes wrong, clause 10.2 requires you to react, determine the root cause, and take corrective action to prevent recurrence. You then review whether the action worked. All of these records must be retained. A workable CAPA procedure identifies the problem, investigates why it happened using root cause analysis, defines corrective and preventive actions, assigns responsibility and deadlines, and verifies effectiveness after implementation.
The effectiveness check is where many organizations fall short. Writing a corrective action plan is easy. Going back weeks or months later to confirm the problem hasn’t resurfaced takes discipline. If the fix didn’t work, document that and start again. Auditors look for genuine follow-through, not paperwork.
Internal Audits
Clause 9.2 requires you to establish an audit program that covers all areas of the QMS, define audit criteria and scope, and base frequency on the importance and risk of each process. Audit findings, including any nonconformities, must be documented and fed into the corrective action process. The people conducting the audits should be independent of the area being audited.
Management Review
Clause 9.3 keeps leadership engaged with the system. Top management must review the QMS at planned intervals, considering inputs like customer feedback, audit results, process performance, corrective action status, and the effectiveness of actions taken to address risks and opportunities. Outputs must include decisions about improvement, changes to the QMS, and resource needs. Retain documented information as evidence, usually meeting minutes and action lists.
Add Industry Layers If They Apply
ISO 9001:2015 is the general framework. Several industries layer additional requirements on top of it, and the manual has to address them if they apply.
Medical Devices
Medical device manufacturers in the United States must comply with the Quality Management System Regulation (QMSR) under 21 CFR Part 820. A major change took effect on February 2, 2026: the FDA amended Part 820 to incorporate ISO 13485:2016 by reference, aligning U.S. requirements with the international standard.1FDA. Quality Management System Regulation (QMSR) U.S. medical device companies now use ISO 13485 as the foundational QMS framework, with FDA-specific additions for record control (§ 820.35) and device labeling and packaging controls (§ 820.45).2eCFR. Quality Management System Regulation
If your manual supports electronic approvals or electronic records, you’ll also need to address 21 CFR Part 11, which governs electronic signatures and electronic records and requires controls for system access, audit trails, signature manifestations, and linking signatures to their records.3eCFR. Electronic Records; Electronic Signatures Paper-based approvals that are later scanned don’t trigger Part 11. Digital approvals do.
Automotive
Automotive suppliers typically must comply with IATF 16949:2016, which builds on ISO 9001:2015 and adds requirements specific to automotive production and accessory parts. Documentation must incorporate both the IATF standard and applicable customer-specific requirements from automakers.4AIAG. IATF 16949:2016 The automotive standard is more prescriptive than base ISO 9001 in areas like production part approval, measurement system analysis, and statistical process control. If you supply the automotive industry, the manual needs dedicated sections for these.
Draft, Approve, Distribute, Review
Before you write, gather what each section needs: organizational context, stakeholder needs, existing process documentation, job descriptions that define quality responsibilities, and any industry-specific regulatory requirements. Don’t start writing until you have a clear picture of how work actually flows. The biggest mistake in QMS manual development is describing how processes should work in theory rather than how they work in practice. Auditors spot that gap quickly.
Once drafted, the manual goes through formal approval, with top management signing off. The signature matters. It means leadership accepts responsibility for the system’s effectiveness and commits resources to support it. The approved manual gets a revision number, and every subsequent change follows the same approval and version control process.
Distribution should match how your organization actually communicates. A corporate intranet or document management system works for organizations with reliable digital access. Controlled physical copies make sense for shop floors or field locations without consistent connectivity. Whatever the method, the system must ensure everyone accesses the current version and outdated copies are removed or clearly identified.
Schedule reviews at least annually to confirm the manual still reflects your actual operations. New product lines, facility expansions, and shifts in regulatory requirements all trigger updates. Management review outputs under clause 9.3 often identify changes that need to flow back into the manual. Treating it as a living document is what separates organizations that use their QMS from those that maintain it only for the certificate on the wall.