ISO 9001 process maps: clause 4.4, turtle diagrams & documented information

What ISO 9001:2015 actually requires

ISO 9001:2015 clause 4.4 requires the organization to "determine the processes needed for the quality management system" and to "determine the sequence and interaction of these processes." That's the bedrock requirement that makes process mapping mandatory — though the standard never specifies a notation.

Clause 7.5 then requires "documented information" to be controlled — meaning your process maps need version numbers, owners, and approval dates visible on the artifact itself.

Documented information defined

ISO 9001:2015 replaced "documents" and "records" with the umbrella term documented information. The standard explicitly requires documented information for:

• Scope of the QMS (4.3)
• Quality policy (5.2.2)
• Quality objectives (6.2.1)
• Evidence of fitness for purpose of monitoring equipment (7.1.5.1)
• Competence (7.2)
• Operational planning and control (8.1)
• Design and development outputs (8.3.5)
• Externally provided processes (8.4.1)
• Nonconformity and corrective action (10.2.2)

Process maps live inside this controlled documentation set.

Turtle diagrams explained

A turtle diagram is a single-page summary of one process, organized into six legs around a central process box:

• Inputs — what triggers and feeds the process
• Outputs — deliverables and downstream handoffs
• With what — equipment, software, infrastructure
• With whom — roles, competencies, training
• How — procedures, work instructions, methods
• How measured — KPIs, metrics, performance indicators

Auditors love turtle diagrams because they answer five of the most common clause 4.4 audit questions on one page.

SIPOC for ISO 9001

SIPOC (Suppliers → Inputs → Process → Outputs → Customers) is a five-column high-level overview, ideal for the top of your process documentation pyramid. Use it to show how a process connects upstream and downstream — particularly useful for satisfying clause 4.4's "sequence and interaction" requirement.

Pair the SIPOC with a detailed swimlane flowchart and you've covered both the bird's-eye view and the operational detail.

The 'six documented procedures' myth

ISO 9001:2008 mandated six specific documented procedures. ISO 9001:2015 removed that explicit list — you now decide which procedures need to be documented based on risk and process complexity. That said, in practice most certified organizations still maintain documented procedures for:

• Control of documented information
• Internal audit
• Control of nonconforming output
• Corrective action
• Management review
• Risk management

Process interaction matrix

To prove "sequence and interaction" (4.4.1.b), build a process interaction matrix: rows and columns list every identified process; each cell marks where one process passes inputs to another. Pair the matrix with a top-level process map showing arrows between process boxes.

Worked example: purchasing process map

A typical ISO 9001 purchasing process map (clause 8.4 — externally provided processes, products, and services) includes:

1. Purchase requisition created (Requester)
2. Supplier qualification check (Procurement)
3. Approval per delegation of authority (Manager)
4. PO issued (Procurement)
5. Goods/services received and inspected (Receiver)
6. Nonconforming product handling — if applicable (Quality)
7. Invoice three-way match (AP)
8. Payment (Treasury)

Each step gets a swimlane, every decision shows both branches, and the nonconformance path links to your corrective action procedure (clause 10.2).

Audit-ready process map checklist

• Process owner named on the diagram
• Version number and effective date visible
• Inputs, outputs, and external interfaces shown
• Decision diamonds with both branches drawn
• References to related procedures and work instructions
• KPIs / process measures called out
• Linked to risk register (clause 6.1) for high-risk steps

Frequently asked questions