Quality Management Systems and ISO Standards

Introduction and context

A quality management system (QMS) is the coordinated set of processes, responsibilities, resources and controls through which an organization consistently delivers products and services that satisfy customers and applicable requirements. It is not merely a quality manual, a collection of forms, or an annual certification exercise. A mature QMS is an operating system for managing organizational performance and learning.

ISO 9001 is the internationally recognized requirements standard for a QMS. The current main edition is ISO 9001:2015, supplemented by the 2024 climate-action amendment, which requires organizations to consider whether climate change is a relevant issue in their context and whether interested parties have climate-related requirements. ISO 9001 is generic: it can apply to manufacturing, health care, education, construction, logistics, software and public services. It specifies requirements, but does not prescribe one organizational structure or one technology platform.

This chapter explains how to design and document a process-based QMS consistent with ISO 9001 principles. It also examines context analysis, documented information, operational controls, certification, sector-specific requirements, governance and contemporary implementation challenges.

Learning objectives

By the end of this chapter, the learner should be able to:

1. Explain the purpose, principles and architecture of a QMS.
2. Analyse organizational context and interested-party requirements.
3. Model processes and establish measurable controls and interactions.
4. Distinguish documented information that must be maintained from information that must be retained as evidence.
5. Design operational controls for externally provided processes, production or service delivery, release and nonconformity.
6. Plan certification and evaluate the limitations of certification.
7. Integrate legal, regulatory, sector-specific and climate-related requirements into a QMS.
8. Evaluate QMS effectiveness using risk-based thinking, audits, indicators and continual improvement.

1. The quality management system as an organizational system

Quality means the degree to which a set of inherent characteristics fulfils requirements. Requirements may arise from customers, legislation, regulators, contracts, professional bodies, internal specifications and social expectations. Quality therefore includes more than conformance to a technical specification; it may include safety, reliability, accessibility, timeliness, confidentiality, sustainability and fitness for intended use.

A QMS connects four elements:

• Purpose: the value the organization intends to deliver.
• Processes: linked activities that transform inputs into outputs.
• Controls: criteria, methods, resources and authorities that keep processes capable and consistent.
• Evidence and learning: records, measurements, audits, corrective actions and management decisions.

ISO 9001 adopts a process approach supported by risk-based thinking. A process has a defined input, activities, output, customer or recipient, owner, resources, criteria and measures. For example, a purchasing process may receive an approved purchase request, select and evaluate a supplier, issue an order and verify receipt. Its outputs include purchased goods, supplier information and purchasing records.

The seven quality management principles

ISO quality management principles provide a conceptual foundation rather than a checklist:

1. Customer focus: understand current and future needs and seek to enhance customer satisfaction.
2. Leadership: establish direction, policy, responsibilities and a culture supportive of quality.
3. Engagement of people: enable competent people to participate and contribute.
4. Process approach: manage activities as an interconnected system rather than isolated departments.
5. Improvement: pursue better performance, capability and suitability.
6. Evidence-based decision making: base decisions on reliable analysis and evaluation.
7. Relationship management: manage relationships with relevant interested parties, especially key providers.

These principles are mutually reinforcing. Customer focus without process control produces promises that cannot be reliably fulfilled. Measurement without leadership produces data without action. Improvement without engagement often produces superficial compliance.

The PDCA model

The Plan–Do–Check–Act cycle provides a practical architecture:

• Plan: determine context, risks, opportunities, objectives, resources and methods.
• Do: operate processes and provide products or services under controlled conditions.
• Check: monitor, measure, audit and review performance.
• Act: correct nonconformities, address causes and improve the QMS.

PDCA is not a linear project completed once. It operates at several levels: individual process, department, organization and strategic planning. A production process may use hourly checks, while top management reviews the whole system quarterly or at planned intervals.

2. ISO 9001 architecture and context analysis

ISO 9001:2015 is organized around clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement. Clauses 1 to 3 provide scope, references and terms. The structure is compatible with other ISO management-system standards and encourages integrated systems.

Understanding context

An organization should identify internal and external issues that can affect its ability to achieve intended QMS results. External issues may include market conditions, technology, competition, legislation, economic pressures, climate hazards, cultural expectations and supply-chain instability. Internal issues may include organizational structure, competence, culture, infrastructure, knowledge, resources, information systems and strategic priorities.

