ISO 9001 requirements, clause by clause

ISO 9001:2015 is the world's leading standard for quality management systems (QMS). It describes what a QMS must achieve so that you consistently deliver products and services that meet customer requirements and regulatory obligations.

The standard follows the high level structure used by many ISO standards. Clauses 1 to 3 cover scope, references and terms. The actual requirements are in clauses 4 to 10. The standard tells you what to achieve. It does not prescribe how your business must look.

Behind all clauses stand seven quality management principles:

Customer focus

Understand what customers need and aim to meet it reliably.

Leadership

Management sets direction and takes responsibility for the system.

Engagement of people

Competent and motivated people deliver quality every day.

Process approach

Activities are managed as connected processes, not as isolated tasks.

Improvement

The organisation keeps getting better, step by step.

Evidence-based decision making

Decisions rest on data and observation, not on assumption.

Relationship management

Suppliers and other partners are managed as part of your quality.

• ISO 9001 at a glance

These three clauses set the frame. They ask you to know your business, to take ownership at the top and to plan before you act.

Clause 4, Context of the organisation

Understand the issues that affect your business and the needs of interested parties such as customers, authorities and staff. Define the scope of your QMS and the processes it contains. Typically documented: the scope statement and a process overview.

Clause 5, Leadership

Management shows commitment, focuses on customers, defines a quality policy and assigns roles and responsibilities. Typically documented: the quality policy and an organisation chart or role descriptions.

Clause 6, Planning

Identify risks and opportunities, set measurable quality objectives and plan how to reach them. Plan changes to the system in a controlled way. Typically documented: a risk and opportunity list and the quality objectives with owners and deadlines.

These clauses cover the daily work: what you need to deliver, how you deliver it, how you check it and how you improve.

Clause 7, Support

Provide the people, infrastructure, environment and knowledge you need. Make sure staff are competent and aware of the policy. Define how you communicate and control documented information. Typically documented: training and competence records, and calibration records where you measure.

Clause 8, Operation

Plan and control how you deliver. This includes customer requirements, design and development where relevant, externally provided products and services, production or service delivery, release and the handling of nonconforming outputs. Typically documented: order or contract reviews, supplier evaluations and records of checks before release.

Clause 9, Performance evaluation

Monitor and measure results, including customer satisfaction. Carry out internal audits and hold management reviews. Typically documented: audit results, customer feedback and management review minutes.

Clause 10, Improvement

Deal with nonconformities, correct their causes and improve the system continually. Typically documented: a log of nonconformities with the actions taken.

ISO 9001:2015 speaks of documented information. It no longer requires a quality manual by name. You decide how much documentation your business needs, but some items are expected. The table shows common examples.

Keep documents short and in use. A one-page policy that your team knows is worth more than a thick manual nobody reads.

The requirements are the same for every organisation, but you apply them in proportion. A trades business with ten people will run fewer processes and keep fewer records than a manufacturer with several sites.

A practical start is to write down what you already do. Most businesses find that much of clauses 7 to 10 exists in some form: checklists, order forms, supplier notes, complaint handling. The work is to make it consistent, visible and measurable.

ISO 9001 suits manufacturing companies, service companies, trades and craft businesses, IT and software companies, consulting firms and public institutions.

• ISO for small and medium businesses
• Overview of all standards

Zertify gives you a quick way to check how your business measures up against the ISO 9001 requirements. You complete an online self-assessment of 30 yes/no questions. If you reach 20 of 30, you can pay and receive your certificate within 4 hours after passing and payment.

The certificate is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before the certificate is issued. It is based on your self-assessment, with no on-site audit. Every certificate can be verified publicly on zertify.ch by number and QR code.

The price is CHF 599 (€599) in the first year, then CHF 399 (€399) per year including the short online re-audit. The certificate is valid for 3 years and is confirmed every year. It is a yearly subscription that you can cancel at any time for the end of the year. If you prefer the classic route with an on-site audit by a certification body, the guide on certification routes helps you compare.

• Start the free self-assessment
• See pricing
• Compare the certification routes