Quality and compliance work is not the production of a document set. It is the construction of an evidentiary record that answers three questions about a named process: what the organisation says it does, what it can show it did, and what it did when the two diverged. ISO 9001:2015 gives that work its shape and none of its content; the content is the organisation’s own procedures and records. This piece sets out the job, the method that produces an audit-ready set, the six ways the work commonly fails, the measured cost of a month, and the boundary no agent crosses — including the one that matters most, which is that it cannot issue the certificate.
The job
The job exists wherever an organisation has to account for how its work is controlled: a certification audit, a customer’s second-party audit, a tender questionnaire, a regulator’s inspection, or an internal programme that answers to a management review. It is the same work in all five cases, and it fails in the same way — not at the standard, but at the point where a process description and the record the process actually leaves part company.
The work runs as a cycle rather than a task. Describe the process as it is performed. Establish which records the process leaves behind. Test whether the record exists where the procedure says it should. Grade what is missing. Correct it. Then go back and check that the correction held. ISO 9001:2015 names three of those steps as activities an organisation performs on itself: internal audit (9.2), nonconformity and corrective action (10.2), and management review (9.3). The audit-ready pack is the record of that cycle, not a separate deliverable manufactured for an auditor.
The certificate is a by-product, and a late one. An organisation can do this work well and never seek certification; many do, because a customer’s questionnaire asks the same questions as a certification body and asks them in writing. An organisation that holds a certificate does the work continuously, because the certificate is maintained by surveillance audits in years one and two and by a recertification audit in year three. The paperwork that gets produced the week before an audit is not the job; it is the symptom of the job not having been done.
One instrument built for this job is the studio’s ISO Auditor, which reads a client’s management system and produces the set described below. This piece is about the work rather than the instrument: where it names the assembly, it says so, and every argument here stands whether or not an assembly is used.
What the standard asks for, and what it does not
ISO 9001:2015 states its requirements in clauses 4 to 10 — context of the organisation, leadership, planning, support, operation, performance evaluation, improvement. Clauses 1 to 3 are scope, normative references and terms; they contain no requirements. The structure is worth knowing because it is the order in which a clause-first audit will ask its questions, and that order is not the order in which an organisation does its work.
Three things the standard requires to exist as documented information are commonly misread as a list of everything that must be written down. The scope of the quality management system must be available and maintained as documented information (4.3). The quality policy must be available as documented information (5.2.2). The quality objectives must be maintained as documented information (6.2.1). Clause 4.4 then sets the general duty: maintain documented information to the extent necessary to support the operation of processes, and retain documented information to the extent necessary to have confidence that the processes are being carried out as planned. Records are required as evidence in specific places — the fitness for purpose of monitoring and measuring resources (7.1.5.1), the competence of people whose work affects the system (7.2), the implementation of the audit programme and its results (9.2.2), the results of management review (9.3.3), and the nature of nonconformities and the results of corrective action (10.2.2).
Everything else is a judgement the organisation makes. The note to 7.5.1 is explicit that the extent of documented information differs from one organisation to another with its size, the complexity of its processes and the competence of its people. The 2015 revision dropped the quality manual and the six documented procedures its predecessor required; the activities those procedures governed remain required, but the paperwork around them is now sized by the organisation.
ISO’s own guidance on documented information puts the point in a sentence worth keeping: the standard requires a documented quality management system, not a system of documents. That distinction is the whole argument of this section. A four-hundred-page manual can conform in form and describe a system nobody runs. A five-page map with the right records behind it can conform and be effective. The test is not completeness of paperwork but objective evidence that the processes and the system are effective — and effectiveness, not volume, is what an organisation asserts when it claims conformity.
What the standard does not do is equally practical. It prescribes no format, no numbering scheme, no process-map notation, no organisation chart and no quality department, and it does not tell an organisation what its processes are. Clause 4.4 requires that determination to be made by the organisation itself. That determination is the raw material of any audit.