A useful context register may contain:

The register is not valuable because it exists; it is valuable when it informs risks, objectives, controls and management decisions.

Interested parties and requirements

Interested parties are persons or organizations that can affect, be affected by, or perceive themselves to be affected by a decision or activity. They may include customers, employees, owners, regulators, suppliers, contractors, communities, insurers and certification bodies.

Not every expectation becomes a QMS requirement. The organization determines which interested parties and requirements are relevant to its ability to provide conforming outputs and enhance customer satisfaction. For example, a regulator’s statutory safety requirement is mandatory; a community preference may become a strategic commitment; a supplier’s preferred ordering method may be irrelevant unless it affects delivery.

A requirements matrix should identify the source, obligation, process owner, evidence and review frequency. This helps prevent a common failure: knowing that a requirement exists but not assigning responsibility for maintaining compliance.

Scope of the QMS

The scope defines the products, services, locations and organizational boundaries covered. It should be precise enough to prevent misleading claims. For example: “Design, manufacture and after-sales service of electrically powered laboratory instruments at the central facility.” The organization must consider context, interested-party requirements and its products and services when determining scope.

Activities cannot be excluded simply because they are inconvenient. ISO 9001 permits the organization to determine applicability of requirements, but an inapplicable requirement must not affect its ability or responsibility to provide conforming products and services. A design organization normally cannot declare design controls irrelevant merely because production is outsourced; responsibility remains with the organization if it controls the design outcome.

Process architecture

A process map may be hierarchical:

• Strategic processes: strategy, governance, risk and management review.
• Core processes: marketing, design, purchasing, production, delivery and service.
• Support processes: competence, infrastructure, information control, maintenance and internal audit.
• Improvement processes: corrective action, data analysis and continual improvement.

For every significant process, document the owner, purpose, inputs, outputs, sequence, interactions, resources, criteria, risks, opportunities, measures and retained evidence. A SIPOC table—suppliers, inputs, process, outputs and customers—is a useful starting model, but it should be supplemented by controls and performance measures.

3. Risk-based thinking and planning

ISO 9001 does not require one prescribed risk-management method or a universal risk score. The method should be proportionate to the organization’s size, complexity and risk. A simple qualitative approach may classify risks as low, medium or high. A more formal method may calculate a priority score:

Here, R is a risk priority score, P is the assessed probability of occurrence and I is the assessed impact. If both scales run from 1 to 5, R ranges from 1 to 25. This multiplication is a management convention, not a law of nature. It assumes that the scales are defined consistently and that probability and impact are sufficiently meaningful to combine. It should not conceal a catastrophic low-probability event or replace professional judgement.

A process risk register might identify:

Risk-based planning should connect four questions: What might prevent the intended result? What opportunity could improve it? What control is needed? How will effectiveness be evaluated? Controls should be embedded in processes, not left only in a risk register.

Quality objectives should be measurable where practicable, consistent with policy and monitored. Examples include reducing complaint recurrence, increasing on-time delivery, improving first-pass yield or completing competence assessments. An objective should identify its measure, baseline, target, owner, resources, due date and review method. “Improve quality” is an aspiration, not an operational objective.

4. Leadership, responsibilities and support

Top management is accountable for QMS effectiveness. It should integrate QMS requirements into business processes, promote process thinking, provide resources, communicate the importance of conformity and customer satisfaction, and ensure that people are not pressured to bypass critical controls.

The quality manager may coordinate the system, but cannot own every process or substitute for leadership. Process owners are accountable for process performance; employees are responsible for following approved methods and reporting problems; internal auditors evaluate conformity and effectiveness independently enough to be credible.

Competence and organizational knowledge

Competence includes education, training, skills and experience. A competent-person system should:

1. define required competence for relevant roles;
2. assess current competence;
3. provide training or other development;
4. evaluate whether the action was effective; and
5. retain appropriate evidence.

Attendance at training is not proof of competence. Effectiveness may be demonstrated through observation, examination, supervised work, error rates or successful authorization.

Organizational knowledge includes specifications, lessons learned, process parameters, troubleshooting experience and customer knowledge. When experienced employees leave, undocumented tacit knowledge can disappear. Structured handovers, communities of practice, standard work and post-event reviews reduce this vulnerability.

