External QM representative for medium-sized companies: order, costs, audit path

ISO 9001:2015 has formally removed the mandatory appointment of a quality management representative in Section 5.3, but the standard requires clearly assigned responsibilities for the quality management system with documented evidence. In audit practice, certifiers, industrial customers and supplier questionnaires continue to expect a named person with an appointment certificate, job description and a direct reporting line to management. For medium-sized companies with between 50 and 500 employees, this expectation is often difficult to achieve with their own resources because there is a lack of qualifications, there is not enough capacity in addition to day-to-day operations, or qualified applicants are rare on the job market. The audit pressure increases additionally due to customer requirements from automotive supply, mechanical engineering and medical technology.

An external QM representative closes this gap without having to set up an internal full-time mandate. You receive a person appointed by name, a documented reporting line, a reproducible audit trail including templates and a workspace in which all evidence is stored in version form. This article explains when the model is valid, what obligations lie with the external QMB, what cost frameworks are common, what pitfalls are known in audit practice, how the external QMB fits into an integrated management system and how CIVAC, as a compliance platform and officer-as-a-service, secures the order operationally. The appointment certificate, signed, filed, verifiable. You read six practical sections, a cost chapter, two audit sections and an FAQ block with concrete answers.

The revision of ISO 9001 in 2015 formally removed the requirement to appoint a top management representative. Section 5.3 today talks about roles, responsibilities and authorities that need to be assigned, communicated and understood within the company by top management. The quality management system can theoretically be operated without a designated QMB, provided that the required tasks are verifiably assigned to people or functions. This formal opening is rarely exploited in practice.

In audit practice the situation is different. Certifiers such as TÜV, DEKRA or DQS check the allocation of responsibilities in the Stage 1 audit and expect a clear contact person for the QM system. Supplier questionnaires from large industrial customers continue to contain the QMB Name field. If you cannot name a person here, you risk inquiries, audit extensions and devaluations in supplier management, which can translate into B supplier status or loss of contract. The external quality management representative serves exactly these operational expectations and provides the audit-proof evidence required in 5.3, 7.1.6, 9.2 and 9.3. Tasks include control of documented information, internal audits, management reviews and the interface to the external certifier. You remain responsible as top management, the QMB takes over operational control and documentation. This separation must be clearly defined in the appointment certificate and job description. In addition, DIN ISO 19011:2018 serves as a guideline for auditing management systems, which is used for audit program planning. The external QMB is based on this guide and on industry-specific supplementary standards such as IATF 16949 for automotive suppliers or ISO 13485 for medical devices. These industry standards tighten the qualification and documentation requirements and must be taken into account in the mandate.

Small businesses are missing three things at the same time: staff with ISO qualifications, time for a parallel mandate and an audit routine. An internal solution often results in the QMB hat being worn in addition to production or sales management. This works as long as there is no audit pending. If the external certifier proposes dates, operational obligations conflict with the preparation of management review, audit program and measures from the last monitoring. The audit preparation is done or postponed in the evening hours, the quality drops.

The second reason is qualifications. ISO 9001 requires documented competence in 7.2 for each role that influences QM performance. An internal employee without formal auditor training can only meet this requirement through complex training paths; 80 to 120 hours of training plus an annual refresher are typical. External QM representatives already have the qualifications, documented by certificates, audit experience and references from comparable mandates. The third reason is the separation of operational responsibility and QM control. Anyone who manages production and at the same time audits the effectiveness of their own processes creates role conflicts that show up in the audit. An external QMB provides the required independence according to 9.2.2 c. CIVAC structures this separation via an appointment certificate with a clear reporting line to management and a workspace in which audits, measures and evidence are managed separately from operational systems. Others run compliance like a filing cabinet. We run it like software. There is also a fourth reason that is less often openly expressed: staff turnover. Internal QMB positions are often unfilled in medium-sized companies because qualified applicants are rare and the market is highly competitive. An external mandate is contractually secured and does not depend on the termination of an individual employee.

The list of tasks for the external quality management representative is based on ISO 9001 Chapters 4 to 10 and the appointment certificate. In practice, the duties are bundled into seven blocks: maintenance of the QM documentation including manual and procedural instructions, planning and implementation of the internal audit program according to 9.2, preparation and moderation of the management assessment according to 9.3, control of corrective and preventive measures according to 10.1 and 10.2, interface function to the external certifier, evaluation of customer feedback and complaints as well as regular reporting to top management with key figures and Trends.

