In This Article
- ISO 9001:2015 uses the Annex SL high-level structure (Clauses 4-10) shared by all ISO management system standards
- Clause 8 (Operation) contains the most sector-specific requirements covering the full product/service lifecycle
- Risk-based thinking replaces preventive action from the 2008 version, embedded throughout all processes
- The standard requires leadership involvement, not just delegation - top management must actively demonstrate commitment
- Only documented information explicitly required by the standard is mandatory; a quality manual is no longer required
Understanding the Standard Structure
ISO 9001:2015 is the world's most widely adopted management system standard. It specifies requirements for a Quality Management System (QMS) that helps organizations consistently deliver products and services that meet customer and regulatory requirements. The standard follows the Harmonized Structure (HS), meaning it shares a common framework with other ISO management system standards such as ISO 14001 (Environmental) and ISO 27001 (Information Security), making integration straightforward.
Clauses 1-3: Scope, normative references, and terms and definitions - these are informational and not auditable.
Clauses 4-10: The mandatory requirements that organizations must meet for certification.
No Annex A: Unlike ISO 27001, ISO 9001 does not have an Annex A of controls. All requirements are embedded within Clauses 4-10.
A key principle of ISO 9001 is the process approach, which requires organizations to manage interrelated processes as a system to achieve intended outcomes. This is underpinned by the Plan-Do-Check-Act (PDCA) cycle and risk-based thinking throughout the standard.
| Clause | Title | PDCA Phase | Focus Area |
|---|---|---|---|
| 4 | Context of the Organization | Plan | Understanding environment and scope |
| 5 | Leadership | Plan | Commitment and direction |
| 6 | Planning | Plan | Risks, opportunities, objectives |
| 7 | Support | Do | Resources, competence, communication |
| 8 | Operation | Do | Product/service delivery |
| 9 | Performance Evaluation | Check | Monitoring and review |
| 10 | Improvement | Act | Corrective action and continual improvement |
Clause 4: Context of the Organization
Understanding your environment and defining your QMS boundaries
4.1 Understanding the Organization and Its Context
What it means: Know your organization's operating environment. Identify the external factors (market conditions, regulatory landscape, competitive pressures, technological changes) and internal factors (organizational culture, capabilities, resources, governance structure) that are relevant to your purpose and affect your ability to achieve the intended outcomes of your QMS.
What you need: A documented analysis of internal and external issues. Many organizations use tools like SWOT analysis or PESTLE analysis to structure this. The analysis must be monitored and reviewed regularly.
4.2 Understanding the Needs and Expectations of Interested Parties
What it means: Identify the stakeholders who are relevant to your QMS - customers, regulators, employees, suppliers, shareholders, and others - and determine what they require or expect from your organization in terms of quality.
What you need: A list of interested parties and their relevant requirements. These requirements should be monitored and reviewed because they change over time.
4.3 Determining the Scope of the Quality Management System
What it means: Clearly define what your QMS covers - which products, services, processes, locations, and functions are included. The scope must consider the external and internal issues from 4.1 and the requirements from 4.2.
What you need: A documented scope statement that specifies the boundaries and applicability. If any requirements of the standard are not applicable, you must justify why (but you cannot exclude requirements from Clauses 4-10 if they are relevant).
4.4 Quality Management System and Its Processes
What it means: Establish, implement, maintain, and continually improve your QMS, including the processes needed and their interactions. For each process, determine inputs, outputs, sequence, criteria for effectiveness, resources, responsibilities, risks, and opportunities.
What you need: A process map or process interaction diagram, along with documented information to support process operation and confidence that processes are carried out as planned.
Create a simple process interaction map that shows how your key processes connect - from customer inquiry through delivery and post-delivery support. This visual tool helps everyone understand how their work fits into the bigger picture and is one of the first things auditors typically ask to see.
Clause 5: Leadership
Top management involvement and direction
5.1 Leadership and Commitment
What it means: Top management must take accountability for the effectiveness of the QMS. This is not a delegation exercise - leaders must actively demonstrate their commitment by ensuring the quality policy and objectives are established and aligned with strategic direction, ensuring QMS requirements are integrated into business processes, promoting the process approach and risk-based thinking, ensuring resources are available, communicating the importance of effective quality management, and engaging and supporting people to contribute to QMS effectiveness.
