Quality Assurance vs Quality Control in ISO 9001
Quality assurance controls the process; quality control checks the output. Compare both under ISO 9001, with a 10-question self-assessment checklist.
Quality assurance (QA) controls how work is planned and done, so you can be confident the result will meet requirements. Quality control (QC) checks the actual product or service and stops anything that fails. QA works on the process; QC works on the output. An ISO 9001 certification audit looks for evidence of both. This guide sets out the difference, maps each to ISO 9001 clauses and ends with a ten-question self-assessment.
What is the difference between quality assurance and quality control?
Quality assurance is the part of quality management that gives confidence before and during the work. Quality control is the part that confirms the result. ISO 9000:2015, the vocabulary standard that ISO 9001:2015 refers to, defines quality assurance as "part of quality management focused on providing confidence that quality requirements will be fulfilled" (clause 3.3.6). It defines quality control as "part of quality management focused on fulfilling quality requirements" (clause 3.3.7). ISO withdrew ISO 9000:2015 on 27 May 2026 and replaced it with ISO 9000:2026 (ISO). ISO says the new edition includes updated definitions. If your system has moved to the new editions, check the 2026 wording.
ASQ, which quotes the 2015 definitions, adds several practical points (ASQ, page reviewed December 2024). QA "relates to how a process is performed or how a product is made", while QC "is more the inspection aspect of quality management". QA activities cover virtually all of the quality system, and QC is a subset of them. ISO 9000, by contrast, lists QA and QC as separate, parallel parts of quality management. ASQ also notes that the confidence QA provides runs inward to management and outward to customers, regulators and certifiers.
QA vs QC at a glance
| Aspect | Quality assurance (QA) | Quality control (QC) |
|---|---|---|
| Core question | Will our way of working deliver a conforming result? | Does this output meet the requirement? |
| Focus | Processes, systems and people | Products, services and other outputs |
| Approach | Preventive: stop defects arising | Detective: find defects before release |
| Timing | Before and during the work | At appropriate stages: incoming, in-process and final |
| Typical activities | Procedures, training, supplier approval, internal audit, management review | Inspection, testing, measurement, release checks |
| Evidence an auditor samples | Process maps, competence records, audit reports, review minutes | Inspection and test records, release sign-offs, nonconformity logs |
| Example ISO 9001:2015 clauses | 4.4, 7.2, 8.4, 9.2, 9.3, 10.2 | 7.1.5, 8.5.1, 8.6, 8.7, 9.1.1 |
How quality assurance works in practice
Quality assurance is the planned set of controls that make a good result the normal result. In an ISO 9001 system it covers:
- Defined processes with inputs, outputs, criteria, resources and responsibilities (clause 4.4).
- Competent people, with records to show it (clause 7.2).
- Controlled suppliers, evaluated on their ability to supply to requirements, with the extent of control set by their potential impact (clause 8.4).
- Internal audit, which checks that the system conforms and is effectively implemented (clause 9.2). ASQ treats auditing as part of the QA function.
- Management review and corrective action, so performance data is acted on and causes are removed (clauses 9.3 and 10.2).
Our ISO 9001 internal audit checklist shows how to test these controls.
How quality control works in practice
Quality control is the set of checks that decide whether an output is good enough to accept or release. It is not limited to final inspection: checks on incoming material, first-off parts and work in progress are QC too. ASQ describes inspection, the core QC activity, as "measuring, examining, and testing to gauge one or more characteristics of a product or service" and comparing them with specified requirements.
In ISO 9001 terms, QC shows up as:
- Monitoring and measurement at appropriate stages of production or service delivery, under controlled conditions (clause 8.5.1).
- Release checks confirming that requirements are met before products or services go to the customer, with a record of who authorised release (clause 8.6).
- Control of nonconforming outputs, so anything that fails is identified and controlled, for example by correction, segregation, return or acceptance under concession (clause 8.7).
- Measuring equipment that is fit for purpose and, where traceability is needed, calibrated or verified (clause 7.1.5).
QC can sort good output from bad. It cannot make the process produce fewer bad outputs; that needs QA.
Where QA and QC sit in ISO 9001, and what the 2026 edition changes
Quality management is the umbrella. Within it, quality planning sets the objectives, QA builds confidence in the system and QC checks the outputs. Improvement, which in ISO 9001 includes corrective action, removes the causes of problems and draws on both QA and QC data.
ISO published ISO 9001:2026 on 16 September 2026. ISO describes the edition as targeted updates that build on the familiar framework. It puts more emphasis on leadership, a culture of quality and ethical behaviour, and adopts the latest Harmonized Structure (ISO). Organisations certified to ISO 9001:2015 have until 30 September 2029 to transition (LRQA, 16 September 2026). Our ISO 9001:2026 transition guide covers the audit arrangements. Check the clause numbering in the 2026 text before relying on the 2015 numbers used here.