Each of these blocks creates artifacts: audit program, audit reports, action list, management review protocol, supplier evaluation, complaint register, training matrix. There are templates stored in the CIVAC workspace that contain the date, the person responsible and the reference to the ISO requirement. If the external certifier asks about the status of the measures in the surveillance audit, the evidence is available without having to search. The auditor calls, the evidence is ready. It is important to have a clear demarcation from management: The external QMB plans, documents and reports; the decision about measures and resources remains with the top management. This delimitation is stated in the appointment certificate and is checked in the audit. The same applies to the reporting frequency; quarterly reports plus annual management reviews with a documented agenda and resolutions are common. A well-run quarterly report contains five mandatory elements: audit program status, open and closed actions with deadlines, process performance KPIs, supplier performance, and a 90-day outlook. The external QMB delivers this report in the workspace, and the management confirms it with an electronic signature. This routine is strong evidence of the effectiveness of the QM system in the audit and significantly reduces inquiries.

The question of costs often determines the ordering model in medium-sized businesses. A full-time internal QMB position costs between 95,000 and 120,000 euros annually with a gross annual salary of 65,000 to 85,000 euros plus additional wage costs, training and auditor training. A part-time solution with 0.3 FTE is 30,000 to 40,000 euros, but leaves audit peaks unprocessed because the hours are distributed on a weekly basis instead of in the audit cycle. External mandates are mainly offered in three models: a flat-rate contract with a fixed monthly rate, an hourly quota or a combined retainer model with a basic flat rate and an audit add-on.

The standard market price for the flat-rate model is 1,200 to 2,500 euros per month for medium-sized companies with one location, a management system and a predictable audit cycle. Hourly quotas range between 140 and 220 euros net, depending on qualifications and industry. The range is wide because providers charge differently: some include internal audits, others provide them separately, and others charge travel times and audit preparation extra. CIVAC works in the officer-as-a-service model with a flat-rate contract that includes the appointment certificate, reporting line, workspace access, 490 audit templates and the annual internal audit. Licence the workspace for your internal representatives, or have our representatives order it. The SLA for the order is 2 business days instead of the industry standard 2 to 6 weeks. This means that the mandate can be planned before the next audit cycle begins. For multi-location mandates, CIVAC staggers the number of locations included and the degree of integration with ISMS or UMS; the usual surcharge is 30 percent for the second location and 20 percent for each additional location. This staggering is clearly stated in the contract so that the cost development over the three years of the certification cycle can be planned.

The appointment certificate is the core document of every QMB order. It contains the name and function of the appointed person, date of appointment, scope (location, management system, business areas), catalogue of duties with reference to ISO 9001:2015 Sections 5.3, 7.1.6, 9.2, 9.3, 10.1, 10.2, authorities, reporting line and signature of top management. Without this certificate, the audit will lack proof that responsibility has been assigned and communicated. Auditors regularly assess missing appointment certificates in Stage-2 as a major deviation.

The reporting line leads directly to top management, not through department heads or area managers. This direct connection protects against conflicts of interest when the QMB reports deviations that affect production. The job description breaks down the tasks further, supplemented by reporting formats, frequencies and escalation paths. CIVAC provides these three documents as templates in the workspace; they are structured according to ISO 9001:2015 and additionally according to ISO/IEC 27001:2022 if an integrated management system exists. If the order is placed externally, the certificate will be created within 2 working days, countersigned by the management and stored in the workspace. Audit proof, documented, ISO 9001 proof. If the company has several locations, the document regulates the scope; a group QMB appointment with site managers who report to the central QMB is common. This structure can be mapped in the workspace with a role and rights concept, which also enables the external representative to be changed without loss of data. In addition to the appointment certificate, a handover agreement documents what must be in the workspace on the day the mandate is taken over: current version of the QM manual, open audit program, list of measures, last management review, supplier list with risk classification and complaint register from the last twelve months. This handover is confirmed in writing and archived in the workspace so that later audits can trace the seamless transition. The handover agreement also contains a confidentiality clause, a clause on the return of data at the end of the mandate and a regulation on the retention period of the audit evidence of at least ten years in accordance with the retention obligation under commercial law.

Stage 1 audits check the document situation and the readiness of the QM system for the actual certification audit. The external auditor usually expects twelve groups of documents: QM manual or process map, context analysis according to 4.1, interested parties according to 4.2, scope according to 4.3, risks and opportunities according to 6.1, quality policy and quality objectives according to 5.2 and 6.2, roles and responsibilities according to 5.3, documented information according to 7.5, audit program according to 9.2, management review according to 9.3 as well as evidence of corrective measures and Evidence of training.

An internal QMB usually only collects these documents shortly before the audit, which leads to inconsistencies: version statuses do not match, data contradict each other, those responsible are not named. The external quality management representative works continuously according to the Stage 1 catalogue because he is familiar with the scheme. In the CIVAC workspace, the twelve document groups are pre-structured as sections; each template has a version ID, revision date and person responsible. Audit questions can be linked to evidence with just two clicks. In the Stage 2 audit, the auditor randomly checks the effectiveness of the documented processes on site. Here the external QMB provides the bridge between documentation and practice. Preparation for Stage 2 includes employee interviews, walk-throughs through production and ensuring that operational employees know and apply the procedural instructions relevant to their work. CIVAC provides walk-through checklists and interview guides as part of the 490 audit templates. In addition, a test audit session is common in which the external QMB examines the critical areas two weeks before the official Stage 2 and highlights weak points. This sample has proven successful in practice because it familiarizes employees with the audit situation and final document gaps become visible before the certifier arrives. The results of the test are documented in the workspace and discussed with management in a 30-minute pre-audit briefing.

