Truke Studio

• The question, and why the usual answer is thin

“How do you ensure that lessons learned from previous projects are applied to new ones?”

ISO 9001 asks for it under 7.1.6, organizational knowledge, and again under 10.2 where corrective action has to prevent recurrence. IATF and ASPICE auditors ask their own versions. The answer most organisations give is a procedure that requires engineers to consult past work, plus a lessons-learned register that proves the knowledge was stored.

Neither shows that anything arrived. A procedure describes an intention. A register describes a shelf. The auditor's actual question is about the journey between them, and the honest answer in most organisations is we rely on people remembering to look — which is why the follow-up question, show me a project that inherited a lesson it did not write, is the uncomfortable one.

• What you can put in front of an auditor instead

A row nobody wrote there, and where it came from

A project's compliance register carries an Origin column naming the type each obligation arrived from. Nothing was copied into the project: the register is derived on every read, which is why a requirement added to a type today shows up on a project finished last year.

A gap that stays open until somebody answers

An inherited obligation reads missing — not as a stored flag, but as the difference between what the type requires and what the project has answered for. It cannot go stale, because there is nothing to keep up to date.

Every revision, with who and when and what changed

All revisions of every item are kept with author, timestamp and the author's own description of the change, and diff shows any revision against the one before it — which is what makes that description checkable rather than merely present.

Two identical questions, hours apart, that agree

The database is live, so an audit running against it could honestly get two different answers. Reads pin to a moment with as_of, and a page showing history says so in a banner that cannot be dismissed. How auditing works →

A record of what you examined

An append-only journal of who read what, when and by which route — so the scope of an audit is itself evidence. Every CSV and XLSX export carries a provenance header naming the database and the moment it came from.

• A QMS built, then audited through its own API

A library of 65 requirements covering the clauses of ISO 9001:2015, a quality system built against it, and then an audit run over the API with the verdicts recorded:

Conform

Minor nonconformity

Major nonconformity

Observation

Not applicable

The seeded gaps were found. The finding worth reporting is the one nobody planted: 16 requirements had evidence present in the system and no link to it — a failure mode that a shelf full of documents cannot even express, because on a shelf the evidence and the requirement were never connected in the first place. The whole case study →

• What this does not prove

The case study above asked whether an ISO 9001 audit could be conducted against KF data alone, and answered partly. That answer is worth repeating here rather than leaving in a footnote:

Judging whether evidence is sufficient is not a query. KF can show you that a management review record exists, is linked to the requirement, and was written inside the audit period. Whether its content actually demonstrates that top management reviewed the quality system is a human judgment, and no amount of structure removes it.

Arrival is not comprehension. KF proves a lesson reached a project and that somebody closed the row. It does not prove they understood it, or that the closure was honest.

A register full of open gaps proves the mechanism works and the organisation does not. That is the correct outcome and an uncomfortable one, and it is visible to your auditor as readily as to you.

KF is not a QMS. No training management, no supplier qualification workflow, no electronic signature regime. It is the evidence layer under the parts of a quality system that are about engineering knowledge.

Can you prove that your organization learns?