5.1.2 Customer Focus: Top management must ensure that customer requirements and applicable statutory and regulatory requirements are determined, understood, and consistently met. Risks and opportunities that can affect conformity of products and services must be addressed, and the focus on enhancing customer satisfaction must be maintained.
What you need: Evidence of management involvement - meeting minutes, resource allocation decisions, communications, strategic alignment documentation.
5.2 Quality Policy
What it means: Establish a quality policy that is appropriate to the organization's purpose and context, provides a framework for setting quality objectives, includes a commitment to satisfy applicable requirements, and includes a commitment to continual improvement.
What you need: A documented quality policy that is communicated and understood within the organization, available to relevant interested parties, and reviewed for continuing suitability.
5.3 Organizational Roles, Responsibilities, and Authorities
What it means: Top management must ensure that the responsibilities and authorities for relevant roles are assigned, communicated, and understood. Specifically, someone must be responsible for ensuring the QMS conforms to ISO 9001 requirements, that processes deliver their intended outputs, that QMS performance is reported to top management, and that customer focus is promoted throughout the organization.
What you need: Documented roles and responsibilities (organization charts, job descriptions, RACI matrices), evidence of communication.
Clause 6: Planning
Risk-based thinking, objectives, and managing change
6.1 Actions to Address Risks and Opportunities
What it means: When planning your QMS, consider the issues from Clause 4.1 and the requirements from Clause 4.2 to determine risks and opportunities that need to be addressed. The purpose is to give assurance that the QMS can achieve its intended results, enhance desirable effects, prevent or reduce undesired effects, and achieve improvement.
Plan actions to address these risks and opportunities, integrate them into your QMS processes, and evaluate their effectiveness.
Unlike ISO 27001 or ISO 31000, ISO 9001 does not require a formal risk assessment methodology or risk register. Risk-based thinking is a concept that should be embedded in your processes. However, many organizations find that maintaining a risk register is a practical way to demonstrate compliance and manage risks systematically.
What you need: Evidence that risks and opportunities have been considered and addressed. This could be a risk register, FMEA, process risk assessments, or simply documented considerations within process documentation.
6.2 Quality Objectives and Planning to Achieve Them
What it means: Establish quality objectives at relevant functions, levels, and processes. Objectives must be consistent with the quality policy, be measurable, take into account applicable requirements, be relevant to conformity of products and services and to enhancing customer satisfaction, be monitored, be communicated, and be updated as appropriate.
What you need: Documented quality objectives with plans that detail what will be done, what resources are needed, who is responsible, when it will be completed, and how results will be evaluated.
6.3 Planning of Changes
What it means: When you determine that the QMS needs to change, carry out the changes in a planned manner. Consider the purpose of the changes and their potential consequences, the integrity of the QMS, the availability of resources, and the allocation or reallocation of responsibilities and authorities.
What you need: Evidence that changes to the QMS are planned and managed, not ad hoc. Change records, impact assessments, and approved change requests demonstrate compliance.
Clause 7: Support
Resources, competence, awareness, communication, and documentation
7.1 Resources
ISO 9001 breaks resource requirements into five specific categories:
7.1.1 General: Determine and provide the resources needed for the establishment, implementation, maintenance, and continual improvement of the QMS. Consider the capabilities and constraints on existing internal resources and what needs to be obtained from external providers.
7.1.2 People: Determine and provide the people necessary for effective implementation of your QMS and for the operation and control of its processes.
7.1.3 Infrastructure: Determine, provide, and maintain the infrastructure necessary for the operation of your processes - buildings, utilities, equipment, hardware, software, transportation, and information and communication technology.
7.1.4 Environment for the Operation of Processes: Determine, provide, and maintain the environment necessary for the operation of your processes. This includes physical factors (temperature, humidity, lighting, airflow, hygiene, noise) as well as social factors (non-discriminatory, calm, non-confrontational) and psychological factors (stress-reducing, burnout prevention, emotionally protective).
7.1.5 Monitoring and Measuring Resources: When monitoring or measurement is used to verify conformity of products and services, determine and provide the resources needed to ensure valid and reliable results. Measuring equipment must be calibrated or verified at specified intervals, or prior to use, against measurement standards traceable to international or national standards. Equipment must be identified, safeguarded against adjustments, damage, and deterioration.
7.1.6 Organizational Knowledge: Determine the knowledge necessary for the operation of your processes and to achieve conformity of products and services. This knowledge must be maintained and made available as needed. When addressing changing needs and trends, consider current knowledge and determine how to acquire additional necessary knowledge.
