Quality Management Principles and ISO Terminology

Introduction

A quality management system (QMS) is not merely a collection of procedures used to pass an audit. It is the organized way in which an organization directs, controls, evaluates and improves activities that influence the quality of products and services. ISO 9000:2015 provides the fundamental concepts and vocabulary for quality management, while ISO 9001:2015 specifies requirements for a certifiable quality management system. Together, they provide a common language for organizations, customers, regulators, suppliers and auditors.

The seven quality management principles are the conceptual foundation of the ISO 9000 family:

1. Customer focus
2. Leadership
3. Engagement of people
4. Process approach
5. Improvement
6. Evidence-based decision making
7. Relationship management

These principles are not independent slogans. They form an interconnected management logic. Customer needs establish direction; leadership creates alignment; competent and engaged people operate processes; process performance generates evidence; evidence supports decisions; improvement strengthens the system; and relationships with relevant interested parties sustain organizational capability.

At postgraduate level, it is important to distinguish between compliance and quality management. Compliance asks whether specified requirements have been met. Quality management asks whether the organization reliably creates value, controls variation, learns from experience and remains capable of meeting changing requirements.

Learning Objectives

After studying this chapter, students should be able to:

• explain the seven quality management principles and their interrelationships;
• distinguish quality, conformity, nonconformity, effectiveness and efficiency;
• identify customers and other interested parties relevant to a QMS;
• apply the process approach to an organizational activity;
• explain the role of risk-based thinking, documented information and organizational knowledge;
• use evidence to support quality-related decisions;
• evaluate leadership, people engagement and relationship management in practice; and
• analyze a quality-management case and recommend an integrated response.

The Conceptual Foundation of ISO Quality Management

Quality as value perceived by relevant parties

In ISO terminology, quality is the degree to which a set of inherent characteristics of an object fulfils requirements. An object may be a product, service, process, system, person, organization, resource or combination of these. Characteristics can be physical, sensory, behavioural, temporal, ergonomic, functional or ethical.

This definition has three important implications. First, quality is not limited to manufacturing defects. A service may be technically correct but poor in responsiveness, accessibility or courtesy. Second, quality is judged against requirements, which may be explicit, implicit, statutory, regulatory or contractual. Third, quality is multidimensional: an organization may satisfy one requirement while failing another.

Quality should therefore not be equated with luxury, perfection or the absence of all variation. A fit-for-purpose, affordable service can be high quality when it reliably fulfils relevant requirements and creates value for customers and other interested parties.

Requirements and conformity

A requirement is a need or expectation that is stated, generally implied or obligatory. Requirements may originate from customers, laws, regulators, professional standards, internal policies or the organization’s own commitments.

Conformity is the fulfilment of a requirement. Nonconformity is the non-fulfilment of a requirement. These terms are more precise than the everyday expressions “good” and “bad.” A product can conform to a specification yet fail to satisfy an unstated customer expectation, revealing a weakness in requirements determination. Conversely, a product may be useful despite a technical deviation, but it remains nonconforming unless the deviation is formally authorized or otherwise addressed.

Correction is action to eliminate a detected nonconformity. Corrective action is action to eliminate the cause of a nonconformity and prevent recurrence. These must not be confused. Reworking a defective item is correction; changing a poorly controlled process after investigating why defects recur is corrective action.

Effectiveness and efficiency

Effectiveness concerns the extent to which planned activities are realized and planned results achieved. Efficiency concerns the relationship between results achieved and resources used. An activity can be effective but inefficient—for example, delivering every order correctly through excessive overtime. It can also be efficient but ineffective—processing orders at low cost while sending incorrect products.

Managers should examine both dimensions. A narrow focus on efficiency can encourage cost reduction that damages reliability, safety or customer experience. A narrow focus on effectiveness can conceal waste and poor resource utilization.

Risk and opportunity

Risk is the effect of uncertainty. An effect is a deviation from an expected result, which may be positive, negative or both. Risk-based thinking requires an organization to consider what could prevent desired outcomes, what could create beneficial opportunities, and what controls are proportionate to the significance of the issue.