5. Documented information: design, control and evidence

ISO 9001 uses the term documented information, covering both information that must be maintained as a controlled document and information that must be retained as evidence. The standard does not require a fixed “quality manual” or a particular software system.

Maintained and retained information

• Maintained information tells people what to do: policies, procedures, specifications, work instructions, forms and process criteria.
• Retained information demonstrates what was done or achieved: inspection results, training evidence, audit reports, management-review outputs, supplier evaluations and corrective-action records.

The distinction is functional, not merely grammatical. A completed form may be a retained record; the blank approved form is maintained information.

Effective control includes approval, review, version status, access, distribution, change control, protection, retrieval, retention and disposition. Digital systems also require backup, access permissions, audit trails, cybersecurity and arrangements for system migration. Excessive documentation can create work that does not improve control; insufficient documentation creates dependence on memory and inconsistent practice.

A document should answer: What activity does it control? Who uses it? What risks does it address? What evidence is generated? When must it be reviewed? Who may change it?

6. Operational controls

Operational planning translates customer, legal and internal requirements into controlled execution.

Customer-related processes

Before accepting an order or commitment, the organization should review requirements, including those stated by the customer, not stated but necessary for intended use, statutory and regulatory requirements, and differences from previously agreed requirements. Changes should be communicated to relevant personnel.

Marketing claims require governance. An organization should not promise performance, delivery or compliance that its processes cannot support. Contract review is therefore both a commercial and a quality control.

Design and development

Where applicable, design controls should define inputs, outputs, reviews, verification, validation, changes and responsibilities. Verification asks whether outputs meet specified inputs; validation asks whether the resulting product or service is suitable for its intended use. For example, software passing a code review may satisfy design inputs, but user validation is still needed to establish practical fitness.

Control of external providers

Outsourcing does not transfer ultimate responsibility for conforming outputs. Provider controls should reflect risk and may include qualification, capability assessment, defined purchase information, inspection, performance monitoring, audits and escalation. A low-risk stationery supplier does not require the same controls as a supplier of safety-critical components.

Purchase information should specify relevant requirements such as drawings, acceptance criteria, competence, inspection, traceability and change notification. Incoming inspection should be based on risk rather than habit.

Production and service provision

Controlled conditions may include documented information, suitable infrastructure, competent personnel, monitoring equipment, process validation, identification and traceability, preservation, customer property and post-delivery activities. Validation is especially important where the output cannot be fully verified later, such as sterilization, welding, some software deployments or professional services.

Monitoring and measuring resources must be suitable for the purpose and, where necessary, calibrated or verified against standards. If equipment is found unsuitable, the organization should assess the validity of previous results and take action.

Release and nonconforming outputs

Release should occur only after planned requirements have been satisfactorily completed, unless an authorized person approves otherwise and, where applicable, the customer accepts it. Evidence should identify the person authorizing release.

Nonconforming outputs should be identified and controlled to prevent unintended use or delivery. Disposition may involve correction, segregation, rework, return, concession or destruction. Reworked output should be reverified when appropriate. Nonconformity records should distinguish immediate correction from corrective action, which addresses the cause of recurrence.

7. Performance evaluation and improvement

A QMS needs measures that support decisions. Useful indicators may include complaint rate, on-time delivery, process capability, rework, warranty cost, audit findings, supplier performance and corrective-action recurrence. No single indicator proves quality. A low complaint rate may reflect poor reporting rather than good performance.

Internal audits provide structured evidence about conformity and effectiveness. An audit programme should consider process importance, changes, previous results and risk. Auditors should be competent and sufficiently objective. An audit finding should state the requirement, objective evidence and the condition observed. “The process is poor” is not an auditable finding; “three of ten sampled release records lacked required authorization” is specific and testable.

Management review evaluates whether the QMS remains suitable, adequate and effective. Inputs commonly include trends in customer satisfaction, process performance, nonconformities, audit results, supplier performance, resource adequacy, risks and opportunities, and improvement opportunities. Outputs include decisions about resources, changes and improvement.

Corrective action follows a disciplined sequence:

1. react to the nonconformity and control its consequences;
2. investigate whether similar problems exist or could occur;
3. determine causes using appropriate methods such as 5 Whys, fault-tree analysis or cause-and-effect analysis;
4. implement action;
5. evaluate effectiveness; and
6. update risks, documents or training where necessary.

