Quality management representative: tasks, order and ISO 9001:2015

With ISO 9001:2015, the formal obligation to appoint a top management representative has been removed. Instead, Chapter 5.3 of the standard requires top management to assign responsibilities and authority for relevant roles. In practice, this does not mean the end of the quality management representative (QMB), but rather a shift: the role remains indispensable, its appointment is now made through internal instructions instead of through external norms. Anyone who misunderstands this and forgoes a QMB role risks audit findings, customer complaints and sanctions in the regulated area.

This article explains what tasks a quality management representative has, how the order is made correctly according to ISO 9001:2015, which liability and insurance protection apply and how the role applies in regulated industries such as medical devices (ISO 13485), automotive (IATF 16949) and aviation (EN 9100) is additionally regulated. We also show how CIVAC, as a compliance platform and officer-as-a-service, bundles QMB work in a central workspace: appointment certificate, audit templates, control of documented information, action tracking and external ordering in 2 working days instead of 2 to 6 weeks. Anyone who has not only certified ISO 9001, but also operates ISO 13485, IATF 16949 or EN 9100 in parallel, also benefits from integrated mapping because identical requirements do not have to be recorded twice and audit preparation is significantly accelerated.

The quality management representative is the operational interface between top management and the company's quality management system (QMS). He ensures that the QM processes are implemented, adhered to and continually improved. Until the revision of ISO 9001:2008, the order was expressly prescribed in Chapter 5.5.2. With ISO 9001:2015, this formal obligation was deleted because the standard explicitly assigns responsibility to top management and wanted to avoid that the latter relieves itself through delegation.

In reality, however, the role remains indispensable. Chapter 5.3 of ISO 9001:2015 requires assigning responsibilities for ensuring compliance with standards, reporting to top management, promoting customer focus and maintaining the integrity of the management system during changes. In practice, these tasks are still carried out by a QMB, often with an alternative name such as quality manager, QM manager or process owner quality. The appointment is made through instructions from top management with clearly defined tasks, authorities and resources.

In regulated industries, the role is again explicitly required via industry standards. ISO 13485:2016 for medical devices requires a top management representative in Chapter 5.5.2, IATF 16949 for automotive requires multiple designated responsible persons, and EN 9100 for aviation regulates the roles as well. CIVAC bundles these order and audit templates for 25 representative roles in a uniform platform, so that parallel duties are also covered without contradictions. You can find out more about the specific role on the Quality Management Representative page, with order logic and SLA models. An integrated platform also simplifies the interface to related officer roles such as data protection, IT security or supply chain management because processes and documentation requirements overlap significantly.

The tasks of a quality management representative are divided into six core areas: system operation, document control, audits, measures, training and reporting to top management. During system operation, the QMB ensures that all processes are described, approved and implemented. Document control includes version management of manuals, procedural instructions, work instructions, forms and records in accordance with ISO 9001:2015 Chapter 7.5 (documented information).

Audits are the backbone of QMB work. Internal audits according to Chapter 9.2 must be planned, carried out and evaluated, with documented findings, corrective measures and effectiveness testing. External audits by certification bodies such as TÜV, DEKRA, DQS or LRQA are prepared and accompanied by the QMB. There are also customer audits, supplier audits and, in the regulated area, authority inspections, for example by BfArM for medical devices or by the Federal Motor Transport Authority in the automotive sector.

Measures from audits, customer complaints and internal information are tracked via CAPA processes (corrective and preventive actions), with a clear person responsible, deadline and effectiveness test. Training keeps employees up to date and ensures that new processes are understood. Reporting to top management takes place as part of the management review in accordance with Chapter 9.3, typically annually and often quarterly. CIVAC delivers 490 ready-to-use audit templates that structure exactly these processes, with action tracking, versioning and automatic reminders for due dates. This turns the QMB work into a reproducible process instead of an ad hoc improvisation shortly before the audit date. The structured recording also enables valid trend analysis over multiple audit cycles so that top management can see whether corrective measures are actually effective or whether there are systemic weaknesses that need to be strategically addressed. Integrated tracking of measures with clear escalation levels also prevents CAPA measures from being formally closed without a real effectiveness test having taken place, which regularly leads to major findings in external audits.

Even if ISO 9001:2015 has removed the explicit order requirement, a written order from the quality management representative remains best practice. It creates clarity about tasks, authorities and resources and is a prerequisite for any robust audit defence. An effective appointment certificate includes at least nine elements: name and function, task description, authorities (in particular access to all QM-relevant areas), reporting line, resources and budget, representation, confidentiality, protection against dismissal and entry into force.

The reporting line leads directly to top management, in larger structures in addition to the supervisory board or steering committee. It must not be interrupted by an intermediate operational level, otherwise the independence of the assessment is at risk. In regulated industries, the reporting line is often extended to designated persons, such as the Person Responsible for Regulatory Compliance (PRRC) according to Art. 15 MDR/IVDR or the safety officer according to automotive standards.