ISO 9001 does not prescribe a single risk-assessment method. Organizations may use risk registers, failure mode and effects analysis, hazard analysis, scenario analysis, supplier evaluation, trend analysis or expert judgment. The method should fit the organization’s context and the consequences of failure. A small service firm may use a simple probability–impact matrix, whereas a medical-device manufacturer may require formal, regulated risk-management techniques.

A useful conceptual representation is:

This expression is a managerial screening model, not a universal ISO formula. Likelihood and consequence must be defined consistently, and the resulting score should not replace professional judgment. A low-probability event with catastrophic consequences may deserve priority even when its numerical score is modest.

Documented information

Documented information is information required to be controlled and maintained by an organization, together with the medium on which it is contained. It includes both documents traditionally used to direct work and records retained as evidence of results.

The term deliberately avoids prescribing a particular medium. Documented information may be paper-based, electronic, audio-visual, cloud-hosted or embedded in software. Organizations must determine what information is necessary, ensure it is available where needed, protect it from loss or unauthorized alteration, and control changes, access, retention and disposition.

A procedure explains how an activity is performed; a record demonstrates what happened. In practice, one document can perform both functions, but the distinction remains useful. Excessive documentation can create bureaucracy and encourage employees to work around the system. Insufficient documentation can produce inconsistent work and weak evidence. The appropriate level is determined by process complexity, competence, risk, regulatory obligations and the need for objective evidence.

Organizational knowledge

Organizational knowledge is knowledge specific to the organization, generally gained through experience and used or shared to achieve its objectives. It includes explicit knowledge—such as specifications, lessons-learned reports and databases—and tacit knowledge, including professional judgment, practical skills and understanding of local conditions.

Knowledge can be lost when experienced employees retire, suppliers change, software is replaced or facilities are reorganized. Effective knowledge management includes mentoring, structured handover, training, communities of practice, accessible technical records, post-project reviews and controlled updating of lessons learned. Knowledge management is therefore a continuity and quality issue, not merely an information-technology function.

The Seven Quality Management Principles

1. Customer focus

Organizations depend on customers and should understand current and future customer needs, meet requirements and strive to exceed expectations. Customer focus includes identifying customer segments, translating needs into requirements, monitoring perceptions, managing complaints and balancing short-term requests with long-term value.

Customer focus is broader than customer satisfaction surveys. Satisfaction data can be incomplete, biased or delayed. Organizations should combine complaints, repeat business, service-level performance, interviews, usability studies, warranty claims, returns and direct observation. They should also distinguish the customer who purchases from the user who experiences the product and the beneficiary who receives its outcome.

Customer focus does not mean accepting every request without analysis. A request may conflict with law, safety, professional ethics, capacity or the needs of other customers. Responsible customer focus involves transparent communication and fair decisions.

2. Leadership

Leaders establish unity of purpose, direction and conditions in which people can achieve quality objectives. Leadership is demonstrated through decisions, resource allocation, behaviour and attention to results—not only through policy statements.

Senior leaders should integrate QMS requirements into business processes, communicate the importance of conformity, promote process thinking, support risk-based decisions and ensure accountability. Middle managers translate strategic intent into operating priorities, while supervisors influence daily behaviour. Leadership therefore exists at multiple organizational levels.

A common failure is symbolic leadership: executives endorse quality publicly but reward only volume, speed or short-term financial results. Such inconsistent signals create a culture in which employees hide defects or bypass controls. Effective leadership aligns incentives, performance measures and operational decisions with quality objectives.

3. Engagement of people

Competent, empowered and engaged people are essential to value creation. Engagement involves more than attendance at training. It includes participation in problem solving, access to relevant information, psychological safety, recognition, authority appropriate to responsibility and understanding of how individual work affects organizational outcomes.