The method: read the process before the clause
Two directions of work are available, and only one produces a usable audit. The first starts from the standard: take the clauses in order, write a question for each requirement, and walk the organisation with the list. It is the common method and it fails predictably. The organisation ends up with documents organised by clause instead of by process; the checklist asks the standard’s questions in the standard’s order rather than the client’s; and the auditor arrives at a warehouse, a laboratory or a service desk holding a question about a clause, with no model of what the place actually does. The audit then finds what the checklist asked about, which is usually what the previous audit asked about.
The second direction starts from the organisation. Read its management system before reading the standard: process descriptions, procedures, work instructions, the records each process keeps, and any previous audit report. Then map the clauses onto those processes rather than the processes onto the clauses. Clause 4.4 supplies the vocabulary for the map, because it is a description of a process before it is anything else.
The map is the plan for everything that follows. Every clause in scope appears against the process that carries it. A clause that no process carries is a gap in the design of the system, and saying so is the most valuable finding an audit produces — more valuable than any missing record, because a missing record is usually recoverable within a week and a missing process is not. Where one process carries three clauses, it is one row and three requirements. Where one clause is carried by three sites or three shifts, it is three rows, because the evidence is different in each.
Traceability then runs both ways. From a clause, an auditor can reach the process, the question, the record to look in and the evidence to record. From a record found in the field, an auditor can reach back to the requirement it satisfies. An audit pack that supports only the first direction is a reading exercise; the second is what makes the fieldwork possible by someone other than the person who wrote the map.
Two criteria, not one
Every audit point is judged against two criteria, and an audit that applies one is measuring half the system.
The first is the standard’s requirement. The second is the organisation’s own procedure — what it promised, in its own words, that this process would do. The second criterion is where most real nonconformities live, because most organisations write a procedure that is conforming and then work to a different rhythm. A procedure that says records are reviewed monthly, against a register showing two reviews in a year, is a nonconformity against the organisation’s own commitment; the standard’s requirement to retain documented information may be satisfied in form while the control the procedure described has quietly stopped happening.
Applying the standard alone has the opposite defect: the organisation’s own promises go untested, and the audit passes a procedure that is itself deficient. A procedure can be complete, signed and useless — it can describe a control that does not address the risk it names, or assign a responsibility to a role that has not existed since a reorganisation. Only the first criterion catches what the system fails to require; only the second catches what the organisation fails to do.
So a finding quotes both, and says which one failed. Three outcomes are possible and each implies a different corrective action. The practice fails the standard while conforming to the procedure, which makes the procedure the defect and the correction a document change. The practice conforms to the standard while failing the procedure, which makes the practice the defect and the correction a behavioural one. The practice fails both, which is the rarest and the most urgent.
The test of a finding is whether it can be answered. A finding that quotes the requirement, the organisation’s own clause, the record that should exist and the record that does not is answerable in two lines. A finding that says document control is weak is not answerable at all, and an auditee who cannot answer will dispute it, reasonably, until someone withdraws it.
The artefacts
Six artefacts carry the work. Each has one reader and one job; where an artefact is asked to serve two readers it serves neither, and the pack thickens without getting stronger.
Table 1. The six artefacts, the reader each is written for, and what it must contain to be usable.
| Artefact | Reader | What it must contain |
|---|---|---|
| Process-clause map | The auditor and the person signing | Every clause in scope against the process that carries it; a named owner per row; the clauses no process carries, marked as design gaps |
| Request for information | The auditee | The inputs the corpus does not contain, asked per process; nothing the reader already holds |
| Process checklist | The person doing the fieldwork | Five fields a row: clause, requirement, question to ask, record to look in, evidence to record |
| Findings log | The auditee and the certification body | One entry a finding: criterion, evidence, which criterion failed, the four-point grade, the corrective action, the verification |
| Audit report | The person who signs | Executive summary, scope and criteria, method, findings by process, readiness conclusion |
| Gap analysis | Management | Clause, requirement, evidence, status, risk — ordered by what would fail first |
The process-clause map is the plan. It is the artefact that decides what the rest of the audit has to ask, and the one whose absence makes every later artefact arbitrary.