In practice, the appointment often fails due to trivialities: outdated appointment certificates from the ISO 9001:2008 era, missing signatures, unclear representation regulations or undocumented resources. CIVAC provides a tested template which, after entering the key data, creates an appointment certificate ready for signature within one working day. The appointment certificate, signed, filed, verifiable. Licence the workspace for your internal representatives, or have our representatives order it. The workspace links the order with the task catalogue, audit calendar and reporting templates so that every certification body can see the complete evidence in just a few clicks and no weeks are lost in preparation. A clear order also makes it easier to argue with insurance companies because D-and-O and professional liability policies require a documented scope of tasks in order to be effective in the event of damage, and protection is often denied without a document. The appointment certificate should also address the representation regulations, because audit appointments and inquiries from authorities cannot be suspended even during vacation times or in the event of illness, and without representation the risk of delays or findings increases significantly.

There is no state-protected job title of quality management representative in Germany. Engineering, scientific or business training is common, supplemented by recognised certificates. The training courses according to DGQ, TÜV or DQS are established and are completed as QMB training, Lead Auditor ISO 9001 or Six Sigma Green Belt. In the regulated area, industry-specific qualifications are also available, such as MDSAP auditor training for medical devices or VDA 6.3 auditor for automotive.

Basic knowledge must be present in: ISO 9001:2015 including the relevant appendices, audit methodology according to ISO 19011, statistics and process capability, FMEA, root cause analysis (8D, Ishikawa, 5-Why), CAPA processes and risk management according to ISO 31000. In practice, the combination of methodological knowledge and industry knowledge is crucial because the application of the standard in the food industry is different than in chemistry or mechanical engineering.

The training obligation applies to the QMB itself and all employees related to QM. Annual refreshers are standard, supplemented by event-related training for standard updates, process changes or audit findings. CIVAC structures the further training using a training matrix that differentiates between compulsory, role and occasion topics, with content, date, group of participants and effectiveness test. The auditor calls, the evidence is ready. CIVAC's external QMBs complete an internal qualification program that consistently prepares ISO 9001:2015 and the most important industry standards and is recertified annually so that management can demonstrate a consistent qualification base. Learning progress and quiz results are also recorded via the platform, which makes it easier to check effectiveness and serves as reliable evidence of the training measures in the audit, instead of just presenting a list of participants. The annual refresher is automatically added to the training calendar and communicated to superiors, so that the training budget is targeted and no mandatory training is overlooked, which increases audit security.

Internal audits according to ISO 9001:2015 Chapter 9.2 are the early warning system of the QMS. They must be planned, carried out and documented, with clearly defined auditor qualifications, audit plan, audit questions, findings, corrective actions and effectiveness testing. Frequency and depth depend on the risk and importance of the processes, usually at least annually for each process, more often for particularly critical processes.

External audits by certification bodies follow a three-year cycle: certification audit, two surveillance audits, recertification audit. In addition, special audits are carried out in the event of significant changes or if there are justified indications of deviations. Customer audits are standard practice in the industry, especially in the automotive (VDA 6.3), food (BRCGS, IFS) and pharmaceutical sectors. The preparation includes updating the documents, training employees, mock audits in particularly audit-intensive areas and providing evidence.

Findings are divided into major and minor non-conformities. Major Findings prevent certification or its maintenance, Minor Findings allow timely remediation. CAPA measures are tracked in the workspace: root cause analysis, corrective action, preventive action, effectiveness check. Licence the workspace for your internal representatives, or have our representatives order it. Others run compliance like a filing cabinet. We run it like software. CIVAC links audit findings with the original process descriptions so that every correction is reflected directly in the QMS document and version changes remain traceable. Further details can be found at CIVAC Roles, with an overview of related representative functions. CIVAC also provides a pre-audit checklist that addresses the most common stumbling blocks in the certification audit, so that top management and the QM team go through standardised preparation before each appointment. The checklist includes document status, proof of training, open CAPA measures, customer complaints and the last management review, so that gaps can be closed in a targeted manner before the audit date.

ISO 9001:2015 Chapter 7.5 replaces the classic term documents and records with documented information. It includes both the descriptions required for the operation of the QMS (manual, procedures, instructions) and the evidence (records, test reports, training certificates, audit reports). Control requires creation, updating, release, version management, distribution, access, protection and retention as well as controlled deprecation.

In practice, document control is the most common stumbling block in external audits. Several versions of a document exist in parallel, employees work with outdated printed copies, records are missing or incomplete. Anyone who uses Word documents and SharePoint folders without strict versioning will fail the first independent check at the latest. GDPR compliance and IT security according to ISO/IEC 27001:2022 also require controlled access and retention logic.