Competence includes knowledge, skills and experience. Organizations should determine required competence, provide development where necessary, evaluate whether development is effective and retain appropriate evidence. However, competence evaluation should not become a paperwork exercise. Observation of work, practical demonstrations, error patterns and customer outcomes may provide stronger evidence than certificates alone.

Employees often detect emerging quality problems before formal indicators do. A culture that punishes the messenger suppresses this knowledge. A mature QMS encourages escalation of problems and distinguishes honest reporting from negligent behaviour.

4. Process approach

A process is a set of interrelated or interacting activities that uses inputs to deliver an intended result. The process approach manages work as a system of linked processes rather than as isolated departments.

For each process, managers should identify:

• purpose and intended outputs;
• inputs and their sources;
• sequence and interaction with other processes;
• criteria and methods, including measures;
• resources, responsibilities and authorities;
• risks and opportunities;
• controls for outsourced or externally provided activities; and
• evidence needed to demonstrate performance.

The process approach exposes hand-off failures. For example, a sales department may promise a delivery date without consulting production, while production may release goods without confirming the customer’s special packaging requirement. Neither department necessarily appears defective when assessed in isolation; the process interface is defective.

Figure: The process approach links inputs, controlled activities, outputs and feedback for improvement.

5. Improvement

Improvement is essential for maintaining performance, responding to changing conditions and creating new opportunities. It includes correction, corrective action, continual improvement, breakthrough change, innovation and organizational learning.

Improvement should be disciplined rather than impulsive. The Plan–Do–Check–Act cycle provides a useful logic: plan objectives and controls; implement them; check results against requirements; and act to standardize, correct or redesign. The cycle can operate at strategic, process and operational levels.

Root-cause analysis should seek causal mechanisms rather than blame. Techniques such as the five whys, cause-and-effect diagrams, fault-tree analysis and Pareto analysis can structure inquiry. Their outputs remain hypotheses until supported by evidence. A team that stops at “operator error” may miss confusing instructions, unsuitable equipment, workload, inadequate training or conflicting targets.

6. Evidence-based decision making

Decisions should be based on the analysis and evaluation of data and information. Evidence may include process measures, audit findings, inspection results, customer feedback, supplier performance, complaints, financial data and risk assessments.

Evidence-based management does not mean that every decision must be reduced to a single numerical score. Data can be incomplete, poorly sampled or misleading. Managers must evaluate validity, timeliness, measurement uncertainty, data definitions and possible bias. Qualitative evidence and expert judgment can be appropriate when their basis is made explicit.

A useful performance distinction is between leading and lagging indicators. A lagging indicator, such as warranty cost, reports an outcome after failure. A leading indicator, such as completion of preventive maintenance or review of design changes, may signal future performance. Neither is automatically superior; a balanced set is more informative.

7. Relationship management

Organizations manage relationships with relevant interested parties to sustain success. Interested parties are persons or organizations that can affect, be affected by, or perceive themselves to be affected by a decision or activity. They may include customers, employees, owners, suppliers, regulators, partners, communities and society.

Relationship management includes communication, collaboration, performance evaluation, development of suppliers, risk sharing and clarification of responsibilities. It does not require treating all interested parties identically. The organization must determine which parties are relevant to its QMS and which requirements are applicable.

Supplier relationships illustrate the principle. Selecting suppliers only on price can increase defects, delays, obsolescence and reputational risk. Evaluation should consider capability, quality history, delivery, resilience, regulatory compliance, information security and willingness to improve. At the same time, supplier controls should be proportionate: a critical sterilization provider requires more rigorous oversight than a supplier of office stationery.

Applying the Principles as an Integrated System

The principles reinforce one another. Customer focus identifies value; leadership provides direction; engaged people operate and improve processes; evidence reveals performance; relationships provide external capability; and improvement closes the learning loop.

A practical implementation sequence is:

1. Define the organization’s context, strategic direction and relevant interested parties.
2. Identify customer and regulatory requirements.
3. Map core, support and management processes.
4. Assign process owners, authorities, measures and resources.
5. Identify risks, opportunities and controls.
6. Determine competence and organizational knowledge needs.
7. Establish necessary documented information.
8. Monitor, audit and review performance.
9. Address nonconformities and pursue improvement.

