What the clause requires
Clause 4.4 is the heart of the process approach. The company has to determine the processes needed for the quality management system and, for each one: the inputs required and the outputs expected, the sequence and interaction with the other processes, the criteria and methods of control including the performance indicators, the resources needed, who is responsible, the risks and opportunities that apply, and how the process is evaluated and improved. It is a long list, but it is the same list a competent manager would write anyway when asked to explain how a process is run.
In practice this usually becomes a process map showing who feeds whom, plus one sheet per process, sometimes called a process characterisation or a SIPOC: suppliers, inputs, activities, outputs, customers, process owner, indicator and risks. The standard also asks for documented information to the extent necessary to support the operation of the processes and to give confidence that they are being carried out as planned. How much documentation that means is a decision for the company, based on the size of the operation and the competence of the people doing the work.
The point to watch is that the map reflects the real company. Externally provided processes remain inside the system and still have to be controlled (see clause 8.4); leaving them off the map does not put them beyond the auditor's reach. Auditors typically ask the process owner to explain the indicator, the target and what was done when the result went the wrong way. That is the moment when it becomes clear whether the process is genuinely managed or merely drawn on a slide, and it is the most common source of findings against clause 4.4.
What the auditor asks to see
- A process map showing how the processes interact and feed each other
- A characterisation of each process: inputs, outputs, owner, resources and indicator
- Indicators with a target, an actual measurement and a recorded analysis
- Risks and opportunities considered process by process
- Externally provided processes identified in the map and controlled
Where companies most often get it wrong
- A beautiful map that does not match the real flow of work in the company
- A process with no defined owner, or an owner who does not know the indicator
- An indicator that is measured every month and never analysed
- A relevant externally provided process forgotten in the map
Example of a nonconformity
- Requirement
- ISO 9001, 4.4.1 c) and g): determine the criteria and methods of control and evaluate the processes.
- Evidence
- The dispatch process sheet defines the indicator "on-time deliveries" with a target of 95%, but there has been no measurement since 01/2026; the process owner stated that the data stopped being generated after the change of management software.
- Finding
- The control criterion defined for the process is neither applied nor evaluated.
How to comply using PrismaBiz
Ready-made templates for this clause
Frequently asked questions
Do I need a procedure for every process?
No. The standard asks for documented information to the extent necessary. Many companies comply with the process sheet plus instructions only where there is a real risk of error.
How many processes should a quality management system have?
There is no right number. Small companies usually have between 6 and 12. Too much detail creates bureaucracy; too much grouping hides responsibilities.
Is an indicator mandatory for every process?
The standard asks for criteria and methods of control, including monitoring, measurement and related performance indicators, as appropriate. In practice, every relevant process has at least one.