A correction fixes the immediate instance. Corrective action reduces the likelihood of recurrence. Preventive thinking is embedded in risk-based planning even though the 2015 structure does not require a separate preventive-action clause.

8. Certification and conformity assessment

Certification is a formal, independent conformity assessment in which an accredited certification body audits an organization against ISO 9001 requirements and issues a certificate when conformity is demonstrated. ISO itself does not certify organizations. Accreditation bodies assess the competence and impartiality of certification bodies.

A typical certification pathway includes:

1. decision to implement and define scope;
2. gap analysis against requirements;
3. QMS design and implementation;
4. internal audit and management review;
5. Stage 1 audit, examining readiness, scope, documented information and preparedness;
6. Stage 2 audit, evaluating implementation and effectiveness;
7. correction and corrective action for findings;
8. certification decision; and
9. surveillance audits and periodic recertification.

Certification is not a guarantee that every product is perfect, nor is it an award for superior quality compared with every uncertified competitor. It indicates that the QMS was found to conform to the audit criteria within the stated scope at the time of assessment. Organizations should avoid misleading claims such as “ISO-approved product” when only the management system is certified.

Certification costs include consultancy, training, system development, audit fees, employee time and ongoing surveillance. A risk-based business case should consider customer requirements, market access, regulatory expectations, process discipline and learning benefits. Certification pursued only for a logo often produces ceremonial compliance.

9. Sector-specific and integrated requirements

ISO 9001 provides a foundation but may need to be combined with sector-specific requirements. Examples include:

These standards should not be treated as interchangeable. ISO 9001 addresses QMS requirements; ISO 14001 addresses environmental management; ISO/IEC 27001 addresses information-security management. An integrated system can share context analysis, document control, audits and management review while retaining discipline-specific controls.

Legal compliance cannot be outsourced to the certification body. The organization must identify applicable laws, maintain access to current requirements, assign responsibility, evaluate compliance and retain evidence. Ethical governance also requires truthful records, impartial reporting, protection of whistleblowers, respect for customer data and refusal to conceal defects.

10. Technology, digital QMS and artificial intelligence

Digital QMS platforms can improve version control, workflow, traceability, dashboards, electronic approvals and corrective-action follow-up. However, digitizing a poor process merely makes poor control faster. System design should address access rights, electronic signatures, data integrity, backup, cybersecurity, retention and business continuity.

Artificial intelligence may assist with classifying complaints, detecting document inconsistencies, identifying trends and suggesting likely causes. It should not automatically approve safety-critical release, alter controlled specifications or make compliance claims without accountable human review. AI outputs can be inaccurate, biased, non-reproducible or based on incomplete data. Governance should define approved uses, validation, human authorization, data protection, logging and escalation. Where AI influences a QMS decision, the organization should retain sufficient evidence to explain and challenge that decision.

Contemporary QMS design increasingly addresses climate resilience, supply-chain disruption, remote work, cybersecurity, circular economy expectations and product traceability. These developments do not eliminate core quality principles; they expand the context in which quality must be managed.

Applied case: illustrative implementation in a precision-pump manufacturer

Background

A fictional company, ApexFlow Pumps, manufactures industrial dosing pumps for water-treatment plants. It has 120 employees, exports to three countries and has grown rapidly through subcontracting machining and electronics assembly.

Problem

Customers reported late deliveries, inconsistent calibration certificates and repeated failures linked to incorrect electronic modules. Departments maintained separate spreadsheets, supplier approval was informal, and corrective actions were closed after replacement without investigating causes. Management decided to implement an ISO 9001-based QMS before seeking certification.

Analysis

A cross-functional team mapped quotation, contract review, design change, purchasing, incoming inspection, assembly, calibration, release and after-sales service. The analysis showed that the problem was not simply operator error. Requirements were transferred inconsistently from sales to engineering; approved supplier criteria were unclear; and the calibration laboratory lacked a controlled record template.

The team ranked risks using defined probability and impact scales, while separately escalating safety and regulatory risks regardless of score. It identified climate-related interruption risks because extreme heat had previously affected the electronics supplier and transport network.