What you need: Resource allocation evidence, infrastructure records, environmental monitoring (where applicable), calibration records and schedules, knowledge management systems or documented procedures.
7.2 Competence
What it means: Determine the necessary competence of persons doing work that affects quality performance and QMS effectiveness. Ensure persons are competent on the basis of appropriate education, training, or experience. Where applicable, take actions to acquire the necessary competence and evaluate the effectiveness of those actions.
What you need: Competence criteria for key roles, training plans, training records, qualification certificates, evidence of effectiveness evaluation of training undertaken.
7.3 Awareness
What it means: Persons doing work under the organization's control must be aware of the quality policy, relevant quality objectives, their contribution to QMS effectiveness (including the benefits of improved quality performance), and the implications of not conforming with QMS requirements.
What you need: Awareness programs, induction materials, communication records, evidence that personnel understand their role in quality.
7.4 Communication
What it means: Determine the internal and external communications relevant to the QMS, including what you will communicate, when, with whom, how, and who communicates.
What you need: Communication plan or procedure addressing both internal and external communications related to quality.
7.5 Documented Information
What it means: Your QMS must include documented information required by ISO 9001, plus any additional documented information you determine is necessary for QMS effectiveness. You must control the creation, updating, and management of documented information.
What you need: Document control procedures covering identification, format, review and approval, availability, protection, distribution, storage, retention, and disposition. Version control and access controls are essential.
| Clause 7 Area | Key Requirement | Common Evidence |
|---|---|---|
| People | Adequate personnel for QMS | Staffing plans, org charts |
| Infrastructure | Maintained facilities and equipment | Maintenance logs, asset registers |
| Environment | Suitable working conditions | Environmental monitoring, workplace assessments |
| Monitoring Resources | Calibrated measurement equipment | Calibration certificates and schedules |
| Knowledge | Organizational knowledge maintained | Knowledge bases, SOPs, lessons learned |
| Competence | Trained and qualified personnel | Training records, qualifications |
Clause 8: Operation
Planning and controlling your product and service delivery
Clause 8 is the longest and most detailed clause in ISO 9001. It covers the entire lifecycle of your products and services, from understanding customer requirements through to delivery and post-delivery activities.
8.1 Operational Planning and Control
What it means: Plan, implement, and control the processes needed to meet requirements for providing products and services and to implement the actions determined in Clause 6.1. Determine product and service requirements, establish criteria for processes and acceptance of products and services, determine resources needed, implement control of processes, and retain documented information.
What you need: Quality plans, work instructions, control plans, acceptance criteria, process controls for outsourced processes.
8.2 Requirements for Products and Services
8.2.1 Customer Communication: Establish processes for communicating with customers about product and service information, enquiries, contracts, orders, customer feedback (including complaints), handling customer property, and contingency actions when relevant.
8.2.2 Determining Requirements: Determine the requirements for products and services, including any applicable statutory and regulatory requirements, and those considered necessary by the organization. Ensure you can meet the claims for the products and services you offer.
8.2.3 Review of Requirements: Before committing to supply products or services, review to ensure requirements are defined (including delivery and post-delivery), any differences between contract or order requirements and those previously expressed are resolved, and you have the ability to meet the requirements. Retain documented information of review results and any new requirements.
8.2.4 Changes to Requirements: When requirements change, ensure relevant documented information is amended and that relevant persons are made aware of the changes.
8.3 Design and Development of Products and Services
What it means: If your organization designs products or services, you must establish, implement, and maintain a design and development process. This includes planning (stages, reviews, verification, validation), determining inputs (functional and performance requirements, regulatory requirements, standards, consequences of failure), implementing controls (reviews, verification, and validation activities), and managing outputs (meeting input requirements, adequate for subsequent processes, including monitoring and measurement criteria, specifying product/service characteristics).
What you need: Design and development plans, input records, review records, verification records, validation records, output documentation, change records.
If your organization does not design products or services (for example, you manufacture to customer specifications or resell products), you can determine that Clause 8.3 is not applicable. However, this must be justified in your scope documentation and cannot affect your ability or responsibility to ensure conformity of products and services.
8.4 Control of Externally Provided Processes, Products, and Services
What it means: Ensure that externally provided processes, products, and services conform to requirements. This applies to products and services from suppliers, outsourced processes, and products or services provided directly to customers on your behalf.
