_1762866128417-DS2_OO1j.png)
Why traceability shortens audits
“Where do you define the evaluation of external providers?” – many teams answer such questions by searching: in the manual, on the drive, in their memory. Traceability answers immediately, because the mapping from requirement to evidence is recorded once and maintained.
In regulated industries traceability is mandatory anyway: medical device manufacturers must trace requirements through verification and validation, automotive suppliers must evidence customer-specific requirements, and for ISO 27001 the Statement of Applicability shows how every control is implemented. For ISO 9001, too, the effort pays off – by the second audit at the latest.
What you can link
How to build traceability
- 1
Define the scope
In the certification scope you select the requirements that apply. Non-applicable requirements are excluded with a justification.
- 2
Start with core requirements
Begin with the requirements auditors always ask about: policy, objectives, document control, competence, audit, management review, corrective action.
- 3
Use analysis results
Confirmed evidence from the gap analysis and the compliance check are ideal candidates for links.
- 4
Maintain rather than rebuild
When a document is replaced or withdrawn, update the link. That keeps the matrix current.
Example of a traceability matrix
| Requirement | Evidence | Type | Process |
|---|---|---|---|
| ISO 9001 7.5.3 Control of documented information | QM-VA-001 Control of documented information | Implements | Document control |
| ISO 9001 7.2 Competence | QM-VA-014 Cleanroom hygiene, hygiene training | Supports | HR and training |
| ISO 9001 8.4 External providers | QM-FB-012 Supplier evaluation form | Implements | Purchasing |
| ISO 9001 9.2 Internal audit | QM-VA-004 Internal audits | Implements | Internal audits |
| ISO 27001 5.2 Policy | IS-RL-001 Information security policy | Implements | Leadership |
The matrix is also a valuable tool for change: before a document is changed or withdrawn, you see which requirements depend on it.
Using traceability when things change
Traceability delivers most value when something changes. Three typical situations:
A new edition of a standard is published
You immediately see which documents implement the affected clauses and can create new versions selectively instead of revising the whole manual. The regulatory radar alerts you to new editions.
A document is to be merged or withdrawn
Before acting, the matrix shows which requirements would be left without evidence. You map them to the new document before the old one disappears.
A customer asks about a requirement
You record customer-specific requirements, for example from the automotive industry, as your own requirements. When asked, you show where and how they are implemented – including training records of the people involved.
In all three cases, the matrix replaces hours of searching with a targeted look – and prevents changes from creating gaps that only surface in the next audit.
Who maintains the matrix
In small companies, the quality manager usually maintains traceability. In larger organisations a split has proven itself: process owners confirm the mappings for their processes, and quality ensures completeness across all standards. Because links are created with a description and type, it stays clear why a mapping exists – even when the person who created it has long moved on to another role.
Where traceability is required
| Standard / regulation | Requirement | Contribution |
|---|---|---|
| ISO 13485:2016, 7.3 | Design inputs and outputs, verification and validation traceable | Links from requirements to evidence |
| EU MDR, Annex II | Technical documentation demonstrating the general safety and performance requirements | Mapping of requirements to documents |
| IATF 16949:2016, 4.3.2 | Evaluate and include customer-specific requirements | Own requirements in scope, with evidence |
| ISO/IEC 27001:2022, 6.1.3 | Statement of Applicability with implementation status | Control → policy and procedure |
| ISO 9001:2015, 4.4 | Processes with documented information | Process → document |
Tips for a maintainable matrix
- Link at the level of clauses or sub-clauses, not individual sentences. Overly fine matrices go stale quickly.
- Use link types deliberately: “implements” for the leading document, “supports” for complementary evidence.
- Add customer-specific requirements as your own requirements in the scope – so they sit alongside the standard requirements.
- Spot-check the matrix before every internal audit.
Frequently asked questions
How much effort is it to build traceability?
For the core requirements of a standard, a few hours are usually enough. If you take over the evidence from the gap analysis and compliance check, it is much faster.
What is a traceability matrix?
A table that maps requirements to the evidence that fulfils them – for example clauses to procedures, processes and training.
Do I need traceability for ISO 9001?
The standard does not explicitly require a matrix, but it makes audits much easier and helps you see the impact of changes.
Can I link my own requirements?
Yes. You create your own requirements, such as customer requirements, in the certification scope and link them like standard requirements.
Are links created automatically?
No. Analyses suggest evidence; you create the link deliberately so the matrix stays reliable.
What happens if a linked document is withdrawn?
When withdrawing, check in traceability which requirements are linked to the document and assign the new evidence. That way no requirement is left without proof.
How do I keep a traceability matrix current when things change?
Treat each change to a requirement, process or document as a possible trigger to review neighbouring links. Identify the changed item first, then follow its relationships to parent requirements and to procedures, evidence and owners. Do not leave a superseded record marked as current; decide whether it should be archived, replaced by a new version or retained as historical evidence. Every open gap needs an owner and a next action. Spot-check the revised matrix against real workflows, especially for safety-critical or regulatory topics. A matrix remains useful only when it has a clear owner and changes are included in the normal approval process, rather than being reconstructed shortly before an audit.