ISO 9001 · Step-by-step series · Article 6 of 10

ISO 9001 Clause 8: Operational Planning and Control of Production and Service Provision

Clause 8 of ISO 9001:2015 is the longest in the standard and the one most directly connected to the day-to-day operations of any industrial company. It covers everything from how you plan and execute production to how you manage external providers, how you control changes, and what you do when a product fails to meet requirements. This guide breaks down each subclause with practical examples and concrete tools.

Structure of clause 8: a bird's-eye view

Clause 8 is divided into seven major blocks that follow the logical flow of a company's operations:

• 8.1 Operational planning and control: defining what, how, and when things are produced.
• 8.2 Requirements for products and services: managing what the customer needs.
• 8.3 Design and development: applies when you create new products or services (can be justifiably excluded if you don't design).
• 8.4 Control of externally provided processes, products, and services: management of suppliers and subcontractors.
• 8.5 Production and service provision: the operational core — work instructions, traceability, customer property, preservation.
• 8.6 Release of products and services: how you authorize delivery to the customer.
• 8.7 Control of nonconforming outputs: what you do when something fails to meet requirements.

8.1 Operational planning and control: the master plan

Clause 8.1 requires the organization to plan, implement, control, maintain, and improve the processes needed to produce products or deliver services. This is not bureaucracy: it means having clarity, before production starts, on what resources you need, what acceptance criteria apply, and how you will demonstrate that the process was executed correctly.

The minimum elements your operational planning must include are:

• The criteria for the processes and the acceptance of products and services.
• The resources needed to achieve conformity with product requirements.
• The control of processes in accordance with the defined criteria.
• The documented information necessary to have confidence that the processes have been carried out as planned.
• The way in which planned and unplanned changes will be controlled.

8.2 Managing customer requirements: listening well to produce well

Clause 8.2 deals with how you capture, review, and manage what the customer needs before committing to deliver it. It sounds obvious, but it's one of the most frequent sources of nonconformities: the customer asked for one thing, sales understood another, and production manufactured a third.

The three pillars of 8.2 are:

• Customer communication (8.2.1): providing information on products and services, handling inquiries and contracts, obtaining feedback including complaints, and handling customer property.
• Determining the requirements (8.2.2): identifying not only what the customer explicitly requests, but also applicable statutory and regulatory requirements and any implied requirement necessary for the product's intended use.
• Review of the requirements (8.2.3): before committing to supply, reviewing that you have the capability to meet all requirements, that any differences between contract requirements and previously expressed ones have been resolved, and retaining evidence of this review.

A common mistake: skipping the order review for urgent orders or repeat customers. Even for a trusted customer, the review before accepting the order is mandatory under 8.2.3. It can be quick (a fast check that deadlines and specifications are feasible), but it must be done and evidenced.

8.3 Design and development: when you create something new

Clause 8.3 applies to organizations that design or develop products or services. If your company only manufactures to customer specifications and has no design activity of its own, you can exclude this clause from the scope of your QMS, but the exclusion must be documented and justified in the scope of the system.

For companies that do design, 8.3 requires a structured process with:

• Design planning: stages, milestones, reviews, responsibilities, resources, and involvement of interested parties.
• Design inputs: functional and performance requirements, statutory and regulatory requirements, information from previous designs, and any other essential requirement.
• Design controls: reviews, verification (does the design meet the inputs?) and validation (does the resulting product meet end-user requirements?).
• Design outputs: what the design process generates — specifications, drawings, manufacturing instructions.
• Design changes: any subsequent change must be identified, reviewed, verified, validated, and approved before implementation.

8.4 Managing external providers: the most critical clause in industry

Clause 8.4 is probably the one generating the most nonconformities in third-party audits in the industrial sector. It covers all processes, products, and services the organization obtains from external providers, which includes three scenarios:

• Products and services incorporated into the organization's own products (raw materials, components, subassemblies).
• Products and services provided directly to the customer on the organization's behalf (distribution of subcontracted services).
• Processes or functions of the organization performed by an external provider (outsourcing entire processes: heat treatment, coating, logistics).

The external provider management process required by 8.4 has three elements:

8.5 Production and service provision: the operational core

Clause 8.5 is the operational heart of clause 8. It sets out the requirements for controlling how production or service delivery is carried out, including:

• 8.5.1 Control of production and service provision: availability of documented information (work instructions, product specifications), monitoring and measuring resources, suitable infrastructure and environment, competent personnel, and validation and revalidation activities for special processes.
• 8.5.2 Identification and traceability: identifying products throughout production and, where traceability is a requirement, controlling the unique identification of outputs and retaining evidence.
• 8.5.3 Property belonging to customers or external providers: identifying, verifying, and protecting customer-owned property entrusted to you. If it is lost or damaged, notify the customer and retain evidence.
• 8.5.4 Preservation: preserving outputs during production and delivery to maintain conformity with requirements — packaging, handling, storage, transportation.
• 8.5.5 Post-delivery activities: warranty, after-sales service, recycling, or other applicable post-delivery obligations.
• 8.5.6 Control of changes: reviewing and controlling changes to production to maintain conformity. Retaining evidence of the person authorizing the change.

