ISO 9001 Process Landscape: How to Identify and Document Your Core Processes
Our complete ISO 9001 implementation guide for SMEs walked through the full certification path. Our guide to writing a quality policy established your QMS direction. Our guide to quality objectives showed how to translate that direction into measurable targets. This article is the next step: how to identify, structure, and document the processes that actually run your business — the process landscape that forms the operational backbone of your entire QMS. Your quality policy sets the direction. Your objectives define the milestones. Your process landscape is the map of how value actually moves through your organization. Many SMEs approach this step with anxiety. They imagine complex process maps, hundreds of pages of documentation, and a full-time quality manager to maintain it all. In practice, a functional process landscape for an SME with 10 to 100 employees can fit on one page — and documenting it in a way that satisfies ISO 9001 auditors is more straightforward than most consultants suggest. This guide shows you exactly how to do it: how to identify your processes, how to structure them into the three mandatory categories, how to document them at the right level of detail, and how to connect them into a coherent system.
Identifying core processes is best done as a team workshop — starting from the customer and tracing value through the organization.
What Does ISO 9001:2015 Actually Require? (Clause 4.4)
Clause 4.4 is titled “Quality Management System and Its Processes.” Among all the clauses in the standard, it is one of the most consequential — and most frequently misunderstood.
Clause 4.4.1 — What You Must Establish
The standard requires that your organization must:
Determine the processes needed for the QMS and their application throughout the organization
Define the inputs and outputs of each process
Determine the sequence and interaction of these processes
Determine the criteria and methods needed to ensure effective operation and control of these processes
Determine the resources needed for these processes and ensure their availability
Assign responsibilities and authorities for each process
The standard requires that you maintain documented information to support the operation of your processes and retain documented information to have confidence that processes are being carried out as planned.
Practical note: Notice what the standard does NOT say. It does not require flowcharts. It does not require a specific format. It does not require dedicated process documentation software. What it requires is that you can demonstrate — to yourself and to an auditor — that you understand your processes, control them, and improve them. How you do that is your decision.
A process landscape (also called a process map or process house) is a high-level visualization of all processes in your organization, grouped into categories, showing how they relate to each other and how value flows from customer requirements to customer satisfaction. At the landscape level, you are working at the strategic overview — the thirty-thousand-foot view that shows structure before detail. A process landscape typically shows:
The three process categories (management, core, support)
The process names at the right level of abstraction
The overall flow direction — inputs from customers and interested parties on the left, outputs (delivered value) on the right
Key interactions between processes
The process landscape is the structural foundation of your QMS. Every other element — objectives, procedures, audit plans, management reviews — connects back to it.
Example process landscape for a SaaS company — management, core, and support processes structured in a three-tier house with customer inputs and outputs.
How Complex Does Your Process Landscape Need to Be?
For your initial ISO 9001 implementation, a simple one-page overview is entirely sufficient. A general process landscape listing 8 to 12 processes in the three standard categories — like the ACME Inc example above — satisfies Clause 4.4 and will pass your first certification audit. Do not over-engineer it at this stage.
As your business grows and your operations become more complex, a more detailed landscape with sub-processes, process interactions, and performance indicators per process becomes genuinely useful — not for the auditor, but for your own operational clarity. This is when a general one-page overview starts to struggle: you have too many processes to track, too many owners to coordinate, and too many interfaces to manage manually.
At that level of complexity, QMS software tools become a practical option. Products like vissibl.ai are built specifically for this: they let you map and maintain your process landscape digitally, assign process owners, track KPIs per process, and connect your risks, objectives, and audits directly to the relevant processes. For an SME starting out, this is not necessary. For a growing organization with 50 or more employees and a maturing QMS, it can eliminate significant administrative overhead.
The rule of thumb: start simple, stay simple as long as it works. Add complexity only when your operations demand it, not before.
The Three Process Categories Every SME Must Cover
ISO 9001 does not prescribe specific process categories, but auditors and quality practitioners universally use a three-tier model that maps perfectly onto what the standard requires. Every process in your organization falls into one of three categories.