CIVAC provides a documented information engine: Each version is recorded with creation, release, entry into force, distribution recipients, access rights and retention period. Outdated versions are blocked but not deleted, so the history remains available at all times for audits, complaints and government inquiries. ISO/IEC 27001:2022 with its 93 controls and EU data residency ensure integrity and confidentiality. Audit proof, documented, ISO proof. This turns a typical audit vulnerability into a controlled strength that not only meets ISO 9001, but also covers ISO 13485, IATF 16949 or EN 9100 in parallel, because the control logic works identically and only the technical content is industry-specific. When switching from paper or SharePoint solutions to the platform, CIVAC provides support with migration templates and training so that the transition is completed within a few weeks without any audit risk. A gradual migration is also possible, starting with the audit area and gradually taking over document control, training matrix and supplier management, depending on the audit frequency and the need for internal change.

The decision between internal and external staffing follows three criteria: size and complexity of the company, regulatory density and availability of qualified personnel. Up to around 200 employees, an internal full-time QMB position is rarely economical because the effort is 0.3 to 0.8 full-time equivalents. In regulated industries (medicine, automotive, aviation) the requirement is higher because there are additional industry standards, audit frequencies and communication with authorities.

External appointment does not mean loss of control, but rather transfer of the operational function to a qualified person who acts independently and fulfils a clearly defined scope of tasks. The external QMB takes part in internal audits, prepares external audits, carries out the management review, tracks CAPA measures and is available for customer and government inquiries. Legal responsibility remains with top management, but execution is reliably documented.

CIVAC offers both paths as a compliance platform and officer-as-a-service. In the licence model, the internal person receives workspace, 490 audit templates, training matrix and ISO 27001:2022-compliant storage with EU data residency. In the service model, CIVAC provides the appointed person, integrated into the same platform, with an order in 2 working days instead of 2 to 6 weeks, monthly control group, audit support and CAPA tracking. The advantage lies in the hybrid option: start externally, build internally, gradually take over without having to migrate data because everything remains in the same workspace and acceptance in the company is promoted through continuous participation by the external role. The SLA models range from monthly presence to permanent standby availability, depending on industry, audit frequency and regulatory depth. The service model also includes on-site audit support, short telephone consultations and written statements to authorities or customers, without each individual call being billed separately.

ISO 9001:2015 is the basic standard; in regulated industries it is supplemented or replaced by sector-specific standards. ISO 13485:2016 regulates the QMS for medical devices and is a prerequisite for CE marking according to MDR (Regulation (EU) 2017/745) and IVDR (Regulation (EU) 2017/746). It requires a representative of top management with clearly defined tasks, supplemented by the Person Responsible for Regulatory Compliance (PRRC) according to Art. 15 MDR with their own qualification requirements.

IATF 16949 is the global automotive standard, supplemented by VDA-specific requirements such as VDA 6.3 (process audit) and VDA 2 (production release). In addition to the QMB, the standard requires designated persons responsible for process safety, customer satisfaction and supplier approval. EN 9100 for aviation, space and defence is based on ISO 9001, supplemented by requirements from risk assessment, configuration management and counterfeit parts prevention.

In practice, companies with multiple certifications often operate an integrated QMS in which the requirements of all relevant standards are covered. CIVAC supports this via a mapping module that maps ISO 9001:2015, ISO 13485:2016, IATF 16949 and EN 9100 to common process building blocks. The clock starts on awareness. 87 MDR within 15 days, the deadline is automatically transferred to the workspace and the QMB is reminded. This creates a compliance backbone that not only covers ISO 9001, but also serves industry-specific obligations in parallel, without each standard requiring its own tooling and without duplication of work. The platform also maintains the updates of the respective standard revisions, so that when new versions of a standard are published, companies are prepared for the requirements in good time and transition periods are strictly adhered to.

The quality management representative is the operational hub for the company's standard compliance. Even though ISO 9001:2015 has removed the explicit ordering requirement, the function remains in fact indispensable, and in regulated industries it is even explicitly required via sector-specific standards. Anyone who does not fill the role or only fills it formally risks audit findings, loss of certification, customer complaints and, in the medical or automotive sectors, official measures with significant economic consequences.

The decisive factor is not the choice between internal and external, but the verifiability of the QMB work. The appointment certificate, signed, filed, verifiable. Audit plan, audit findings, CAPA measures, effectiveness test. Document control with versioning, release and controlled access. Management review with reporting line to top management. Anyone who tries to do this without a platform will fail at the latest with the first external audit or a customer complaint because the documents are in different systems and versions contradict each other.

CIVAC is the compliance platform and officer-as-a-service that closes exactly this gap. 25 representative roles are live, 490 audit templates are immediately ready for use, 93 controls according to ISO/IEC 27001:2022 as a security foundation, EU data residency for compliance security. Licence the workspace for your internal representatives, or have our representatives order it. Both paths lead to the same environment with the same templates, the same EU data residency and identical audit trails. Turn reading into a mandate.: Write to info@civac.de or use the contact form on civac.de. We will respond within one business day with a concrete proposal that defines the QMB scope of work, order date and audit roadmap, so that the next certification or surveillance audit is stress-free. An initial telephone appointment lasts 30 minutes and clarifies order requirements, industry specifics and the appropriate model between licence, service and hybrid, without being tied to a contract.