Auditing the Process Approach: ISO 9001 Clause 4.4 in Practice

Why Clause 4.4 Is the Heart of Your QMS Audit

When auditors talk about auditing a quality management system, they often jump straight to objectives, nonconformities, and corrective actions. But the foundation of any ISO 9001 audit sits right back at Clause 4.4, which requires the organisation to establish, implement, maintain, and continually improve its QMS and its processes. If the process approach is not working, nothing else in the system will hold together properly.

Auditing the process approach under ISO 9001 Clause 4.4 is one of the most important and, frankly, one of the most underestimated skills in audit practice. Many auditors treat it as a formality, a quick check of the process register, and then move on. Experienced auditors know that Clause 4.4 is where you find out whether the organisation actually understands and manages its own operations, or whether the QMS is just a set of documents sitting in a folder.

This article walks through what Clause 4.4 actually requires, how to audit it effectively, what evidence to look for, and the common gaps that auditors find in practice. If you want to understand process based auditing at a deeper level, the companion article The Process Approach Explained With Examples provides useful background on the concept itself.

What ISO 9001 Clause 4.4 Actually Requires

Before you can audit Clause 4.4 effectively, you need to be clear on what it demands. The clause requires the organisation to determine the processes needed for the QMS and their application throughout the organisation. That sounds simple, but the detail matters.

Clause 4.4.1 sets out eight things the organisation must determine for each process:

• The inputs required and outputs expected
• The sequence and interaction of the processes
• The criteria and methods needed to ensure effective operation and control
• The resources needed and their availability
• The responsibilities and authorities for each process
• The risks and opportunities related to the process, as addressed under Clause 6.1
• Methods for monitoring, measuring, and evaluating the process
• Opportunities to improve the process and the QMS overall

Clause 4.4.2 then requires the organisation to maintain documented information to support the operation of its processes and to retain documented information to the extent necessary to have confidence that processes are being carried out as planned.

That distinction between maintaining and retaining documented information is important in audit practice. Maintaining refers to living documents like procedures and process descriptions. Retaining refers to records that demonstrate what actually happened.

Understanding Process Inputs and Outputs Before You Walk In

Good preparation is everything when auditing the process approach. Before you arrive on site, or before you start a remote audit session, you should understand the organisation's process map or process register. Most organisations will have some form of this, whether it is a turtle diagram, a flowchart, a list of processes, or something more sophisticated.

Ask yourself these questions during your document review:

• Has the organisation clearly identified its core processes, support processes, and management processes?
• Are the interactions between processes documented or at least described?
• Do the process descriptions identify inputs, outputs, owners, and performance measures?
• Is there evidence that risks and opportunities have been considered at the process level?

If the organisation has not defined its processes at all, that is a finding in itself. If the process map exists but bears no resemblance to how the organisation actually operates, that is a more serious finding because it suggests the QMS has been built for the auditor rather than for the business.

Turtle diagrams are a particularly useful tool for both organisations and auditors when examining individual processes. They capture inputs and outputs, the resources used, the methods applied, the competencies required, and the performance indicators for a given process, all on a single page. If you are not familiar with using them in audit practice, the article Turtle Diagrams: How to Use Them in Process Audits is worth reading before your next process audit.

How to Audit the Process Approach on Site

Start With the Process Owner

For each process you are auditing, your first interview should be with the person who owns or manages that process. Ask them to walk you through the process from start to finish. Listen carefully to how they describe it. Do they understand the inputs that trigger the process? Can they tell you what a good output looks like? Do they know what can go wrong and what controls are in place?

A process owner who cannot describe their own process without reading from a procedure is a red flag. It may indicate that the process was designed by someone else, perhaps a consultant or a quality manager, and has never been genuinely adopted by the people running it.

Key questions to ask the process owner include:

• What triggers this process to start?
• What does a successful output from this process look like?
• What can go wrong, and what do you do when it does?
• How do you know the process is performing well?
• What information do you receive from the previous process, and what do you hand over to the next one?