Category
Description
SME Examples
Management Processes
Processes that direct and coordinate the organization. They set direction, allocate resources, and ensure the QMS functions and improves.
Processes that directly create and deliver your product or service to the customer. These are the processes the customer pays for.
Sales / order intake, engineering / design, production / service delivery, shipping / installation, customer service
Support Processes
Processes that enable the core processes by providing resources, infrastructure, and competence. They do not directly create customer value but are necessary for the core to function.
HR / training, purchasing, IT, maintenance, infrastructure management, document and records control
Practical note: The core processes vary significantly by industry. A manufacturing SME’s core processes look very different from a professional services firm’s. Start from the customer and work backwards — the right list is the one that accurately reflects how your organization creates and delivers value.
Every SME process falls into one of three categories — management, core, or support — and together they form your process landscape.
How to Identify Your Core Processes: Step by Step
The following approach works for SMEs with no prior process documentation. It typically takes one to two workshop sessions of ninety minutes each with the leadership team.
Step 1: Start With the Customer
Ask: What does the customer come to us for? What do they receive when we are done? For a manufacturing SME the answer is a physical product that meets specifications and is delivered on time. For a consulting firm it is advice, a report, or an implemented solution. For a medical device company it is a compliant, safe device. Write the customer requirement on the left side of a blank page. Write the delivered output on the right side. Everything in between is a candidate for your core process map.
Step 2: Trace the Value Stream
Walk through the journey of a typical order from first customer contact to final delivery and payment. At each handover point — where work passes from one team or function to another — you have a process boundary. A typical SME producing custom components might identify: Sales → Order Review → Engineering → Production Planning → Production → Quality Control → Shipping → Invoicing. Each of those transitions is a process. The handover point is where you define inputs and outputs.
Step 3: Add Management Processes
Ask: What processes ensure we have direction, we review our performance, and we improve? For most SMEs, this means at minimum:
Strategic planning and management review (Clause 9.3)
Internal audit program (Clause 9.2)
Corrective action and continual improvement (Clause 10)
Step 4: Add Support Processes
Ask: What must be in place for our core processes to function? Typical SME answers: HR, purchasing/supplier management, IT/infrastructure, document control.
Step 5: Name Your Processes at the Right Level
Resist the temptation to go too detailed too early. A process landscape should have 8 to 15 processes for a typical SME. If you have 30 items on your list, you have gone to the task level rather than the process level. A process operates over time, has defined inputs and outputs, and can be owned by one responsible person. A task is a step within a process.
Tip: If a step takes 5 minutes and one person, it is probably a task. If it involves multiple steps, takes days or weeks, and creates a defined output that feeds into the next step, it is a process. Use that as your filter when deciding what belongs in your landscape.
The turtle diagram: one central process with four arms for inputs, outputs, controls, and resources — the simplest way to document what Clause 4.4.1 requires.
The Turtle Diagram: Documenting Individual Processes
Once your process landscape is defined, you need to document each individual process at a sufficient level of detail. The turtle diagram is the most practical and auditor-friendly tool for this. It captures everything ISO 9001 Clause 4.4.1 requires for a single process in one compact view:
Element
Question It Answers
Example (Order Processing)
Process Name
What process is this?
Order Processing
Process Owner
Who is accountable?
Head of Sales
Inputs
What triggers the process? What information or material enters?
Customer inquiry or purchase order, product specification
Outputs
What does the process produce? What goes to the next process or customer?
Confirmed order with delivery date, production order
Controls / Requirements
What rules govern this process?
ISO 9001 Clause 8.2, customer contract terms, pricing policy
Resources
What equipment, tools, systems, or infrastructure are needed?
ERP system, CRM, trained sales staff
Competence / Who
Who performs the process, and what competence is required?
Sales team with product knowledge, authority to commit delivery dates
Performance Indicators
How do you know the process is working? What do you measure?