Approach and solution

ApexFlow defined the QMS scope, process owners and customer requirements matrix. It introduced:

• mandatory contract review for technical and delivery requirements;
• controlled bills of material and engineering-change approval;
• risk-based supplier qualification and incoming verification;
• electronic calibration records with instrument status and traceability;
• release authorization tied to completed test evidence;
• a corrective-action process requiring cause analysis and effectiveness review;
• monthly process indicators and quarterly management review; and
• contingency arrangements for critical electronic modules.

Training effectiveness was assessed through supervised demonstrations rather than attendance alone. Internal auditors sampled actual records across shifts and suppliers.

Outcome

After six months, first-pass acceptance improved, late delivery declined and calibration records became retrievable within minutes. The company achieved certification within the defined scope, although the certification audit identified a need to strengthen evaluation of outsourced special processes. Management treated this as useful feedback rather than as a reason to conceal the activity.

Learning points

The case demonstrates that certification follows system discipline; it does not create it. Process mapping exposed interactions that departmental procedures had hidden. Evidence became useful when linked to decisions. Supplier control required more than an approved-supplier list, and corrective action required more than replacing defective parts. Finally, a QMS was effective because operational managers owned the processes while quality professionals facilitated coherence and assurance.

Challenges and limitations

QMS implementation may fail through bureaucratic overload, weak leadership, fragmented ownership, fear of reporting, superficial risk scoring, audit fixation or excessive dependence on consultants. Small organizations may struggle with resources, while large organizations may struggle with inconsistent local practices. Standardized procedures can also suppress professional judgement if they are written without understanding actual work.

ISO 9001 is a management-system standard, not a complete product-safety, environmental, information-security or ethical-governance system. Certification audits use sampling and limited time; they cannot observe every transaction or guarantee future performance. The appropriate response is not to reject standardization but to understand its boundaries and integrate complementary controls.

Best practice is to maintain a lean, risk-proportionate QMS; involve process users; use data without worshipping metrics; audit real work; investigate recurring problems; protect the independence of assurance; and connect quality objectives with strategy, customer value and legal responsibility.

Chapter Summary

A quality management system is an interconnected framework of processes, controls, responsibilities, resources and evidence used to achieve consistent, conforming and valuable outputs. ISO 9001:2015 provides generic requirements organized around context, leadership, planning, support, operation, performance evaluation and improvement, with climate considerations added in 2024.

The process approach requires organizations to define inputs, outputs, interactions, owners, criteria, risks, measures and evidence. Context analysis considers internal and external issues, interested parties, scope and applicable requirements. Risk-based thinking connects uncertainty to operational controls and objectives, but risk scores are conventions that must be supported by judgement.

Documented information includes both instructions that are maintained and evidence that is retained. Operational control covers customer requirements, design, external providers, production or service delivery, release and nonconforming outputs. Performance evaluation uses indicators, audits and management review, while corrective action addresses causes rather than merely correcting symptoms.

Certification is independent conformity assessment of the QMS within a defined scope; it is not certification of every product and not a guarantee of excellence. Sector-specific standards, legal obligations, climate resilience, cybersecurity and responsible AI may require additional controls. The most effective QMS is proportionate, process-owned, evidence-based, ethically governed and continuously improved.

Key Terms

Quality management system: Coordinated processes, responsibilities and resources for directing and controlling quality.

ISO 9001: International requirements standard for a quality management system.

Process approach: Management of activities as interacting processes within a system.

PDCA: Plan–Do–Check–Act cycle for control, evaluation and improvement.

Quality management principle: Foundational idea guiding effective quality management.

Interested party: Person or organization that can affect, be affected by or perceive an effect from a decision or activity.

Context: Internal and external issues relevant to an organization’s purpose and QMS results.

Scope: Boundaries and applicability of the QMS.

Risk-based thinking: Consideration of uncertainty, threats and opportunities when planning and controlling work.

Documented information: Information required to be controlled and maintained or retained by the QMS.

Process owner: Person accountable for the performance and control of a process.

Conformity: Fulfilment of a requirement.

Nonconformity: Failure to fulfil a requirement.

Correction: Action to eliminate a detected nonconformity.

Corrective action: Action to eliminate the cause of a nonconformity and prevent recurrence.

Internal audit: Systematic evaluation of conformity and effectiveness by or for the organization.

Management review: Top-management evaluation of QMS suitability, adequacy and effectiveness.

Certification body: Independent organization that audits a management system against specified criteria.