8.6 Release of products and services: formal authorization

Clause 8.6 requires the organization to implement planned arrangements at appropriate stages to verify that product requirements have been met. Release to the customer cannot proceed until all planned arrangements have been satisfactorily completed, unless otherwise approved by a relevant authority and, where applicable, by the customer.

The documented information to be retained regarding release includes: evidence of conformity with acceptance criteria and traceability to the person(s) authorizing release.

8.7 Control of nonconforming outputs: the mandatory checklist

Clause 8.7 is one of the most heavily audited because it's easy to verify on the shop floor. It requires the organization to ensure that outputs that do not conform to their requirements are identified and controlled to prevent their unintended use or delivery.

There are four possible actions when facing a nonconforming product:

• Correction: rework or repair so the product meets requirements.
• Segregation, containment, return, or suspension of supply: isolating the product to prevent it from moving forward in the process or reaching the customer.
• Informing the customer: when the nonconforming product has already been delivered, notifying the customer.
• Obtaining authorization for concession: accepting the product as-is, documenting who authorizes it and under what conditions.

Most common audit findings on clause 8

After analyzing hundreds of audit reports from industrial SMEs, these are the most frequent findings related to clause 8:

• 8.2.3 — No evidence of order review: sales accepts urgent orders without reviewing whether deadlines and specifications are feasible. An easy finding to detect and correct.
• 8.4.1 — Outdated approved supplier list: purchases are made from providers who have never been evaluated or haven't been re-evaluated in years.
• 8.4.3 — Purchase orders without technical specifications: material is ordered from a supplier without clearly defining quality requirements or acceptance specifications.
• 8.5.2 — Incomplete traceability: the finished product batch can be identified, but not the raw material batch used. Critical in food, pharma, and automotive.
• 8.7 — Nonexistent or unused quarantine area: nonconforming products are not physically separated from conforming stock, or the area exists but isn't used consistently.

Frequently asked questions about ISO 9001 clause 8

What is the difference between a correction and a corrective action in ISO 9001?

A correction (clause 8.7) is the immediate action taken to eliminate the detected nonconformity: rework, repair, or scrapping the defective product. A corrective action (clause 10.2) goes further: it analyzes the root cause of the nonconformity and applies measures so it does not happen again. They are complementary, not alternatives: when a nonconformity appears, you first correct the immediate problem (8.7) and then, if severity or recurrence justifies it, you open a corrective action (10.2).

Can I exclude design clause 8.3 if I don't design products?

Yes. ISO 9001:2015 allows clause 8.3 to be excluded when the organization determines that design and development is not applicable. This determination must be justified in the scope of the QMS, explaining why it doesn't apply. Common reasons include: manufacturing entirely to customer specifications, being a distributor that does not modify products, or providing standardized services with no design component of your own.

How often must I re-evaluate my external providers under ISO 9001?

ISO 9001 does not set a specific frequency for supplier re-evaluation. The standard requires that providers be "re-evaluated periodically" according to criteria defined by the organization. Common industry practice is an annual evaluation for critical providers (category A) and every two or three years for lower-impact providers. For providers with recurring issues, a quarterly or even monthly re-evaluation can be established until the provider demonstrates sustained improvement.

What happens if a nonconforming product has already reached the customer?

ISO 9001 clause 8.7 states that when nonconforming outputs are detected after delivery of products, or during or after the provision of services, the organization must take appropriate actions. This includes notifying the customer, recalling the product if necessary, and initiating relevant corrective actions. Hiding the problem is not an option compatible with the QMS. Proactively communicating with the customer is generally better for the long-term relationship than waiting for the customer to detect the problem on their own.

Does a maintenance service provider fall under clause 8.4?

Yes, if the maintenance affects equipment that produces or measures product conformity. Clause 8.4 covers "any externally provided process," which includes preventive and corrective maintenance services for production and inspection equipment, treatments applied to the product (galvanizing, painting, heat treatment), calibration of equipment by external laboratories, or subcontracted testing and quality control services. The level of control over this type of provider must be proportional to its impact on the conformity of the final product.

How should I manage customer engineering changes that affect production?

Customer engineering changes introduced during production are managed under clause 8.5.6 (control of changes). The typical process is: receipt of the change → impact review (does it affect specifications, tooling, work instructions, materials?) → update of affected documented information → formal approval of the change by the authorized person → communication to personnel → production under the new specification → retention of evidence of the change. In automotive, this is usually formalized through an Engineering Change Notice (ECN) that is kept in the customer's file.

IgeraIndustria Quality Team · Updated 2026-07-07 · ISO 9001 step-by-step series: Article 5 — Clause 7 · Article 7 — Clause 9