Order entry error rate (target ≤0.5%), average quote response time (target ≤24h)
Risks and Opportunities
What can go wrong, and what opportunities exist?
Risk: customer spec misunderstood; Opportunity: upsell at order review
A completed turtle diagram for each of your 8–15 processes, collected in a single Excel or Word file, is a fully compliant process documentation system. No specialized software required. For guidance on the work instruction level — one step below the process level — see our free ISO 9001 work instruction template.
The Process Interaction Matrix
ISO 9001 Clause 4.4.1 requires you to determine the sequence and interaction of your processes. The process interaction matrix is the most efficient way to demonstrate this. A simple grid — processes listed on both axes — uses a checkmark or arrow in each cell to indicate that one process passes an output to another. For a 10-process SME, this matrix fits on half a page and immediately makes visible which processes are most interconnected, and therefore where interface problems are most likely to occur.
Practical note: You do not need software to create a process interaction matrix. A table in Excel or Word with your processes on both axes and checkmarks at intersections is entirely sufficient. Auditors consistently accept this format. What they want to see is that you have thought about how processes connect — not that you used sophisticated modeling tools.
A process interaction matrix on one page shows how your processes connect — and where the critical handover points are.
How Much Documentation Does ISO 9001 Actually Require?
This is the question that causes the most confusion. The 2015 revision of ISO 9001 deliberately moved away from mandatory procedures. Here is what is actually required.
Mandatory Documented Information
The standard explicitly requires documented information for:
Scope of the QMS (Clause 4.3)
Quality policy (Clause 5.2)
Quality objectives (Clause 6.2)
Competence of personnel (Clause 7.2)
Monitoring and measurement results (Clause 9.1)
Internal audit program and results (Clause 9.2)
Management review outputs (Clause 9.3)
Nonconformities and corrective actions (Clause 10.2)
And for the processes themselves, the standard uses careful language: you must maintain documented information to support the operation of your processes and retain documented information to have confidence that processes are being carried out as planned.
Minimum Viable Process Documentation for an SME
For your process landscape, this translates to:
A process landscape diagram or list showing all processes (1 page)
A turtle diagram or equivalent for each key process (1 page per process)
A process interaction matrix showing how processes connect (1 page)
For a typical SME with 10–12 key processes, that totals roughly 12–15 pages. A well-maintained version of this set is entirely audit-ready.
Tip: Do not confuse process documentation with work instructions. A turtle diagram describes the what, who, and how of a process at the management level. A work instruction tells an operator exactly how to perform a specific task. ISO 9001 does not require work instructions — but for critical processes where errors have serious consequences, they are good practice regardless of certification requirements.
For practical guidance on what documents and records your QMS needs to control, and how to manage them without bureaucratic overhead, see our guide to ISO 9001 document control.
Common Mistakes SMEs Make With Process Landscapes
After working through process landscapes with dozens of SMEs, the same failure patterns appear consistently.
Mistake 1: Confusing Organizational Structure With Process Structure
A process landscape is not an org chart. Processes cut across departmental boundaries. Order processing might involve Sales, Engineering, and Production. Drawing your process map along departmental lines means missing the interfaces where most quality problems actually occur.
Mistake 2: Going Too Detailed Too Early
The process landscape is the overview. Detail lives in turtle diagrams and work instructions. If your landscape has 40 items, consolidate to the 8–15 process level first.
Mistake 3: Processes Without Owners
Every process must have a named owner — a specific person who is accountable for performance, not a department or a job title. If the process owner is “Quality Department,” nobody actually owns it. Assign a name.
Mistake 4: Documentation That Nobody Uses
Process documentation that exists only for the audit creates a false sense of control while providing none of the operational benefit. Write documentation at the level of detail your team actually needs to perform the process correctly. If people ignore it in practice, the documentation is either too detailed (a procedure manual nobody reads) or not detailed enough (too abstract to be useful).
Mistake 5: Never Updating the Process Landscape
Organizations change. New services are added. Processes are restructured. Your process landscape should be a living document, reviewed at every management review. An outdated process landscape is a common major finding in surveillance audits. For a full picture of what goes wrong during implementation, see our guide to common pitfalls in ISO 9001 implementation.