QA and QC examples in three UK settings
| Setting | Quality assurance example | Quality control example |
|---|---|---|
| Machine shop | Approved work instructions, operator training records, calibration schedule, supplier approval for raw material | Incoming material checks, first-off inspection, in-process dimensional checks, final inspection before dispatch |
| Construction contractor | Inspection and test plans agreed before work starts, subcontractor vetting, briefing of site teams | Hold-point sign-offs, snagging inspections, concrete cube tests |
| Consultancy or service firm | Defined delivery method, templates, peer-review rules, competence matrix | Review of each report or deliverable against the client brief before issue |
ASQ notes that services often include products such as reports, contracts or designs, whose quality may still need to be controlled. Our guides to ISO 9001 for manufacturing, ISO 9001 for service businesses and ISO 9001 and ISO 45001 in construction go deeper on each setting.
How an auditor tells a working QMS from a documentation-only one
A certification audit tests whether the management system is implemented and effective, not whether documents exist. Under ISO/IEC 17021-1:2015 (clause 9.3.1.3), the purpose of the stage 2 audit is to evaluate the implementation of the client's management system, including its effectiveness. Auditors gather that evidence by reviewing records, interviewing people and observing work, and they sample rather than read everything.
| What the auditor checks | Working system | Documentation-only system | ISO 9001:2015 clause |
|---|---|---|---|
| A job traced from order to delivery | Contract review, planning, inspection and release records link to the same order and dates | Records exist for each stage but cannot be linked to one job | 8.2.3, 8.5.2, 8.6 |
| What people say they do | Staff describe the method in the current instruction and know where to find it | Staff describe a different method, or the instruction is out of date | 7.5.3, 8.5.1 |
| Inspection results | Results are recorded against stated acceptance criteria | Results are ticks with no criteria or values | 8.5.1, 8.6 |
| Objectives and performance data | Trends are analysed and decisions follow | Objectives are listed but no data has been collected | 6.2, 9.1.3 |
| Nonconformities | Each has a cause, an action and an effectiveness check | The same defect recurs, each time closed as "reworked" with no cause | 8.7, 10.2.1 |
| Internal audits | Reports say what was sampled and what was found | Reports state "no findings" without describing what was checked | 9.2.1, 9.2.2 |
| Management review | Minutes record decisions, actions and resources | Minutes repeat the same text each year | 9.3.3 |
Our guide to common ISO 9001 nonconformities explains how findings are graded and closed.
Practical audit case: repeated dimensional nonconformities in manufacturing
Illustrative audit scenario. This scenario shows how an auditor connects QC records to QA requirements. It is not a UniCert client audit, and it does not describe a real finding or corrective actions that have taken place.
| Scenario detail | Description |
|---|---|
| Sector | Precision machining |
| Size | Approximately 25 employees |
| Standard | ISO 9001:2015 |
| Processes sampled | Production control, quality control, equipment maintenance and corrective action |
What the records show. Nonconformity records sampled during the audit show the same dimensional nonconformity on one part, the position of a drilled hole, in several different production batches. Quality control detects the nonconforming parts each time and sends them for rework. Because nobody evaluates the repeat pattern systematically, the cause is never found and the error keeps recurring.
Root cause. A cause analysis finds that wear on the production fixture is not adequately controlled. The fixture is not included in the equipment maintenance plan, so its condition is not checked between batches.
Corrective actions in the scenario:
- Add the production fixture to the maintenance plan.
- Strengthen the first-off check at the start of each batch.
- Brief operators on the current work instructions, including the strengthened first-off check.
- Analyse nonconformity records at defined intervals to detect repeat issues.
- Evaluate the effectiveness of these actions using subsequent production records.
| Clause | Relevance in this scenario |
|---|---|
| 8.5.1 Control of production and service provision | Controlled conditions include monitoring and measurement at appropriate stages and the use of suitable infrastructure. Detecting the defect at inspection shows monitoring in place; the strengthened first-off check moves detection to the start of each batch. |
| 7.1.3 Infrastructure | The fixture is production equipment that the organisation must maintain. Leaving it out of the maintenance plan allows the wear that causes the defect. |
| 8.7 Control of nonconforming outputs | Rework is an accepted way of dealing with nonconforming parts, provided conformity is verified after correction and the nonconformity, the action taken and the authority deciding it are recorded. Rework controls the output; it does not address the cause. |
| 9.1.3 Analysis and evaluation | Analysing nonconformity data across batches is how the repeat pattern becomes visible. Without that analysis, each rework looks like an isolated event. |
| 10.2 Nonconformity and corrective action | The organisation must evaluate the need for action to eliminate the cause, so the nonconformity does not recur. Corrective actions must be appropriate to the effects of the nonconformity. Their effectiveness must be reviewed and records retained. |
| 7.2 and 7.5.3 Competence and control of documented information | Briefing operators on the current work instruction, including the strengthened first-off check, helps them apply it competently and ensures the current version is used at the point of use. |
This scenario does not classify the finding as major or minor. That judgement depends on the full audit evidence, including the scale of the problem and its effect on conforming product.