This sequence is iterative rather than strictly linear. For example, process measurement may reveal that an interested party was overlooked, or a complaint may expose missing organizational knowledge.

ISO Terminology in Professional Use

The following distinctions are particularly important in audits and management reviews:

Verification commonly asks, “Did we produce what was specified?” Validation asks, “Is what we produced suitable for its intended use?” A software requirement review may verify that a function was implemented correctly, while user acceptance testing may validate that the system supports actual operational needs.

Worked Application: Evaluating a Service Process

Consider a university admissions process. Its intended output is an accurate and timely admission decision. Inputs include applications, evidence of qualifications, programme requirements, staff competence and information systems. Activities include application receipt, completeness checking, academic evaluation, decision authorization and communication.

A process owner might establish the following indicators:

• percentage of complete applications processed within the published time;
• rate of decisions requiring correction;
• applicant complaints concerning communication;
• proportion of cases awaiting missing information; and
• staff workload during peak periods.

Suppose 480 complete applications were processed in a month and 456 met the published time requirement. The on-time rate is:

The calculation assumes that the 480 applications are correctly classified as complete and that each application has equal status under the published service criterion. It does not, by itself, demonstrate effectiveness. If the process met the time target but produced incorrect decisions, it would be timely yet ineffective. Management should therefore examine accuracy, fairness, applicant experience and compliance with admission rules alongside speed.

Illustrative Case: A Medical Equipment Distributor

Background

The following is a fictional illustrative case. MedSupply Ltd distributes diagnostic equipment to hospitals and clinics. Its QMS had been certified for several years, but customer complaints and emergency deliveries were increasing.

Problem

The organization measured warehouse picking speed and monthly sales but did not measure order accuracy by product risk or customer urgency. Sales staff sometimes accepted verbal changes to orders without updating the controlled order record. A key supplier communicated product substitutions by email, but the information was not consistently shared with warehouse personnel. Employees were reluctant to report near misses because previous discussions had focused on blame.

Analysis

The leadership team initially proposed more final inspection. Process mapping showed that the major weaknesses occurred before inspection:

• customer requirements were incompletely captured;
• responsibility for approving substitutions was unclear;
• supplier communication was not integrated into the order process;
• performance indicators emphasized speed rather than accurate, risk-sensitive fulfilment;
• organizational knowledge about product compatibility was held by a few experienced employees.

The case demonstrated that an isolated control could not compensate for weak customer focus, relationship management, leadership and knowledge management.

Approach and solution

The organization implemented an integrated response:

1. It introduced a structured order-confirmation step for product identity, compatibility, delivery priority and regulatory requirements.
2. It classified products according to clinical and operational risk and applied proportionate approval controls.
3. It established a supplier-change notification process with defined review authority.
4. It added order accuracy, repeat complaints, near misses and supplier responsiveness to the performance dashboard.
5. It created short knowledge guides and paired experienced staff with new employees.
6. It introduced a no-blame near-miss review, while retaining accountability for deliberate violations.
7. Senior leaders reviewed quality indicators alongside sales and delivery indicators.

Outcome

After six months, the organization reported fewer incorrect shipments, faster resolution of supplier changes and more near-miss reports. The increase in near-miss reporting was initially misinterpreted as deteriorating performance. Further analysis showed that reporting behaviour had improved and that the organization was learning about previously hidden risks.

Learning points

The case illustrates five lessons. First, customer focus requires accurate understanding of use and consequences, not merely rapid delivery. Second, leadership is demonstrated by what is measured and rewarded. Third, process performance depends on interfaces between functions and organizations. Fourth, evidence must be interpreted in context; more reports can indicate greater transparency rather than worse control. Fifth, organizational knowledge is a quality resource that requires deliberate preservation.

