Clause 4.1 requires an organization to

- determine the processes needed for the quality management system
- determine the sequence and interaction of these processes
- determine criteria and methods needed to ensure that both the operation and control of these processes are effective
- ensure the availability of resources and information to support the operation and monitoring of these processes
- monitor, measure, and analyse the processes
- implement actions necessary to achieve planned results and continual improvement

Clause 4.1 requires an organization to manage the processes in accordance with the requirements of the ISO 9001: 2008 standard.

Clause 4.1 requires that when an organization outsources any process that can affect product conformity to requirements, the organization shall ensure control over such processes. The type and extent of control to be applied to must be defined within the quality management system.

Quality management system processes should include management activities, provision of resources, product realization, measurement, analysis and improvement.

An outsourced process is a process which the organization chooses to have performed by an external party but is still a part of the quality management system. The organization still assumes responsibility of conformity to all customer, statutory and regulatory requirements for all outsourced processes. The control applied to the outsourced process can be influenced by the potential impact of the outsourced process on the organization’s capability to provide product that conforms to requirements, the degree to which the control for the process is shared, and the capability of achieving the necessary control through the application of purchasing procedures

All of our manual packages come with our comprehensive guide to the process of implementing an ISO 9001 compliant Quality Management System

ISO 9001:2008 requires a “Documented quality management system”, and not a “system of documents”.

The main objectives of your documentation should be:

- Communication of Information – as a tool for information transmission and communication.

- Evidence of conformity – provision of evidence that what was planned, has actually been done.  

- Knowledge sharing – to share and preserve the organization’s experiences. An example would be a technical specification, which can be used as a base for design and development of a new product.

ISO 9001:2008 clause 4.2 Documentation requirements documents may be in any form or type of medium, and the definition of “document” in ISO 9000:2005 clause 3.7.2 gives the following examples:

- paper
- magnetic
- electronic or optical computer disc 
- photograph
- master sample

ISO 9001:2008 clause 4.1 General requirements requires an organization to “establish, document, implement, and maintain a quality management system and continually improve its effectiveness in accordance with the requirements of this International Standard”

Clause 4.2.1 General explains that the quality management system documentation shall include:

- Quality policy (clause 4.2.1.a)
- Quality objectives (clause 4.2.1.a)
- Quality manual (clause 4.2.1.b)
- documented procedures required by the Standard* See Clause 4.2.2 below
- documents needed by the organization to ensure the effective planning, operation and control of its processes, and records required by the Standard

Clause 4.2 makes it clear that where the standard specifically requires a “documented procedure”, the procedure has to be established, documented, implemented and maintained. It also emphasizes that the extent of the quality management system documentation may differ due to:
- the size of organization and type of activities;
- the complexity of  processes and their interactions, and
- the competence of personnel.

All the documents that form part of the Quality Management System have to be controlled in accordance with clause 4.2.3 of ISO 9001:2008, or, for the particular case of records, according to clause 4.2.4

Clause 4.2.2 of ISO 9001:2008 specifies the minimum content for a quality manual. ISO 9001:2008 specifically requires the organization to have “documented procedures” for the following six activities:

- 4.2.3  Control of documents
- 4.2.4  Control of records
- 8.2.2  Internal audit
- 8.3  Control of nonconforming product
- 8.5.2 Corrective action
- 8.5.3  Preventive action
These documented procedures have to be controlled in accordance with the requirements of clause 4.2.3.
It is sometimes convenient to combine the procedure for several activities into a single documented procedure for example we have combined corrective action and preventive action.

Larger organizations or those with more complex processes will almost certainly require additional documented procedures particularly those relating to product realization processes.

In order to demonstrate compliance with ISO 9001:2008, you need to be able to provide objective evidence, although not necessarily documented, that your quality management system has been effectively implemented.

In order to demonstrate the effective implementation of your quality management system, it may be necessary to develop documents other than documented procedures.

There are several requirements of ISO 9001:2008 where you could add value to your quality management system and demonstrate conformity by the preparation of other documents, even though the standard does not specifically require them. Types of documents that can be useful:

Process maps, process flow charts and/or process descriptions
Organization charts
Specifications
Work and/or test instructions
Documents containing internal communications
Production schedules
Approved supplier lists
Test and inspection plans
Quality plans
Record Requirements

Records specifically required by ISO 9001:2008 are listed below:

Management Review       
- Clause 5.6.1

Education, training, skills and experience  
- Clause 6.2.2 e)

Evidence that the realization processes and resulting product fulfill requirements
- Clause 7.1 d)

Results of the review of customer requirements prior to supply related to the product and actions arising from the review
- Clause 7.2.2

Design and development inputs relating to product requirements
- Clause 7.3.2

Results of design and development reviews and any necessary actions
- Clause 7.3.4

Results of design and development verification and any necessary actions         
- Clause 7.3.5

Results of design and development validation and any necessary actions
- Clause 7.3.6

Results of the review of design and development changes and any necessary actions
- Clause 7.3.7

Results of supplier evaluations and any necessary actions arising from the evaluations
- Clause 7.4.1

As required by the organization to demonstrate the validation of processes where the resulting output cannot be verified by subsequent monitoring or measurement
- Clause 7.5.2 d)

The unique identification of the product, where traceability is a requirement
- Clause 7.5.3

Customer property that is lost, damaged or otherwise found to be unsuitable for use
- Clause 7.5.4
Basis used for calibration or verification of measuring equipment where no international or national measurement standards exist
- Clause 7.6 a)

Validity of the previous measuring results when the measuring equipment is found not to conform to requirements
- Clause 7.6

Results of calibration and verification of measuring equipment
- Clause 7.6

Internal audit results and follow-up actions
- Clause 8.2.2

Indication of the person(s) authorizing release of product
- Clause 8.2.4

Nature of the product nonconformities and any subsequent actions taken, including concessions obtained
- Clause 8.3

Results of corrective action
- Clause 8.5.2 e)

Results of preventative action
- Clause 8.5.3 d)

Other records will almost certainly be needed to demonstrate conformity of your processes, products and quality management system. Requirements for the control of records are described in clause 4.2.4 of ISO 9001:2008.