The process approach in ISO 9001: how to map your company's processes

October 16, 2026 6 min readBy the ICS technical team

A company does not deliver its products or services department by department. It delivers them through a chain of activities that runs across sales, operations, purchasing and administration. The process approach means managing that chain as a system, and it is the foundation ISO 9001 is written on. The 2026 edition of the standard, published in September, keeps it as one of its core principles.

What the process approach is

ISO 9000, the standard that sets out the concepts and vocabulary of quality management, defines a process as a set of related activities that use inputs to deliver an intended result. The process approach is one of its seven quality management principles, together with customer focus, leadership, engagement of people, improvement, evidence-based decision making and relationship management.

The core idea is simple: results are more consistent and predictable when activities are understood and managed as interrelated processes that work as a system. In practice, who does each task matters less, and what goes in, what comes out, who receives it and how you know it went well matter more.

What ISO 9001 requires: clause 4.4

The standard does not require a particular format or drawing. It asks the organization to determine the processes its management system needs and, for each one:

• Inputs and outputs. What the process needs to start and what it must deliver.
• Sequence and interaction. Which process it receives from and which one it delivers to.
• Criteria and methods. How it is controlled, including monitoring, measurement and indicators.
• Resources. The people, equipment, information and budget available.
• Responsibilities and authorities. Who answers for the process and who can make decisions.
• Risks and opportunities. What could go wrong or better, and what will be done about it.
• Evaluation and improvement. How you check that the process achieves its results and how you change it when it does not.

The organization must also maintain the documented information needed to support the operation of its processes and retain the information that shows they are carried out as planned. The key word is "needed": not every process requires a written procedure.

The parts of a process

Any process, from answering a quote request to calibrating a piece of equipment, can be described with the same elements:

1. Sources of inputsCustomers, suppliers or other processes
2. InputsRequests, materials, information
3. ActivitiesWhat is done to transform the inputs
4. OutputsProducts, services, information
5. ReceiversCustomers or other processes

Controls and indicators: the check points that show, at any stage, whether the process meets its objective.

Sources and receivers can be internal, such as another process, or external, such as a customer or a supplier. That chain of hand-offs between processes is what the standard calls interaction, and it is what a process map should make visible.

How to build the process map, step by step

1. Start with what you deliver.List the products and services you offer and to which customers. The map is built backwards from there.
2. Name processes, not departments."Purchasing" may be a department; "Supplier selection and evaluation" is a process. Use verbs and results.
3. Group them in three levels.Strategic, such as direction and management review; operational, the ones that produce what the customer pays for; and support, such as people, purchasing, infrastructure and information.
4. Draw who delivers to whom.An arrow between two processes means the output of one is the input of the other. If you cannot say what travels along that arrow, the relationship is not clear.
5. Give each process an owner.One person, not a committee, who answers for its results even when the process crosses several areas.
6. Define a few indicators.One to three per process, tied to its objective, with a target and a review frequency.
7. Include what third parties do.If a process or part of it is outsourced, such as transport or maintenance, it is still inside your system and you must control it.
8. Check it with the people who do the work.A map drawn only by management tends to describe how the company should work, not how it works.

An example process map

This is what the map of a typical service company looks like. Operational processes run from customer needs to customer satisfaction; strategic processes steer them and support processes keep them running.

Customer needs

Strategic processes

• Direction and planning
• Management review
• Internal audit and improvement

Operational processes

1. Sales
2. Service planning
3. Service delivery
4. Delivery and invoicing

Support processes

• Purchasing and suppliers
• People and competence
• Infrastructure and IT
• Documented information

Satisfied customer

The process sheet

The map shows the whole system; the process sheet describes each process on one page. This format works well. The example is the sales process:

Common mistakes

• Copying the org chart. A map with one box per department does not show how work flows and hides the problems that appear between areas.
• Too many processes. If the map has forty boxes, nobody uses it. For a small or mid-sized company, about a dozen processes is usually enough.
• Indicators nobody reviews. An indicator with no target, no owner and no meeting where it is analyzed is just a number.
• Forgetting outsourced work. What a supplier does on behalf of your company must be controlled too.
• A map that never changes. If the company launched a service or opened a site and the map is the same, it no longer describes reality.

How the auditor checks it

In the certification audit, the auditor does not just read documents: they follow the processes. They take an output, for example a delivered service, and trace it back to the customer's request, checking inputs, controls, records and indicators at each step. That is why a clear map makes the audit easier: it shows where the evidence is.

Before that stage, a pre-audit or a gap analysis is worth doing. If you are starting from scratch, the guide to implementing ISO 9001 step by step explains the order of work, and the most common audit findings show where processes usually fail.

What changes with ISO 9001:2026

The 2026 edition keeps the process approach. The most visible changes are in leadership, with more weight on quality culture and ethical behavior, and in planning, where risks and opportunities are handled separately. Organizations certified to the 2015 version have a three-year transition period; we summarize it in ISO 9001:2026: what changes. And if your company works with more than one standard, the harmonized structure lets you use the same process map for all of them.

Sources: ANSI: ISO 9000:2026 fundamentals and vocabulary; NQA: ISO 9001:2026 published; SGS: ISO 9001:2026 key updates; CQI: ISO 9001 revision guidance.