Many medium-sized companies today operate integrated management systems, i.e. QMS according to ISO 9001 plus ISMS according to ISO/IEC 27001:2022 plus EMS according to ISO 14001. The high-level structure of all ISO management system standards allows the duties of QMB, ISB and environmental officer to be managed in a common document system. This saves effort, but increases the requirement for role clarity because each standard has its own obligations and sanction consequences.

The external QMB remains responsible for the QMS, but can document interfaces to the information security officer and the environmental officer in the integrated system. In practical terms, this means: joint audit program, joint management assessment with separate agenda items, joint risk register with standard-specific marking. The respective appointment certificates remain separate, the workspace bundles them. CIVAC supports this multiple mandate through a role concept in which an officer can hold multiple mandates, provided qualifications and capacity are present. The constellation with different external representatives who work in the same workspace is more common. The 93 controls according to ISO/IEC 27001:2022 can be mapped with the QM processes, such as document control, competence management, supplier control. The mapping table is stored in the CIVAC workspace and is accepted as integrated evidence in the audit. Anyone who sets up the integrated system cleanly reduces the audit time by 20 to 30 percent and avoids redundant documentation. The representatives are appointed simultaneously, with one appointment document per mandate and a common reporting line to the management. An integrated audit program determines which processes are audited once a year from a QM perspective, once from an ISMS perspective and once from an environmental perspective, without tripling the operational load on the departments. This bundling is standard in the CIVAC workspace and reduces the number of audit interviews by up to 40 percent compared to three separate audit programs.

Six errors regularly appear in external QMB mandates. First, the appointment certificate is agreed verbally and never signed. There is no evidence in the audit and the auditor classifies the assignment of responsibility as not being implemented. Second, the reporting line leads to quality management instead of management. This means that independence according to 9.2.2 c is not guaranteed, Stage-2 creates a major deviation, the issuance of certificates is delayed or subject to conditions.

Thirdly, the external QMB takes over operational tasks from production and at the same time checks them in the audit. This mixing of roles disqualifies him as an internal auditor, and the external auditor complains of bias. Fourth, the documentation resides in a personal email inbox or on an individual laptop, not in the corporate system. When the external representative changes, knowledge is lost and, in the worst case, audit evidence can no longer be found. Fifth, the contract period is shorter than the audit cycle. A three-year certification cycle requires at least a correspondingly long contract or clear handover rules between external representatives. Sixth, the external QMB is a consultant without a formal appointment. Advice alone does not meet the ISO requirement; the named appointment with duties and authorities is constitutive. CIVAC avoids these traps through standardised appointment certificates, a reporting line to management, a clear separation of advice and mandates, a workspace with EU data residency instead of personal email storage and contracts that cover the full certification cycle. At the start of every mandate, an opening checklist is run through that checks and documents all six pitfalls. A seventh, often overlooked pitfall is the inadequate insurance coverage of the external QMB. Professional liability insurance with coverage amounts of less than 1 million euros is rarely sufficient for consequential audit damage in medium-sized companies. CIVAC provides proof of the coverage amount at the start of the mandate and updates the confirmation annually.

If you are looking for an external quality management representative in a medium-sized company, the right hourly model is less important than the question of whether the operational infrastructure supports it. An external QMB without workspace, without audit templates, without EU data residency creates the same gaps in the audit as an internal QMB without routine. CIVAC is a compliance platform and officer-as-a-service that combines both: the appointment of an external QMB by name within 2 working days and a workspace in which the appointment certificate, reporting line, 490 audit templates and the reporting history are stored in an audit-proof manner.

Licence the workspace for your internal representatives, or have our representatives appointed. Both paths lead to the same audit result, the difference lies in the capacity and qualifications of your own team. We recommend a 30-minute appointment meeting in which we determine the scope, audit cycle, level of integration with ISMS or UMS and reporting frequency. CIVAC then creates an appointment certificate, job description and reporting line, the management countersigns, and the mandate begins. Turn reading into an assignment. Contact: info@civac.de or the contact form on civac.de. The first audit templates are available in the workspace on the day the order is placed, the internal audit program is set up in the first month, and the management review is scheduled with the management. The appointment certificate, signed, filed, verifiable. Within the first 90 days you will receive a complete status report on the maturity of your QM system, a prioritised list of measures and an audit plan that fits the next external certification date. These three artifacts are the basis on which the mandate then runs smoothly throughout the full certification cycle. We recommend scheduling the order discussion at least three months before the next surveillance or certification audit so that the first audit preparations can be carried out without time pressure.