ISO 9001:2015 Key Requirements & Clauses

ISO 9001:2015 Clause Structure

ISO 9001:2015 follows the High-Level Structure (HLS) common to all ISO management system standards. This makes integration with other standards (like ISO 14001, ISO 45001) much easier.

Clause Overview

Clause 4: Context of the Organization

4.1 Understanding the Organization and its Context

Requirement: Determine external and internal issues relevant to your purpose and strategic direction.

What you need to do:

• Identify internal factors (strengths, weaknesses, culture, capabilities)
• Identify external factors (market conditions, regulations, competition, technology)
• Review and update regularly

Examples of Issues:

4.2 Understanding the Needs and Expectations of Interested Parties

Requirement: Determine relevant interested parties and their requirements.

Interested Parties include:

• ✅ Customers (primary)
• ✅ Employees
• ✅ Suppliers
• ✅ Regulators
• ✅ Shareholders/owners
• ✅ Community

What you need to do:

• List all interested parties
• Determine their requirements
• Monitor and review their needs

4.3 Determining the Scope of the QMS

Requirement: Define the boundaries and applicability of your QMS.

Must consider:

• External and internal issues (4.1)
• Interested party requirements (4.2)
• Products and services provided
• Physical locations
• Functions and processes

Output: Documented scope statement

4.4 Quality Management System and its Processes

Requirement: Establish, implement, maintain, and continually improve your QMS, including processes and their interactions.

Process Requirements:

For each process, determine:

1. Required inputs and expected outputs
2. Sequence and interaction
3. Criteria, methods, and controls
4. Resources needed
5. Responsibilities and authorities
6. Risks and opportunities
7. Monitoring and measurement methods
8. Improvement opportunities

Clause 5: Leadership

5.1 Leadership and Commitment

5.1.1 General

Requirement: Top management must demonstrate leadership and commitment.

How to demonstrate:

• ✅ Take accountability for QMS effectiveness
• ✅ Ensure quality policy and objectives are established
• ✅ Integrate QMS into business processes
• ✅ Promote process approach and risk-based thinking
• ✅ Ensure resources are available
• ✅ Communicate importance of effective QMS
• ✅ Support continuous improvement

5.1.2 Customer Focus

Requirement: Top management ensures customer requirements and applicable regulations are determined and met.

Actions required:

• Determine customer requirements
• Address risks and opportunities affecting product/service conformity
• Focus on enhancing customer satisfaction

5.2 Policy

5.2.1 Establishing the Quality Policy

Requirements for Quality Policy:

• ✅ Appropriate to purpose and context
• ✅ Framework for quality objectives
• ✅ Commitment to meet requirements
• ✅ Commitment to continual improvement

5.2.2 Communicating the Quality Policy

Requirement: Quality policy must be:

• Available and maintained as documented information
• Communicated within the organization
• Available to interested parties (as appropriate)

5.3 Organizational Roles, Responsibilities, and Authorities

Requirement: Top management must assign and communicate responsibilities and authorities.

Key roles to define:

• QMS conformity to ISO 9001
• Process performance and outputs
• Reporting on QMS performance
• Customer focus promotion
• QMS integrity during changes

Note: No requirement for a “Management Representative” (though you can still have one)

Clause 6: Planning

6.1 Actions to Address Risks and Opportunities

Requirement: Determine risks and opportunities that need to be addressed to:

• Ensure QMS achieves intended results
• Enhance desirable effects
• Prevent or reduce undesired effects
• Achieve improvement

What you need to do:

1. Plan actions to address risks/opportunities
2. Integrate actions into QMS processes
3. Evaluate effectiveness of actions

Documentation: Not mandatory, but recommended

6.2 Quality Objectives and Planning to Achieve Them

6.2.1 Quality Objectives

Requirements:

• ✅ Consistent with quality policy
• ✅ Measurable
• ✅ Consider applicable requirements
• ✅ Relevant to product/service conformity
• ✅ Monitored
• ✅ Communicated
• ✅ Updated as appropriate

Must be established at relevant functions, levels, and processes

SMART Objectives:

• Specific
• Measurable
• Achievable
• Relevant
• Time-bound

6.2.2 Planning Actions

For each objective, determine:

• What will be done
• What resources will be required
• Who will be responsible
• When it will be completed
• How results will be evaluated

6.3 Planning of Changes

Requirement: When changes to QMS are needed, they must be planned and systematic.