Determine and apply criteria for the evaluation, selection, monitoring of performance, and re-evaluation of external providers. Define the controls you will apply to external providers and their outputs.
What you need: Supplier evaluation criteria and records, approved supplier list, purchase order procedures, incoming inspection or verification processes, supplier performance monitoring records.
8.5 Production and Service Provision
8.5.1 Control of Production and Service Provision: Implement production and service provision under controlled conditions, including availability of documented information defining product/service characteristics and activities, availability of monitoring and measuring resources, implementation of monitoring and measurement activities, use of suitable infrastructure and environment, appointment of competent persons, validation and revalidation of processes where output cannot be verified by subsequent monitoring, and implementation of actions to prevent human error.
8.5.2 Identification and Traceability: Use suitable means to identify outputs and the status of outputs with respect to monitoring and measurement requirements. Control unique identification when traceability is a requirement.
8.5.3 Property Belonging to Customers or External Providers: Exercise care with property belonging to customers or external providers while under your control. Identify, verify, protect, and safeguard this property. Report to the owner if property is lost, damaged, or found unsuitable.
8.5.4 Preservation: Preserve outputs during production and service provision to the extent necessary to ensure conformity to requirements (including identification, handling, contamination control, packaging, storage, transmission, transportation, and protection).
8.5.5 Post-Delivery Activities: Meet requirements for post-delivery activities, considering statutory and regulatory requirements, potential undesired consequences, nature and intended lifetime of products, customer requirements, and customer feedback.
8.5.6 Control of Changes: Review and control changes for production or service provision to ensure continuing conformity with requirements. Retain documented information describing the results of the review, the persons authorizing the change, and any necessary actions.
8.6 Release of Products and Services
What it means: Implement planned arrangements at appropriate stages to verify that product and service requirements have been met. Release to the customer must not proceed until planned arrangements are satisfactorily completed, unless otherwise approved by a relevant authority and, where applicable, by the customer.
What you need: Inspection and test records, release authorization records, traceability to the person(s) authorizing release.
8.7 Control of Nonconforming Outputs
What it means: Ensure that outputs not conforming to requirements are identified and controlled to prevent unintended use or delivery. Take appropriate action based on the nature of the nonconformity and its effect - correction, segregation, containment, return or suspension, informing the customer, or obtaining authorization for acceptance under concession.
What you need: Nonconforming product/service procedures, nonconformity records describing the nonconformity, actions taken, concessions obtained, and the authority deciding the action.
Clause 9: Performance Evaluation
Measuring, analyzing, and reviewing QMS effectiveness
9.1 Monitoring, Measurement, Analysis, and Evaluation
9.1.1 General: Determine what needs to be monitored and measured, the methods for monitoring and measurement, when monitoring and measuring shall be performed, and when results shall be analyzed and evaluated. Evaluate QMS performance and effectiveness.
9.1.2 Customer Satisfaction: Monitor customers' perceptions of the degree to which their needs and expectations have been fulfilled. Determine the methods for obtaining, monitoring, and reviewing this information. Examples include customer surveys, feedback on delivered products and services, meetings with customers, market share analysis, compliments, warranty claims, and dealer reports.
9.1.3 Analysis and Evaluation: Analyze and evaluate appropriate data and information from monitoring and measurement. Results shall be used to evaluate conformity of products and services, the degree of customer satisfaction, QMS performance and effectiveness, whether planning has been implemented effectively, the effectiveness of actions to address risks and opportunities, external provider performance, and the need for improvements to the QMS.
What you need: KPIs and metrics, customer satisfaction measurement methods and results, data analysis reports, trend analysis, performance dashboards.
9.2 Internal Audit
What it means: Conduct internal audits at planned intervals to verify the QMS conforms to your own requirements and ISO 9001 requirements, and that it is effectively implemented and maintained. Plan an audit programme considering the importance of processes, changes affecting the organization, and previous audit results. Define audit criteria and scope for each audit, select objective and impartial auditors, and ensure results are reported to relevant management.
What you need: Internal audit programme, individual audit plans, audit reports, auditor qualification records, evidence that corrective actions are taken for audit findings without undue delay.
9.3 Management Review
What it means: Top management must review the QMS at planned intervals to ensure its continuing suitability, adequacy, effectiveness, and alignment with strategic direction.