Accreditation: Formal recognition of a conformity-assessment body’s competence and impartiality.

Traceability: Ability to follow the history, application, location or evidence associated with an output.

Review Questions

Short Answer Questions

1. What is the difference between a QMS and a quality manual?
2. State the seven quality management principles.
3. Distinguish maintained documented information from retained documented information.
4. What is the difference between correction and corrective action?
5. Why does certification not guarantee that every product is defect-free?

Long Answer Questions

1. Explain how the process approach and PDCA model reinforce each other in an ISO 9001-based QMS.
2. Describe a systematic method for analysing organizational context and interested-party requirements.
3. Discuss the controls required for effective management of externally provided processes and products.
4. Explain the stages of ISO 9001 certification and the responsibilities of the organization, certification body and accreditation body.
5. Evaluate the role of internal audit, management review and corrective action in continual improvement.

Analytical / Application Questions

1. Design a process profile for a university student-admissions process. Identify inputs, outputs, process owner, risks, controls, measures and retained evidence.
2. A company has a low complaint rate but rising rework and employee reports of suppressed defect recording. Analyse what additional evidence and controls should be introduced before management concludes that quality is improving.
3. An organization plans to use AI to classify supplier nonconformities and recommend disposition. Develop a governance plan addressing validation, human authorization, data integrity, traceability and ethical risk.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the process approach in ISO 9001?

A. Each department operates independently to avoid accountability conflicts.

B. Activities are managed as interacting processes with inputs, outputs, controls and measures.

C. Only production activities are treated as processes.

D. Processes are documented only after a failure occurs.

Correct Answer: B. Activities are managed as interacting processes with inputs, outputs, controls and measures.

Question 2

Which item is an example of retained documented information?

A. An approved work instruction

B. A quality policy

C. A completed internal-audit report

D. A blank inspection form

Correct Answer: C. A completed internal-audit report

Question 3

What is the primary purpose of contract review before accepting an order?

A. To eliminate the need for customer communication

B. To confirm that requirements are understood and can be fulfilled

C. To transfer all quality responsibility to the customer

D. To replace process monitoring

Correct Answer: B. To confirm that requirements are understood and can be fulfilled

Question 4

Which statement correctly distinguishes correction from corrective action?

A. Correction addresses an immediate nonconformity; corrective action addresses its cause.

B. Correction is always strategic; corrective action is always operational.

C. Correction is performed only by auditors; corrective action only by customers.

D. They are identical terms with no practical distinction.

Correct Answer: A. Correction addresses an immediate nonconformity; corrective action addresses its cause.

Question 5

Who certifies an organization against ISO 9001 requirements?

A. ISO headquarters directly

B. The organization’s quality manager

C. An independent certification body

D. The organization’s largest customer

Correct Answer: C. An independent certification body

Question 6

Which activity is most directly associated with Stage 2 of certification?

A. Defining the ISO standard’s publication rights

B. Evaluating implementation and effectiveness of the QMS

C. Selecting the organization’s business strategy

D. Accrediting the certification body

Correct Answer: B. Evaluating implementation and effectiveness of the QMS

Question 7

A risk score is calculated as R = P × I, where P = 4 and I = 5. What is the score?

A. 9

B. 20

C. 25

D. 45

Correct Answer: B. 20

Question 8

Which control is most appropriate for a safety-critical externally provided component?

A. No evaluation because outsourcing transfers responsibility

B. The same informal control used for office stationery

C. Risk-based supplier qualification, specified requirements and verification

D. Acceptance based only on the supplier’s advertising claims

Correct Answer: C. Risk-based supplier qualification, specified requirements and verification

Question 9

What is the main purpose of management review?

A. To replace all internal audits

B. To evaluate QMS suitability, adequacy, effectiveness and improvement needs

C. To approve individual employee leave

D. To issue product warranties

Correct Answer: B. To evaluate QMS suitability, adequacy, effectiveness and improvement needs

Question 10

Which statement about ISO 9001 certification is accurate?

A. It certifies every product manufactured by the organization.

B. It guarantees no future nonconformities will occur.

C. It indicates conformity of the QMS within a defined scope at the time of assessment.

D. It makes legal compliance unnecessary.

Correct Answer: C. It indicates conformity of the QMS within a defined scope at the time of assessment.