The request for information is the earliest value in the pack, and the most often skipped. It asks, process by process, for the inputs the corpus does not contain — the current revision of a form, the last three management review minutes, the calibration certificates for a specific instrument. A forty-item questionnaire sent on day one is not a request for information; it is a substitute for reading. Asked leanly and per process, the reply tells the auditor which processes the client can evidence and which it cannot, before any fieldwork is booked.
The checklist is written for the person who will stand in the room, and the field that makes it usable is the question. Clause, requirement and evidence give the structure; the question is what a supervisor can answer without being taught the standard. The record to look in is the part that turns an interview into a test.
The findings log is the record the certification body will read hardest, because it is where the organisation’s own judgement of itself is visible. Findings are graded on four points — positive observation, nonconformity, observation, opportunity for improvement — rather than as major and minor. The major and minor grading belongs to certification bodies’ conventions under their own accreditation rules; borrowing the words without the definitions produces a dispute at the closing meeting, because the auditee will ask which rule defines a major and there is no answer inside ISO 9001. A four-point taxonomy that the office defines, applies consistently and explains in the log is defensible; a borrowed two-point one is not.
The report is written for signature. Executive summary, scope and criteria, method, findings by process, and a readiness conclusion: whether the system, as evidenced, would survive a stage 1 documentation review and a stage 2 implementation audit. It is not an opinion on the organisation, and it does not certify anything.
The gap analysis is the artefact management actually uses, because it is the only one ordered by risk. Clause, requirement, evidence, status and risk, sorted by what would fail first, gives the person holding the budget a sequence rather than a verdict.
What counts as evidence
ISO 9000:2015 defines objective evidence as data supporting the existence or verity of something, and notes that it may be obtained through observation, measurement, test or other means. That definition is broader than a record, and narrower than an assertion.
Four properties decide whether something is evidence. It exists independently of the audit — produced in the course of the work, not for the auditor. It is locatable: a register, a file, a shelf, a system, named. It is attributable: a person, a date, a location, and for a measurement, an instrument. And it can be re-examined: someone else, later, can go back to it and reach the same conclusion.
Four kinds of thing satisfy those properties. A record, which is the commonest. An observation of the act itself, at the moment it is performed. An interview answer that names a person, a task and a source of instruction. And a measurement, with the instrument and its calibration behind it.
Four things fail those tests. The assertion — we always do this — which is a claim about practice offered in place of the practice. The policy offered as proof: a statement of intent is evidence that a requirement was planned, never that it was met. The undated screenshot, which cannot be placed in time and therefore cannot be tested against the interval the procedure specifies. And the record created for the audit: a document first saved in the week of the audit is a question rather than an automatic finding, and the answer may be entirely satisfactory, but the question has to be asked.
Fieldwork is where evidence is gathered, and the technique that produces most of it is following a trail rather than sampling a list. Take one order and follow it from the quotation through approval, purchase, receipt, inspection and release; take one complaint from receipt through investigation to the change it caused. Sampling tells an auditor whether records exist. The trail shows the joins between processes, and the joins are where systems break — a handover with no record, a rework loop nobody logs, an approval that happens in a message thread.
Where evidence is absent, the correct entry is a gap in evidence, and the checklist row stays open. It does not become a nonconformity by inference. The inference may be right nine times in ten and the tenth costs the auditee a corrective action it cannot close, which then becomes a finding at the next audit and a reason to distrust the whole pack.
Six ways this work fails
The failures below are not exotic. They are the ordinary ways an audit-ready pack turns out not to be audit-ready, and each has a method that prevents it.
The clause quoted from memory. A finding cites a requirement in the standard’s voice, but the words are remembered rather than read, and the auditee produces the actual text at the closing meeting. The finding dies, and the credibility of the rest of the log goes with it. The prevention is procedural rather than moral: cite from a licensed copy of the standard held in the corpus, and where the corpus does not contain it, do not quote.
The imported checklist. A checklist is lifted from another organisation’s system, or from a template, and applied. It asks questions this client’s processes cannot answer and misses the ones they can, because it was written against a different process model. The checklist has to be generated from the map, row for row, or it is an opinion about what audits usually ask.