Required inputs include:
- Status of actions from previous management reviews
- Changes in external and internal issues relevant to the QMS
- QMS performance and effectiveness information (customer satisfaction, quality objectives, process performance, nonconformities and corrective actions, monitoring and measurement results, audit results, external provider performance)
- Adequacy of resources
- Effectiveness of actions to address risks and opportunities
- Opportunities for improvement
Required outputs include: Decisions and actions related to opportunities for improvement, any need for changes to the QMS, and resource needs.
What you need: Management review agendas covering all required inputs, meeting minutes documenting discussions and decisions, action items with assigned owners and deadlines, evidence of action follow-up.
Clause 10: Improvement
Getting better over time
10.1 General
What it means: Determine and select opportunities for improvement and implement necessary actions to meet customer requirements and enhance customer satisfaction. This includes improving products and services to meet requirements and address future needs and expectations, correcting, preventing, or reducing undesired effects, and improving QMS performance and effectiveness.
10.2 Nonconformity and Corrective Action
What it means: When a nonconformity occurs (including those arising from complaints), react to control and correct it, deal with the consequences, evaluate the need for action to eliminate the root cause so it does not recur or occur elsewhere, implement any action needed, review the effectiveness of any corrective action taken, and update risks and opportunities determined during planning if necessary. Make changes to the QMS if needed.
What you need: Nonconformity and corrective action procedure, NC records with root cause analysis, documented corrective actions with effectiveness reviews, evidence that the scope of investigation considers whether similar nonconformities exist or could potentially occur.
10.3 Continual Improvement
What it means: Continually improve the suitability, adequacy, and effectiveness of the QMS. Consider the results of analysis and evaluation, and the outputs from management review, to determine if there are needs or opportunities that shall be addressed as part of continual improvement.
What you need: Evidence of improvement activities beyond corrective action - process optimization, innovation, benchmarking, lessons learned, technology upgrades, improvement projects. Trend data showing improvement over time.
ISO 9001 tells you what to achieve, not how to achieve it. The standard provides requirements, but the implementation approach is flexible and should be proportionate to your organization's size, complexity, and risk profile. A 20-person company and a 20,000-person company can both be certified - the depth and formality of their QMS will differ significantly, and that is by design.
The most effective Quality Management Systems are those that are genuinely integrated into daily operations rather than maintained as a separate bureaucratic exercise. When quality becomes how you work - not extra work - the benefits of ISO 9001 are fully realized.
Frequently Asked Questions
What are the main clauses of ISO 9001?
ISO 9001:2015 has seven mandatory requirement clauses: Clause 4 (Context of the Organization), Clause 5 (Leadership), Clause 6 (Planning), Clause 7 (Support), Clause 8 (Operation), Clause 9 (Performance Evaluation), and Clause 10 (Improvement). Clauses 1-3 cover scope, normative references, and terms and definitions - these are informational and not auditable.
Which ISO 9001 clause is most important?
Clause 8 (Operation) contains the most detailed requirements, covering the entire product and service lifecycle from customer requirements through delivery and post-delivery. However, Clause 5 (Leadership) is arguably the most critical because top management commitment and direction drives the effectiveness of everything else in the QMS. Without genuine leadership engagement, even well-designed processes will underperform.
What does risk-based thinking mean in ISO 9001?
Risk-based thinking means integrating risk considerations into your processes without requiring a formal risk management methodology like ISO 31000 or a mandatory risk register. It replaces the previous "preventive action" requirement from ISO 9001:2008 and encourages organizations to proactively consider what could go wrong and what opportunities exist within each process. The approach and depth should be proportionate to your organization's complexity and risk profile.
Is a quality manual required by ISO 9001:2015?
No, ISO 9001:2015 does not require a quality manual. This was a deliberate change from the 2008 version, which explicitly mandated one. However, many organizations choose to maintain a quality manual because it serves as a useful reference document for employees and auditors, aids onboarding of new staff, and demonstrates organizational maturity to clients and stakeholders.
How does ISO 9001:2015 differ from ISO 9001:2008?
The key differences include: adoption of the Annex SL high-level structure shared by all ISO management system standards; introduction of risk-based thinking replacing the standalone preventive action clause; removal of the mandatory quality manual and six required procedures; replacement of separate "documents" and "records" terminology with unified "documented information"; greater emphasis on leadership involvement and organizational context; and a more flexible approach to documentation that focuses on effectiveness rather than prescriptive requirements.