Follow the Process Through the Operation

One of the most powerful techniques in process auditing is to follow a real example through the process from beginning to end. Pick a recent job, order, service delivery, or project and trace it through the system. This is sometimes called vertical auditing or following the audit trail.

For example, in a manufacturing organisation, you might pick a specific production batch and trace it from the customer order through design review, procurement of materials, production planning, manufacturing, inspection, and final release. At each stage, you are looking for evidence that the process operated as described, that inputs were received and outputs were produced, and that any issues were identified and addressed.

This approach quickly reveals whether the process map on paper reflects what actually happens in practice. Gaps between the documented process and the real process are among the most common findings under Clause 4.4.

Check the Sequence and Interaction of Processes

Clause 4.4.1 specifically requires the organisation to determine the sequence and interaction of its processes. This is not just about having a pretty flowchart. It means the organisation must understand how processes connect, what passes between them, and where breakdowns can occur at the handover points.

Handover points between processes are often where quality problems originate. The design team hands over to production without complete specifications. The sales team commits to a delivery date without checking with operations. Procurement receives a purchase order but does not communicate lead time changes back to planning.

When auditing, pay particular attention to these interfaces. Ask what information or materials pass from one process to the next, who is responsible for the handover, and what happens when the incoming information is incomplete or incorrect.

Verify That Performance Measures Are in Place and Used

Clause 4.4 requires the organisation to determine the criteria and methods needed to ensure effective operation and control of its processes, including monitoring, measuring, and evaluating performance. This connects directly to Clause 9.1.1, but the requirement to define process performance measures starts here at Clause 4.4.

During your audit, ask the process owner what they measure and how they know the process is working. Then ask to see the data. A process that has performance indicators defined on paper but no actual measurement data is not being managed effectively.

Common issues you will find in practice include:

• Performance indicators defined in process documentation but not actually tracked
• Metrics that measure activity rather than effectiveness, for example, number of audits conducted rather than whether those audits led to improvement
• No trend analysis, so the organisation cannot tell whether performance is improving or deteriorating
• Process owners who are unaware that performance measures exist for their process

Auditing Process Responsibilities and Authorities

Clause 4.4.1 requires the organisation to assign responsibilities and authorities for its processes. This links to Clause 5.3, but the specific requirement to assign process ownership sits within Clause 4.4.

In practice, many organisations have job descriptions and an organisational chart, but nobody is clearly responsible for end to end process performance. The quality manager might own the quality management process, but who owns the sales process? Who owns the delivery process? Who is accountable when the process fails to produce the right output?

Ask during interviews who is responsible for each process you are auditing. Then verify that the person named actually understands and accepts that responsibility. Check whether the process owner has the authority to make changes to the process when performance is poor, or whether everything requires sign off from someone higher up who may not be close enough to the process to understand it.

Common Clause 4.4 Nonconformities in Practice

After conducting hundreds of audits across different industries, the following gaps come up repeatedly when auditing the process approach:

Process Map Does Not Reflect Reality

The organisation has a process map, but when you follow a real example through the operation, the actual sequence of activities is quite different from what is documented. This is particularly common in organisations that developed their QMS for certification and then continued to operate in the way they always had.

No Defined Inputs or Outputs

Process descriptions exist, but they describe activities without clearly identifying what triggers the process or what constitutes a successful output. Without defined outputs, there is no basis for determining whether the process is performing effectively.

Risks and Opportunities Not Considered at Process Level

The organisation has a risk register, but it sits at the organisational level and has not been connected to individual processes. Clause 4.4.1 specifically requires risks and opportunities to be addressed for each process, not just for the organisation as a whole. This is a common gap that links back to the requirements of Clause 6.1.

Outsourced Processes Not Adequately Controlled

Clause 4.4.1 includes a note that processes that are outsourced must be controlled, with reference to Clause 8.4. Many organisations identify their internal processes but fail to include outsourced processes in their process framework. If a critical part of your service delivery is performed by an external provider, that process still needs to be defined, monitored, and controlled.

