Audit Advisor Knowledge Base

The Process Approach in ISO 9001: How to Build a Process Map

ISO 9001
When a company begins QMS implementation, one of the most difficult topics in practice is not documents and not even the audit — it is the process approach itself. In theory, nearly everyone agrees that “we need to describe the processes.” But as soon as the discussion turns to a process map, the usual questions appear: what exactly should count as a process, how many processes should there be, do we need to identify everything, how should cross-functional links be shown, and why is any of this necessary at all?
The problem is that many organisations still think in terms of departments rather than processes. Production thinks about production, purchasing thinks about purchasing, sales thinks about sales. As a result, the company sees separate functions, but does not clearly see the overall flow of value creation for the customer. Without that, the quality management system quickly becomes formal.
That is exactly why the process approach in ISO 9001 is not just a requirement to “draw a diagram.” It is a shift to a different way of managing: from disconnected functions to interrelated processes with inputs, outputs, owners, indicators, risks, and improvement points. In that logic, a process map is not decoration for an audit, but a tool that helps the organisation see its system as a whole.

What it is

The process approach is a way of managing an organisation through understanding and controlling its processes, rather than only through its organisational structure.
A process can be explained simply: it is a sequence of interconnected activities that transforms inputs into outputs and creates a result for an internal or external customer.
For example:
  • a customer enquiry is turned into a commercial offer;
  • a purchase request is turned into delivered materials;
  • raw material is turned into finished product;
  • a service request is turned into a delivered service.
The main idea is that each process should be viewed not in isolation, but as part of an overall value creation chain.
This leads to three important conclusions.
First: a process is usually broader than a single department.
Second: a process matters not only because of what is done inside it, but because of the result it delivers at the output.
Third: the quality of the result depends not on one individual “hero,” but on how well the process is designed and managed.
A process map is a visual representation of those processes and their interactions. It helps answer questions such as:
  • what processes exist in the organisation;
  • how they are connected;
  • which are core and which are supporting;
  • where each process starts and ends;
  • how the system works as one whole.

Requirements of the standard

In ISO 9001, the process approach is one of the basic principles of the whole system.
Clause 4.4 is especially important here. It requires the organisation to determine the processes needed for the quality management system and apply them throughout the organisation.
In practice, this means the company must determine:
  • what processes are needed for the QMS;
  • their sequence and interaction;
  • their inputs and intended outputs;
  • criteria and methods for control;
  • resources;
  • responsibilities and authorities;
  • risks and opportunities;
  • ways of evaluating and improving the processes.
So the standard requires much more than simply “having processes.” It requires understanding how they are structured and how they are managed.
It is also important that the requirements of the standard do not explicitly say, “the organisation must have a separate process map in diagram form.” But if a company genuinely wants to show the sequence and interaction of its processes, a process map is one of the clearest and most practical ways to do that.
That is why, in practice, a process map almost always becomes part of a sound QMS implementation.

Why a company needs a process map

At first glance, it may seem that a process map is useful only for certification. In reality, its main value is managerial.
A good process map helps to:
  • see the organisation not by departments, but by value flow;
  • understand where process handovers work badly;
  • define process owners;
  • reveal gaps between functions;
  • make accountability easier to discuss;
  • prepare better for the internal audit;
  • understand which processes influence customer results;
  • see where process improvement is really needed.
Very often, the process map is the first thing that shows management that a problem does not sit “inside one department,” but at the interface between several processes.
For example, a missed delivery date may not be a production problem in isolation, but the result of weak links between sales, planning, purchasing, and production. As long as the organisation thinks in departments, that is hard to see. Once it starts thinking in processes, the picture becomes much clearer.

How to build a process map

In practice, it is better not to start with a beautiful diagram. Start with a few simple steps.

1. Identify what the organisation actually does for the customer

It is better to begin not with the organisational chart, but with the question: how exactly does the company create value?
For example:
  • receives an enquiry;
  • reviews requirements;
  • designs a solution, if applicable;
  • purchases materials or services;
  • manufactures the product or delivers the service;
  • checks the result;
  • ships or hands over to the customer;
  • receives feedback.
This already gives a good basis for understanding the key processes.

2. Divide processes into core, management, and support processes

This is one of the most practical ways to structure the map.
Core processes are those that directly create value for the customer.
For example: sales, design, production, service delivery, logistics.
Management processes are those that direct and evaluate the system.
For example: strategic planning, setting objectives, management review, internal audits, risk management.
Support processes are those that enable the core ones to function.
For example: human resources, IT, metrology, document control, purchasing, infrastructure maintenance.
The key point is not to argue about the “correct” classification as an end in itself. The goal is not terminology, but a clearer understanding of the system.