QA vs QC self-assessment: ten questions
Answer each question with evidence you could show an auditor, not with a description of intent.
| # | Question | ISO 9001:2015 clause | Examples of objective evidence |
|---|---|---|---|
| 1 | Are your main processes defined, with inputs, outputs, criteria, owners and measures? | 4.4.1 | Process map or turtle diagrams, named process owners, performance indicators |
| 2 | Do you know which product or service characteristics matter most to the customer, and where each one is checked? | 8.2.2, 8.2.3, 8.5.1 | Customer requirements in the contract review, inspection or test plan |
| 3 | Is monitoring and measurement carried out at appropriate stages, as planned, against stated acceptance criteria? | 8.5.1 | Inspection records showing measured values and acceptance limits |
| 4 | Is measuring equipment fit for purpose and calibrated or verified where traceability is needed? | 7.1.5 | Equipment register, calibration certificates, status labels |
| 5 | Is release authorised and traceable to the person who authorised it? | 8.6 | Signed release notes or system approvals linked to the batch or job |
| 6 | Are nonconforming outputs identified and controlled (for example segregated or quarantined), with the action decided by an authorised person? | 8.7 | Quarantine area or labels, nonconformity records with the action taken and who decided |
| 7 | When a nonconformity occurs, do you evaluate the need for action to eliminate its cause, take corrective action appropriate to its effects, and review whether that action worked? | 10.2.1, 10.2.2 | Corrective action records showing the cause, the action, the reasoning for its extent and the effectiveness review |
| 8 | Can you show that people doing QA and QC tasks are competent for them? | 7.2 | Training records, competence assessments, authorisation lists for inspectors |
| 9 | Are external providers evaluated against criteria and controlled according to their impact? | 8.4.1, 8.4.2 | Approved supplier list, evaluation criteria, incoming inspection or supplier performance data |
| 10 | Do internal audits and management review use QC data and lead to decisions? | 9.1.3, 9.2, 9.3 | Audit programme and reports, data analysis, review minutes with actions and owners |
A "no" or "partly" answer shows where to focus first. An online ISO gap analysis gives a structured view of which ISO 9001 requirements are covered. It is a self-assessment tool, not consultancy.
Does ISO 9001 require a separate QA or QC department?
No. ISO 9001 sets requirements for activities and evidence; how you organise them is your choice. In a small business one person may plan the process and inspect the output. Clause 9.2.2 requires auditors to be selected so that audits are objective and impartial. In practice, this usually means auditors do not audit their own work, so a micro-business may use a colleague or a contracted internal auditor for the areas the owner runs.
Quality assurance and quality control work together
QA asks whether the way you work will deliver a conforming result. QC asks whether this result conforms. Inspection records alone cannot meet ISO 9001, which also requires defined processes, internal audit, management review and corrective action. The strongest systems use QC data to drive QA improvements: if the same entries keep appearing in your nonconformity log, change the process that produces them. See how to get ISO 9001 certified in the UK for the full route.
If you are planning certification, talk to our team about the audit route, or read about our accreditation.
About this guide
- Written by: Ersin Çetin, UniCert Certification.
- Technical and editorial review: Eren İşman, UniCert Certification.
- Editorial process: This article was prepared with AI assistance and reviewed by Eren İşman for technical accuracy, clarity and practical relevance. The article draws on the ISO standards and publicly available references listed below.
- ISO 9001 clause numbers refer to ISO 9001:2015 unless stated otherwise. The practical audit case is an illustrative scenario, not a client audit.
Sources
- International Organization for Standardization (ISO). ISO 9000:2015, Quality management systems: Fundamentals and vocabulary. Clauses 3.3.6 and 3.3.7. Withdrawn on 27 May 2026 and replaced by ISO 9000:2026.
- American Society for Quality (ASQ). Quality Assurance vs Quality Control: QA vs QC. Reviewed December 2024. Quotes the ISO 9000:2015 definitions.
- International Organization for Standardization (ISO). ISO launches update to world's most widely used quality management standard. 16 September 2026.
- LRQA. News release on the publication of ISO 9001:2026 and the transition period. 16 September 2026.
- ISO 9001:2015, Quality management systems: Requirements. Clauses 4.4, 6.2, 7.1.3, 7.1.5, 7.2, 7.5.3, 8.2, 8.4, 8.5.1, 8.5.2, 8.6, 8.7, 9.1.1, 9.1.3, 9.2, 9.3 and 10.2 (paraphrased, not quoted).
- ISO/IEC 17021-1:2015, Conformity assessment: Requirements for bodies providing audit and certification of management systems. Clause 9.3.1.3, purpose of the stage 2 audit (paraphrased).
Related certifications:
Take the Next Step with UniCert
From ISO 9001 quality management to cyber security and supply chain assurance – UniCert provides the management system certification you need to unlock global markets.