Consider:

• Purpose and potential consequences
• QMS integrity
• Resource availability
• Allocation of responsibilities and authorities

Clause 7: Support

7.1 Resources

Required Resources:

7.1.1 General

Provide resources for:

• Establishment, implementation, maintenance, and improvement of QMS

7.1.2 People

Provide competent people for:

• Effective operation of QMS

7.1.3 Infrastructure

Determine and provide infrastructure:

• Buildings, equipment, and utilities
• Transportation
• Information and communication technology

7.1.4 Environment for Operation of Processes

Suitable environment including:

• Social (non-discriminatory, calm)
• Psychological (stress-reducing)
• Physical (temperature, humidity, light, hygiene)

7.1.5 Monitoring and Measuring Resources

Ensure resources are:

• Suitable for monitoring/measurement activities
• Maintained
• Records of calibration/verification kept

7.1.6 Organizational Knowledge

Determine knowledge needed:

• Operation of processes
• Conformity of products/services -Maintained and made available

Sources: Internal experience, lessons learned, external sources

7.2 Competence

Requirement: Determine, ensure, and maintain competence of personnel.

Actions:

1. Determine necessary competence
2. Ensure personnel are competent
3. Take actions to acquire competence (training, mentoring, reassignment)
4. Evaluate effectiveness of actions
5. Retain documented information as evidence

7.3 Awareness

Requirement: Ensure personnel are aware of:

• Quality policy
• Relevant quality objectives
• Their contribution to QMS effectiveness
• Implications of not conforming

7.4 Communication

Requirement: Determine internal and external communications including:

• What to communicate
• When to communicate
• With whom to communicate
• How to communicate
• Who communicates

7.5 Documented Information

7.5.1 General

Required documented information:

• Required by ISO 9001
• Determined by organization as necessary

Flexibility: No specific procedures or manuals required

7.5.2 Creating and Updating

When creating, ensure:

• Identification and description
• Format and media
• Review and approval

7.5.3 Control of Documented Information

Must be controlled to ensure:

• Available where needed
• Adequately protected
• Identified and controlled for distribution, access, retrieval, use
• Retention and preservation
• Control of changes
• Retention and disposition

Clause 8: Operation

8.1 Operational Planning and Control

Requirement: Plan, implement, and control processes needed to meet requirements.

Determine:

• Requirements for products/services
• Criteria for processes and acceptance
• Resources needed
• Control of processes
• Documented information retention

8.2 Requirements for Products and Services

8.2.1 Customer Communication

Communicate with customers regarding:

• Product/service information
• Inquiries, contracts, orders
• Customer feedback
• Customer property
• Contingency actions

8.2.2 Determining Requirements

Determine:

• Customer-specified requirements
• Requirements not stated but necessary
• Statutory and regulatory
• Organization’s own requirements

8.2.3 Review of Requirements

Review before commitment to ensure:

• Requirements are defined
• Contract/order differences are resolved
• Organization can meet requirements

8.2.4 Changes to Requirements

Ensure relevant documented information is amended when requirements change.