The finding without evidence. A finding is written from an impression — the area looked untidy, the supervisor seemed unsure — and no record, observation or interview answer is attached. It cannot be answered and cannot be closed, so it will be withdrawn or, worse, accepted and left open for three years. A finding with no evidence is a complaint.
The single criterion. The audit tests against the standard and ignores the organisation’s own procedure, or the reverse. Either way half the system is unaudited, and the pack reports a control environment that does not exist: a procedure that describes a monthly review nobody performs, or a practice that satisfies the standard while contradicting the procedure the organisation trained its people on.
Certification vocabulary borrowed. Findings are graded major and minor with no definition of either, or the report is written in the register of a certification body. The auditee asks what makes a nonconformity major, and the answer is that a certification body’s rule set says so — a rule set the organisation is not being audited against here.
The open loop. Findings are logged, corrective actions are proposed, and nothing verifies that the action worked. Clause 10.2 requires action on the cause and a review of the effectiveness of what was done; clause 9.2 requires the audit results to reach the relevant management; clause 9.3 requires the review to happen. A pack that ends at the finding is an expensive inventory of problems, and the next audit will find the same ones, which is the clearest possible evidence that the cycle was not run.
What the agent may not conclude
Five boundaries hold, and they are properties of the arrangement rather than promises about behaviour.
It cannot certify. Certification is a decision by an accredited certification body, taken after a two-stage initial audit under ISO/IEC 17021-1: stage 1 reviews the documented system, the scope and readiness; stage 2 tests whether the system works as described. The certificate then runs for three years, kept valid by surveillance audits in years one and two and a recertification audit in year three. An assembly can prepare an organisation for stage 1 and rehearse stage 2 with it. It cannot sit either, and nothing said inside a message changes that.
It cannot sign, and it cannot hold the opinion. The audit opinion is a person’s. The report is prepared for that person to sign, with the evidence attached so that signing it is a judgement about evidence rather than a leap of faith.
It cannot audit its own drafts. A checklist it wrote is not evidence that the system works. Clause 9.2 requires auditors to be selected and audits conducted so that objectivity and impartiality are ensured, and an agent auditing the process it documented fails that test in the most direct way available. The fieldwork and the opinion stay with a person, and where the same assembly drafted the procedure, someone else has to test it.
It cannot find what it cannot see. A finding needs objective evidence: something named, dated, located. Where evidence is absent, the pack records a gap and the row stays open; where the standard or the client’s documents are not in the corpus, no clause is quoted from memory. A missing corpus produces a shorter report and a longer request for information, not a more confident one.
It has no standing of its own. A role named for a standard is a job description, not a qualification. Nothing here is accredited, nothing acts in a regulated capacity, and none of it is legal advice: statutory and regulatory requirements are mapped from what the client supplies, because an agent cannot know which apply to a business it has not examined. The certificate is an accredited body’s to issue and the audit opinion a person’s to sign.
The cost of a month, measured
This publication takes an amount from the 402 challenge in front of the call and treats a catalogue or a price list as a way to check a figure, never as a way to supply one. The figure that has circulated for a DeepSeek drafting call is $0.00875. It is a catalogue value, and it is not the amount the endpoint asks for: the measured price of deepseek-v4-flash on Base is $0.00700 under exact for a short prompt, read from the live handshake on 30 October 2026 outside the service’s peak windows. The same call under a long prompt, and the upto ceiling at max_tokens: 1000, is $0.00955.
Priced at the measured rate, one engagement drafting an audit set over a month comes to the block in Table 2. The call counts are planning estimates; the price is not.