Documented Information Does Not Support Process Operation

Clause 4.4.2 requires the organisation to maintain documented information to support process operation. In practice, this means procedures, work instructions, forms, and specifications must be available at the point of use. Auditors regularly find that documented information exists in a quality management system that workers cannot access, or that the documents are so out of date they bear no relationship to how work is actually performed.

Process Based vs Clause Based Auditing

It is worth being explicit about the difference between auditing by clause and auditing by process, because this affects how you structure your entire audit. A clause based approach would see you work through Clause 4.4, then Clause 5, then Clause 6, and so on. A process based approach starts with the processes themselves and then identifies which clauses are relevant to each process.

ISO 9001 was deliberately structured around the process approach, and the standard itself encourages process based auditing. When you audit the sales process, you will naturally cover requirements from Clause 4.4, Clause 5.3, Clause 6.1, Clause 8.2, and Clause 9.1.1 all in the context of that single process. This produces a much richer picture of how the system is actually working than a clause by clause walkthrough ever could.

The article Process Based vs Clause Based Auditing explores this distinction in more detail and is particularly useful if you are building or refining your audit approach.

Practical Audit Evidence for Clause 4.4

When writing your audit findings, you need to be specific about the evidence you gathered. For Clause 4.4, the types of evidence you should be collecting include:

• The organisation's process register or process map, including the version date and whether it has been reviewed recently
• Individual process descriptions, turtle diagrams, or procedure documents that define inputs, outputs, resources, controls, and performance measures
• Records demonstrating that processes were carried out as planned, such as completed checklists, inspection records, batch records, or job cards
• Performance data for each process, such as on time delivery rates, defect rates, customer complaint data, or cycle times
• Evidence that risks and opportunities have been identified for individual processes
• Records of process reviews, including any changes made as a result of performance monitoring
• Interview notes from process owners demonstrating their understanding of process inputs, outputs, and performance expectations

When something is missing or does not align with the standard, be specific in your finding. Rather than writing

the process approach is not implemented

the documented process map for the production process does not reflect the actual sequence of activities observed during the audit. The incoming inspection step documented in Procedure QP 04 was not performed for the batch reviewed on the day of audit. No performance data was available for the production process for the preceding six months.

Linking Clause 4.4 to the Rest of the Audit

Clause 4.4 does not sit in isolation. Every other clause in ISO 9001 connects back to the process framework established under Clause 4.4. When you find a gap in Clause 4.4, look for the downstream consequences throughout the system.

If processes are not clearly defined, you will typically find that:

• Clause 6.1 risks are assessed at a generic level rather than at the process level where they actually occur
• Clause 7.2 competence requirements are vague because nobody has defined what each process requires
• Clause 9.1.1 monitoring is either absent or measuring the wrong things
• Clause 10.2 corrective actions address symptoms rather than root causes because the process that generated the nonconformity is not well understood

This is why experienced auditors treat Clause 4.4 as the lens through which the entire audit is conducted, not just one clause to check off a list.

Building Your Capability in Process Auditing

Auditing the process approach effectively is a skill that develops with practice. The more processes you audit across different industries and organisation sizes, the better your instincts become for identifying where the real risks and gaps are hiding.

If you are working towards your internal auditor or lead auditor credentials, investing time in understanding process based auditing will pay dividends throughout your career. The Audit Workshop ISO 9001 Internal Auditor and Lead Auditor courses cover process based auditing in depth, with practical exercises that simulate real audit scenarios. You will learn not just what Clause 4.4 requires, but how to apply it in the field, how to gather meaningful evidence, and how to write findings that drive genuine improvement.

Whether you are just starting out or looking to sharpen your existing skills, the How to Audit a Process You Have Never Seen Before article is a practical companion to this one, particularly when you are auditing in unfamiliar industries or operational environments.