8.3 Design and Development (if applicable)

Note: Only if you design your own products/services

Stages:

1. Planning (8.3.2)
2. Inputs (8.3.3)
3. Controls (8.3.4)
4. Outputs (8.3.5)
5. Changes (8.3.6)

8.4 Control of Externally Provided Processes, Products and Services

8.4.1 General

Ensure external providers are controlled when:

• Part of products/services
• Provided directly to customer
• Result of organization’s decision

Types: Purchase, outsourcing

8.4.2 Type and Extent of Control

Determine required controls and verification based on:

• Potential impact
• Effectiveness of controls by external provider

8.4.3 Information for External Providers

Communicate requirements including:

• Processes, products, services to be provided
• Approval of products, methods, processes, equipment
• Competence of persons
• Interactions
• Control and monitoring
• Verification at premises

8.5 Production and Service Provision

8.5.1 Control

Implement under controlled conditions:

• Documented information
• Suitable monitoring/measuring resources
• Competent persons
• Validation and revalidation
• Prevention of human error
• Release, delivery, post-delivery activities

8.5.2 Identification and Traceability

Identify outputs throughout production/service provision.

8.5.3 Property Belonging to Customers or External Providers

Exercise care with property while under your control or being used.

8.5.4 Preservation

Preserve outputs during production/service provision as required.

8.5.5 Post-delivery Activities

Meet requirements for post-delivery (warranty, maintenance, recycling, disposal).

8.5.6 Control of Changes

Review and control changes to production/service provision.

8.6 Release of Products and Services

Implement arrangements to verify requirements are met before release.

Retain documented information:

• Evidence of conformity
• Traceability to authorization authority

8.7 Control of Nonconforming Outputs

When nonconformity detected:

Take action such as:

• Correction
• Segregation, containment, return
• Customer information
• Authorization for use/release/acceptance under concession

Verify conformity when corrected.

Clause 9: Performance Evaluation

9.1 Monitoring, Measurement, Analysis and Evaluation

9.1.1 General

Determine:

• What to monitor/measure
• Methods for valid results
• When to perform
• When to analyze/evaluate

Retain documented information as evidence.

9.1.2 Customer Satisfaction

Monitor customer perceptions including:

• Surveys
• Feedback
• Complaints
• Market share
• Compliments
• Warranty claims

9.1.3 Analysis and Evaluation

Analyze data to evaluate:

• Product/service conformity
• Customer satisfaction degree
• QMS performance and effectiveness
• Planning effectiveness
• Risk/opportunity actions effectiveness
• External provider performance
• QMS improvement needs

9.2 Internal Audit

Requirement: Conduct internal audits at planned intervals.

Audit:

• QMS conformity to own requirements and ISO 9001
• Effective implementation and maintenance

Program must:

• Define frequency, methods, responsibilities, requirements, reporting
• Consider importance of processes, changes, previous results
• Select objective and impartial auditors
• Ensure results reported to relevant management
• Take correction and corrective action
• Retain documented information

9.3 Management Review

Requirement: Top management reviews QMS at planned intervals.

Inputs:

• Changes in external/internal issues
• Customer satisfaction and feedback
• QMS performance (objectives, processes, products/services, nonconformities, monitoring/measurement, audits, external provider performance)
• Resource adequacy
• Risk/opportunity actions effectiveness
• Improvement opportunities

Outputs:

• Improvement opportunities
• QMS change needs
• Resource needs

Retain documented information as evidence.

Clause 10: Improvement

10.1 General

Requirement: Determine and select improvement opportunities.

Actions:

• Improve products/services
• Correct, prevent, reduce undesired effects
• Improve QMS performance and effectiveness

10.2 Nonconformity and Corrective Action

When nonconformity occurs:

1. React: Take action, deal with consequences
2. Evaluate: Determine if similar nonconformities exist/could occur
3. Implement: Take corrective action
4. Review: Effectiveness of corrective action
5. Update: Risks and opportunities if needed
6. Change: QMS if necessary

Retain documented information:

• Nature of nonconformities
• Actions taken
• Results of corrective action

10.3 Continual Improvement

Requirement: Continually improve suitability, adequacy, and effectiveness of QMS.

Consider results of:

• Analysis and evaluation
• Management review

Next Steps

1. Understand Context → Implementation Roadmap
2. Map Your Processes → Process Approach Guide
3. Download Templates → ISO 9001 Templates
4. Prepare for Audit → Audit Checklist

Quick Reference: Mandatory Documents