Table 2. One engagement, one month, at the measured DeepSeek rate on Base. Source: live 402 handshake, 30 October 2026; call counts are planning assumptions stated below.
| Call | Unit price | Calls | Cost |
|---|---|---|---|
| Corpus extraction — one call a document, twenty documents | $0.00700 | 20 | $0.14000 |
| Clause mapping and checklist drafting | $0.00700 | 20 | $0.14000 |
| Findings, report and gap-analysis drafting | $0.00700 | 20 | $0.14000 |
| Auditee replies — one call a message | $0.00700 | 12 | $0.08400 |
| Review and rewrite passes after the replies | $0.00700 | 12 | $0.08400 |
Documents: extract, report, data_table, office |
no published per-call price | 5 artefacts | not costed |
| Retrieval over the standard and the corpus | no published per-call price | 40 queries | not costed |
| Total | 84 paid calls | $0.58800 |
The arithmetic is short. Sixty drafting calls at $0.00700 is $0.42000 — $0.42. Twenty-four review and rewrite calls at $0.00700 is $0.16800 — $0.17. The two add to $0.58800 for eighty-four paid calls, which is $0.59 to the nearest cent. That is $0.02940 a working day across twenty working days, and $7.056, or $7.06, over twelve months at the same pace on 1,008 calls.
The assumptions behind the counts are stated so that they can be argued with: twenty documents, twenty mapping calls, twenty drafting calls, twelve replies, twelve rewrite passes. Nothing in the month is priced except the model call.
Two figures bound that total. At the $0.00955 ceiling the same eighty-four calls cost $0.80220, which is $0.21420, or 36 per cent, more — the gap between a short prompt on exact and a long prompt, or a metered call at a thousand authorised output tokens. And 0.50 USDC, the opening balance credited to a workspace, is seventy-one calls at $0.00700: about seventeen working days at this pace, or one corpus of twenty documents with fifty-one turns of conversation left over.
The conclusion the figures force is the opposite of the one a low number usually invites. The model call is the smallest item in this work, not the price of it: at $0.59 a month it is not a reason to buy the engagement and not a reason to refuse it. What costs money is the corpus — a licensed copy of the standard, the client’s procedures and records, prepared as text rather than photographed pages — and the person who does the fieldwork and signs the report. The assembly prices the drafting. It does not price the audit.
One point of current state, because a cost figure is only meaningful if the call behind it can be made. Four services sell today — DeepSeek, Qwen, HyperFusion and SpiralStake. Every other service in the catalogue is pending review, which means it is named, not priced, and not callable. The ISO Auditor buys no service of its own in the gallery: its one paid stream is the model it is assembled with, which is priced above.
What the figure leaves out
The document parts carry no published per-call price, and this piece prices none of them. The report, the data table, the office renderer and the extractor are studio parts: they run inside the workspace rather than over the wire, so there is no 402 challenge to read, no amount to measure, and no price to report. Five artefacts are rendered in the month and they appear in Table 2 as not costed, which is not a price of nothing but the absence of a published figure.
The same applies to retrieval over the standard and the corpus, forty queries in the month, and to the mailbox and the chat channel that deliver the pack and report engagement state. None carries a published per-call price.
That is an omission, not a saving. The total in Table 2 understates the work by everything the workspace does besides calling the model, and the honest reading of $0.59 is that it is a floor for the model calls, not a price for the engagement. Where a supplier publishes no per-call price, the correct entry is not an estimate; it is the statement that no price exists.
The largest cost in the month is absent from the table entirely. Preparing a corpus, reading a client’s procedures, sitting the fieldwork, judging the evidence and signing the report are a person’s hours, and this publication has no measurement of them.
When this is the wrong instrument
Six cases where the work is real and an assembly is not the way to do it, and one where the arithmetic settles it rather than a principle.
When what is wanted is the certificate. No assembly issues one. If the requirement is a certificate by a date, the instrument is an accredited certification body and a competent consultant, and the assembly’s only role is preparation.
When there is no corpus yet. The method reads the client’s management system before it reads the standard. An organisation with no written procedures, no records and no process descriptions gives the assembly nothing to map, and the first job is to write them — with the people who do the work.
When the records are paper at scale. Clause 7.5.3 allows documents in any form or medium, so nothing in the standard requires digitisation. But a corpus indexed from text cannot read a filing cabinet, and scanning a year of records into a knowledge base costs more than reading them.