Challenges, Limitations and Governance Considerations

The danger of treating principles as slogans

Organizations may display the seven principles while retaining functional silos, contradictory incentives and weak learning systems. Principles become meaningful only when reflected in objectives, process controls, competence, resource decisions and management review.

Measurement limitations

Indicators can be gamed, lag behind reality or encourage unintended behaviour. For example, a call centre measured only average handling time may shorten conversations while increasing repeat calls. Measures should be reviewed for validity, unintended consequences and balance between customer, process, people and business outcomes.

Human and ethical considerations

Quality decisions can affect safety, access, privacy, dignity and fairness. Customer data used for feedback must be handled lawfully and ethically. Artificial intelligence may assist in complaint classification, demand forecasting or anomaly detection, but organizations remain responsible for data quality, explainability, bias monitoring, cybersecurity and human oversight. An automated recommendation is not objective merely because it is numerical.

Proportionality and bureaucracy

ISO terminology does not require every organization to create identical manuals or records. Controls should reflect context, complexity, competence and risk. Excessive controls can slow work and encourage workarounds; inadequate controls can expose customers and the organization to preventable harm. The professional judgment required is to achieve reliable outcomes with suitable, evidence-based control.

Best Practices for Managers and Quality Professionals

• Translate customer and interested-party needs into clear, testable requirements.
• Map processes across departmental boundaries, including outsourced activities.
• Assign ownership without making quality the responsibility of one department alone.
• Use a balanced set of leading and lagging indicators.
• Investigate systemic causes rather than assigning premature blame.
• Preserve critical tacit knowledge through mentoring and structured handover.
• Design documented information around actual work and user needs.
• Evaluate suppliers according to risk and performance, not price alone.
• Make decisions traceable to reliable evidence and stated assumptions.
• Review whether measures and controls are producing the intended behaviour.
• Treat complaints, nonconformities and near misses as sources of learning.
• Integrate ethics, regulatory obligations, safety and information security into quality decisions.

Chapter Summary

Quality management principles provide the foundation for designing and operating an effective ISO-based QMS. Customer focus identifies requirements and value; leadership establishes purpose and resources; engagement of people mobilizes competence and practical knowledge; the process approach manages interactions and hand-offs; improvement develops capability; evidence-based decision making strengthens judgment; and relationship management sustains internal and external networks.

ISO terminology enables precise professional communication. Quality concerns fulfilment of requirements and perceived value. Conformity means that a requirement has been fulfilled, while nonconformity indicates failure to fulfil it. Effectiveness concerns achievement of intended results, whereas efficiency concerns results in relation to resources. Risk-based thinking addresses uncertainty, documented information provides controlled knowledge and evidence, and organizational knowledge protects the capability accumulated through experience.

The principles must be applied as an integrated system rather than as isolated audit topics. Their value is demonstrated through reliable processes, informed decisions, ethical governance, engaged people, learning from evidence and sustained improvement.

Key Terms

Quality: Degree to which inherent characteristics fulfil requirements.

Requirement: Need or expectation that is stated, generally implied or obligatory.

Conformity: Fulfilment of a requirement.

Nonconformity: Non-fulfilment of a requirement.

Effectiveness: Extent to which planned activities are realized and planned results achieved.

Efficiency: Relationship between results achieved and resources used.

Risk: Effect of uncertainty.

Interested party: Person or organization that can affect, be affected by or perceive itself to be affected by a decision or activity.

Process: Set of interrelated or interacting activities that transforms inputs into intended outputs.

Customer focus: Attention to current and future customer needs, requirements and expectations.

Leadership: Establishment of unity of purpose, direction and conditions for achieving quality objectives.

Engagement of people: Participation of competent, empowered and involved people in creating value.

Documented information: Information required to be controlled and maintained, together with its medium.

Organizational knowledge: Knowledge specific to an organization and used to achieve its objectives.

Correction: Action to eliminate a detected nonconformity.

Corrective action: Action to eliminate the cause of a nonconformity and prevent recurrence.

Verification: Confirmation that specified requirements have been fulfilled.