Connecting the Process Landscape to the Rest of Your QMS
The process landscape is the structural backbone that connects to every other element of your QMS:
Quality objectives are set per process — or for the organization as a whole, but monitored at process level
Competence requirements are defined per process (who needs what skills to run this process) — covered in Clause 7.2, the topic of the next article in this series
Management reviews evaluate process performance using the KPIs defined in your turtle diagrams
If you have completed the previous steps in this series — quality policy, quality objectives, risks and opportunities — you will find that the process landscape makes those elements more concrete. Objectives gain clear ownership (which process does this objective belong to?). Risks become process-specific rather than abstract. The QMS stops feeling like a collection of documents and starts functioning as a connected system.
How We Help SMEs Build Their Process Landscape
At Sternberg Consulting, we facilitate structured process identification workshops with SME leadership teams — typically two 90-minute sessions that result in a fully documented process landscape, a complete set of turtle diagrams, and a process interaction matrix. We then review the outputs against the ISO 9001 Clause 4.4 requirements and check for alignment with your quality policy and objectives before your certification audit. If you would like support building your process landscape or want an experienced ISO 9001 consultant to review your process documentation, get in touch with our team.
Frequently Asked Questions
Do we need to flowchart every process?
No. ISO 9001 does not require flowcharts. A turtle diagram, a table, or even a well-structured text description that covers inputs, outputs, controls, resources, competence, and performance indicators is fully compliant. Use flowcharts where they genuinely help — typically for complex branching processes where sequence matters — but do not create them for every process out of obligation.
Can external or outsourced processes be part of our process landscape?
Yes, and they often must be. If you outsource a critical process — logistics, calibration, testing — that outsourced process remains within your QMS scope and must be controlled. It should appear in your process landscape with a clear label that it is externally performed, and your turtle diagram should specify how you control and monitor it.
How often should we update our process landscape?
At minimum, review it at every management review. Update it immediately whenever a significant organizational change occurs — new product lines, restructuring, acquisition of new processes. Do not wait for the next annual review if your business has changed materially.
What is the difference between a process and a procedure?
A process is what happens — the set of activities that transforms inputs into outputs. A procedure describes how it happens — the specific steps, in sequence, with the rules and decisions involved. ISO 9001 requires you to define and control your processes; it does not require written procedures for all of them. Where a process is simple and the people performing it are highly competent, the process can be controlled without a written procedure.
How detailed should turtle diagrams be?
Detailed enough that a new employee with the right baseline competence could understand the process, and brief enough that your team will actually read and use it. A turtle diagram that fills more than one A4 page is generally too detailed. Aim for a half-page structured template per process — everything the standard requires, nothing more.
Do support processes need turtle diagrams too?
Yes, for the key ones. Not every support activity needs a full turtle diagram, but processes critical to QMS function — purchasing, document control, competence management — should have at minimum a basic turtle diagram. For routine administrative tasks, a simpler description is sufficient.
How many processes should our process landscape have?
For a typical SME with up to 100 employees, aim for 8 to 15 processes across all three categories. Fewer than 8 likely means you have consolidated too aggressively and are missing important process distinctions. More than 15 usually means you have gone to the task level. The right number is the one that accurately reflects how your organization creates and delivers value — no more, no less.
The Next Step: Competence and Training
With your process landscape defined and your processes documented at the right level, you have the operational core of your QMS in place. The next article in this series is ISO 9001 Competence and Awareness: A Practical Guide for SMEs, covering Clause 7.2 and 7.3 — Competence and Awareness: how to identify the competence your processes require, how to demonstrate that your team has it, and how to manage training in a way that satisfies auditors without creating a bureaucratic training records nightmare.
Jonathan Sternberg, founder of Sternberg Consulting, brings extensive experience from the automotive, semiconductor, and optical industries. He focuses on customized solutions and genuine collaboration in quality management.