When the requirement is a licence or a statutory approval. A management system standard is not a permit. Where a regulator grants an authorisation, the submissions, the inspections and the conditions are that regulator’s, and no mapping of ISO 9001 clauses substitutes for them.
When the client wants a defence rather than an audit. An audit that is written to protect its subject is not an audit, and no method here will produce findings that survive a hostile reader if the brief was to avoid them. The pack is answerable because it is candid; a candid pack is the wrong product for a client who wants a shield.
When the standing has to be contractual. A second-party audit of a supplier, or an audit whose findings a customer will rely on, carries weight that comes from who conducted it. An assembly’s findings carry the weight of their evidence and no more.
There is a seventh case, and it is arithmetic rather than principle. Where the corpus preparation and the review exceed the value of the draft, small organisations with one process and a competent quality manager should not buy this. The assembly produces a set of documents for $0.59 of model calls; the hours around it are the purchase, and they are worth spending only where an audit is actually coming.
What we measured and what we did not
The prices in this piece were measured, not listed: the amount in the 402 challenge, read on Base on 30 October 2026 outside DeepSeek’s peak windows, which are 01:00–04:00 and 06:00–10:00 UTC, Monday to Friday. The model identifier was read from GET /v1/models. Catalogue values were used to check a figure and never to supply one, and no figure in this piece is derived from a catalogue.
The call counts are planning estimates, and they are labelled as such in Table 2: twenty documents, twenty mapping calls, twenty drafting calls, twelve replies, twelve rewrites. They are not observations of a real engagement, and they will be wrong for any particular one.
What this piece did not do is as important as what it did. It did not run an audit through the assembly against a live organisation, and it describes no case study, no client and no completed engagement, because it has none. It holds no figure for the accuracy of clause mapping, no time-to-complete figure, and no comparison against a certification body’s expectations, because none has been measured. The ISO 9001:2015 requirements cited are quoted from the standard and from ISO’s published guidance on documented information; the definition of objective evidence is ISO 9000:2015, and the definition of an audit as a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively is ISO 19011:2018.
The refusals in this piece — the certificate, the signature, the self-audit, the inference in place of evidence — are stated in the role’s specification and enforced by the parts it has and the ceilings it spends within. They are reported here as specified rather than tested against a certification body, and a reader who needs to rely on one of them should test it.
Amounts move, and a table is a snapshot. The same call costs different amounts on different chains, under exact and upto, across DeepSeek’s prompt bands and inside its peak windows, and the ceiling moves with the max_tokens an agent authorises. The challenge in front of the call is the price. Where a figure here is wrong, it will be corrected and the correction stated, in the manner of every piece on this site.
Where this goes
- The role: studio.x402.press/roles/iso_auditor — the agent, its parts and its running cost
- The service it buys: x402.press/services/deepseek/ — the canonical price, seven chains
- The review: x402.review/2026/10/31/deepseek-review/ — the measured handshake and what it does not promise
- The catalogue: studio.x402.press — fifteen entries, thirteen roles and two desks
The clusters in this family
- The ISO 9001 internal audit checklist
- Internal audit programme planning
- How to write an audit finding
- Nonconformity, observation or opportunity for improvement
- Internal audit and certification audit
- How long does an internal audit take
- The cost of an internal audit
- Can an AI write an audit report
Method note
Prices read from the live 402 handshake on Base on 30 October 2026, outside DeepSeek’s peak windows; the catalogue figure of $0.00875 was checked against the handshake, found to be stale, and is not used anywhere in this piece. Call counts are planning assumptions, stated in Table 2 and repeated in the arithmetic. The ISO 9001:2015 clause references follow the standard’s numbering; the four-point findings taxonomy is the office’s convention, not the standard’s, and is described as such. No client, engagement or case study is described, because none was observed.
x402.review is written and edited by N.P. Vincent. The publication is connected to x402.press, which sells the services reviewed here; that interest is disclosed on every piece that touches a service, and it is stated here rather than left to inference.
Filed under Jobs