Validation: Confirmation that requirements for a specific intended use have been fulfilled.

Objective evidence: Data supporting the existence or verity of something.

Review Questions

Short Answer Questions

1. Define quality in the context of ISO quality management.
2. Distinguish between correction and corrective action.
3. What is meant by documented information?
4. Explain the difference between effectiveness and efficiency.
5. Identify four examples of interested parties for a manufacturing organization.

Long Answer Questions

1. Explain the seven quality management principles and discuss how they reinforce one another.
2. Describe how the process approach can reduce failures at departmental interfaces.
3. Discuss the role of leadership in creating a quality culture.
4. Explain how organizational knowledge can be identified, retained and developed.
5. Evaluate the benefits and limitations of evidence-based decision making in a QMS.

Analytical / Application Questions

1. A hospital meets its target for patient discharge time but experiences increasing readmissions. Analyze this situation using effectiveness, efficiency, customer focus and evidence-based decision making.
2. A supplier offers a substantial price reduction but has a history of late deliveries and inconsistent conformity. Develop a relationship-management and risk-based evaluation approach.
3. Design a process map for a university examination-results process. Identify inputs, outputs, process risks, interested parties, measures and documented information required.

Multiple Choice Questions with Answers

Question 1

Which statement best describes effectiveness?

A. The relationship between results and resources used

B. The extent to which planned activities and results are achieved

C. The fulfilment of every customer preference

D. The number of documents maintained by an organization

Correct Answer: B. The extent to which planned activities and results are achieved

Question 2

Which activity is an example of corrective action rather than correction?

A. Replacing a defective component

B. Sorting nonconforming products

C. Changing a process after identifying the cause of recurring defects

D. Repairing a product before shipment

Correct Answer: C. Changing a process after identifying the cause of recurring defects

Question 3

What is the primary purpose of the process approach?

A. To assign all quality responsibilities to the quality department

B. To manage activities and their interactions as a coherent system

C. To eliminate the need for performance measures

D. To ensure that every process uses the same documentation

Correct Answer: B. To manage activities and their interactions as a coherent system

Question 4

Which of the following is documented information?

A. Only paper-based procedures

B. Only records required by an external auditor

C. Information that an organization is required to control and maintain, regardless of medium

D. Any information found on the internet

Correct Answer: C. Information that an organization is required to control and maintain, regardless of medium

Question 5

A product meets its technical specification but cannot be used for its intended purpose. Which concept most directly indicates a problem?

A. Validation

B. Efficiency

C. Relationship management

D. Organizational structure

Correct Answer: A. Validation

Question 6

Which principle emphasizes using reliable data and information when making decisions?

A. Customer focus

B. Evidence-based decision making

C. Engagement of people

D. Relationship management

Correct Answer: B. Evidence-based decision making

Question 7

Which is the best example of organizational knowledge?

A. A public advertisement from a competitor

B. An employee’s practical expertise in diagnosing a recurring process problem

C. A random customer comment with no context

D. An expired price list unrelated to current operations

Correct Answer: B. An employee’s practical expertise in diagnosing a recurring process problem

Question 8

An organization processes 456 of 480 complete applications within the promised time. What is its on-time rate?

A. 90%

B. 92%

C. 95%

D. 98%

Correct Answer: C. 95%

Question 9

Which statement about risk-based thinking is correct?

A. ISO 9001 requires one fixed numerical risk formula for all organizations

B. Risk only refers to negative events

C. Risk-based thinking considers the effects of uncertainty and proportionate controls

D. Risk assessment eliminates the need for leadership judgment

Correct Answer: C. Risk-based thinking considers the effects of uncertainty and proportionate controls

Question 10

Which action most clearly demonstrates leadership in a QMS?

A. Displaying a quality policy without allocating resources

B. Delegating every quality decision to auditors

C. Aligning objectives, resources and rewards with reliable quality performance

D. Increasing inspection while ignoring process causes

Correct Answer: C. Aligning objectives, resources and rewards with reliable quality performance