3. Define the links between processes

This is the critical step. A process map is not just a list. It is a way to understand interactions.
You need to see:
  • what serves as the input to the process;
  • what output it produces;
  • who receives that output next;
  • where dependencies and interfaces exist.
For example:
  • the output of sales becomes an input to planning;
  • the output of purchasing becomes an input to production;
  • the output of production becomes an input to inspection and dispatch;
  • the results of nonconformity analysis influence corrective actions and training.
This is where the shift to real process thinking begins.

4. Assign process owners

Each key process should have an owner. This is not necessarily the person who performs every task in the process, but the person accountable for the result of the process, its stability, and its development.
Without an owner, a process almost always remains “nobody’s responsibility.”

5. Do not overload the first version of the map

One of the most common mistakes is trying to show every detail, every department, every document, and every subprocess at once.
The first process map should be understandable. It should show the system at a high level, not turn into an unreadable wall chart.
It is usually better to create a simple top-level map first and then, if needed, break individual processes down in more detail later.

Moving from a process map to process thinking

Drawing the map is not enough. That is only the first step.
The real shift to process thinking begins when the company starts regularly asking questions such as:
  • what output from this process is needed by the next one;
  • who is the internal customer of this result;
  • where do deviations most often arise in the process;
  • what indicators show its effectiveness;
  • what risks threaten its stability;
  • who should initiate improvements.
That is the point at which the process map stops being “a document for the auditor” and becomes a working management model.
Process thinking is especially important at interfaces. In many companies, employees know their own function very well, but understand poorly what happens before and after them. This creates typical problems:
  • incomplete transfer of information;
  • shifting responsibility;
  • local optimisation at the expense of the overall result;
  • delays between processes;
  • repeated mistakes.
When an organisation learns to look at the whole chain, the quality of decisions usually improves significantly.

How it works in practice

Imagine a manufacturing company implementing ISO 9001.
First, it identifies its core processes:
  • review of customer enquiries;
  • order planning;
  • purchasing of materials;
  • production;
  • quality control;
  • dispatch.
Then it adds support processes:
  • human resources;
  • metrology;
  • maintenance;
  • documented information control.
And management processes:
  • objective setting;
  • risk analysis;
  • internal audits;
  • management review;
  • corrective actions.
After that, the company builds a map showing how an order moves through the system, what information is transferred between processes, where the control points are, where records are needed, and where problems most often arise.
The map then starts to be used in practical ways:
  • as a basis for process descriptions;
  • as a basis for the internal audit programme;
  • as a training tool for employees;
  • as a way to discuss nonconformities and bottlenecks;
  • as a basis for defining process KPIs.
As a result, the map helps not only with the audit, but with understanding the organisation itself much better.

Typical mistakes

One of the most common mistakes is drawing the process map based on the organisational chart rather than on the real flow of work.
Another is trying to include too much detail too soon. The result is a diagram that is unreadable and useless.
A third is assuming the process map is only needed for certification and can be ignored afterwards.
A fourth is failing to define interactions between processes. In that case, the map becomes only a list of boxes with no management value.
A fifth is not linking the process map with real owners, indicators, risks, and audits.
A sixth is failing to update the map when things change. If the processes change but the map does not, it quickly loses its meaning.

Practical advice

Start at the top level. Do not try to describe every subprocess from the beginning.
Look at the company through the customer’s eyes: where does value creation begin, and through which processes does the result pass?
Use the process map not as decoration, but as a working tool. A good map should help people discuss real issues, not just sit in a presentation.
It is also very useful to connect the map with:
  • process owners;
  • KPIs;
  • risks and opportunities;
  • the internal audit programme;
  • corrective actions;
  • process improvement projects.
One more important point: the process map should be understandable not only to the quality manager, but also to department managers. If they do not recognise their real work in it, the map has probably been created too formally.

Conclusion

The process approach in ISO 9001 is not a requirement to “draw a diagram for the sake of a diagram.” It is a shift from thinking in departments to thinking in value flows, process interactions, and system-wide management.
A process map is one of the most practical tools for making that shift. It helps the organisation see:
  • what processes it has;
  • how they are linked;
  • where the key interfaces are;
  • who is responsible for the result;
  • where the points of control and development are.
For a company building a quality management system, the process map is an excellent starting point for more mature management. It makes QMS implementation clearer, strengthens the internal audit, supports compliance with the requirements of the standard, and creates a foundation for real rather than formal process improvement.
So the main result of the process approach is not the map itself, but the fact that the organisation begins to think as a system.
2026-03-14 19:06