ISO 9001:2015 has ten clauses. Clauses 1 to 3 cover scope, normative references and terms, and contain no requirements you are audited against; clauses 4 to 10 contain the requirements, covering context, leadership, planning, support, operation, performance evaluation and improvement.
If you are implementing a quality management system (QMS), preparing for certification or joining an internal audit team, knowing what each clause asks for, and what evidence satisfies it, saves a great deal of rework.
How the standard is structured
ISO 9001:2015 follows the common structure set out in Annex SL of the ISO/IEC Directives, originally called the high-level structure and now the harmonised structure. The same ten-clause skeleton is used by ISO 14001 (environment), ISO 45001 (occupational health and safety) and ISO 22000:2018 (food safety), which makes integrated management systems much easier.
The standard is also built around the Plan-Do-Check-Act (PDCA) cycle and risk-based thinking. The introduction of ISO 9001:2015 maps the clauses to PDCA as follows:
| PDCA stage | ISO 9001 clauses |
|---|---|
| Plan | 6 Planning, informed by 4 Context and 5 Leadership |
| Do | 7 Support and 8 Operation |
| Check | 9 Performance evaluation |
| Act | 10 Improvement |
| At the centre | 5 Leadership |
In 2024, ISO published Amendment 1, which added a requirement in clause 4.1 to determine whether climate change is a relevant issue, and a related note in 4.2. Certification audits now include this.
The clauses in plain English
Clause 4: Context of the organisation
Understand the internal and external issues that affect your ability to deliver quality, identify interested parties and their relevant requirements, define the scope of the QMS and set up the processes needed, with their inputs, outputs, criteria, owners and risks. Any requirement you consider not applicable must be justified in the scope.
Clause 5: Leadership
Top management must take accountability for the QMS, not delegate it entirely to a quality manager. That means setting a quality policy, ensuring customer focus, integrating the QMS into business processes and assigning clear roles, responsibilities and authorities.
Clause 6: Planning
Determine risks and opportunities and plan actions to address them, set measurable quality objectives with plans to achieve them, and plan changes to the QMS in a controlled way.
Clause 7: Support
Provide the resources the QMS needs: people, infrastructure, a suitable work environment, monitoring and measuring resources (including calibration where needed) and organisational knowledge. Ensure people are competent and aware, plan communication, and control documented information.
Clause 8: Operation
The largest clause, covering how you deliver products and services: operational planning, determining and reviewing customer requirements, design and development, control of external providers, controlled production or service provision, release, and control of nonconforming outputs.
Clause 9: Performance evaluation
Monitor and measure what matters, including customer satisfaction, analyse the data, run internal audits to a planned programme and hold management reviews with defined inputs and outputs.
Clause 10: Improvement
React to nonconformities, correct them, find the cause, take corrective action and check that it worked. Continually improve the suitability, adequacy and effectiveness of the QMS.
What auditors ask for, clause by clause
| Clause | Requirement in plain English | Evidence auditors typically ask for |
|---|---|---|
| 4 Context | Know your issues, stakeholders, scope and processes | Context and interested-party analysis, scope statement with justified exclusions, process map |
| 5 Leadership | Management owns quality and sets direction | Quality policy, organisation chart, role descriptions, evidence of management involvement |
| 6 Planning | Plan for risks, objectives and changes | Risk and opportunity register, quality objectives with targets and owners, change records |
| 7 Support | Provide people, tools, knowledge and control documents | Training and competence records, calibration records, document control system |
| 8 Operation | Deliver to requirements and control what goes wrong | Contract or order review, design records, supplier evaluations, work instructions, release records, nonconforming output log |
| 9 Performance evaluation | Measure, audit and review | KPI data, customer feedback analysis, audit programme and reports, management review minutes |
| 10 Improvement | Fix problems at the root and keep improving | Nonconformity and corrective action records, evidence of effectiveness checks, improvement projects |
ISO 9001:2015 uses the term documented information. Where it says maintain, think procedures and documents; where it says retain, think records. Beyond the scope, quality policy and quality objectives, the standard leaves you to decide how much documentation your processes need.
A new edition is on the way
A revision of ISO 9001 has been in development, with a new edition expected around 2026. Before you plan an implementation or certification audit, check the current edition on the ISO website and confirm transition arrangements with your certification body.
Worked example: a training institute in Kochi
A professional training institute in Kochi delivers classroom and online short courses in laboratory and food safety topics and decides to implement ISO 9001.
- Clause 4: issues include competition from online providers, dependence on a learning management system (LMS) and changing learner expectations. Interested parties are learners, employers, freelance trainers, awarding bodies and regulators. The scope covers design, delivery and assessment of short courses. Design is not excluded, because the institute writes its own courses.
- Clause 5: the director chairs a monthly quality meeting and signs the quality policy, which commits to accurate content and fair assessment.
- Clause 6: a key risk is an LMS outage during an assessment; the action is a tested backup arrangement. Objectives include learner satisfaction and the time taken to issue results.
- Clause 7: trainer competence is defined by subject qualification and teaching experience, with records for every trainer. Course materials are version-controlled.
- Clause 8: course design follows 8.3 with planned reviews by a subject expert and a pilot session. Freelance trainers and the LMS provider are controlled as external providers under 8.4.
- Clause 9: learner feedback, pass rates and complaint data are analysed each quarter. Internal auditors from another department audit each process once a year.
- Clause 10: when a certificate was issued with a misspelt learner name, the institute corrected it, traced the cause to manual data entry and added a learner-confirmation step before printing.
Common mistakes
- Writing a manual first. Start with your real processes; documents should describe how you work, not a template.
- Excluding design and development without thinking. If you create products, services or courses, 8.3 probably applies.
- Leaving leadership to the quality manager. Auditors interview top management and expect them to explain the policy and objectives.
- Objectives that cannot be measured. "Improve quality" is not an objective; add a measure, target, owner and date.
- Risk registers nobody uses. Risks should drive actions and be reviewed, not filed.
- Corrective action without effectiveness checks. Closing a nonconformity is not the same as preventing recurrence.
Key takeaway: Clauses 4 to 10 of ISO 9001 follow a simple logic: understand your context, lead, plan, resource, deliver, measure and improve. Build the system around how your organisation really works, then keep the evidence that shows it.
Frequently Asked Questions
Which clauses of ISO 9001 are auditable?
Clauses 4 to 10 contain the requirements and are audited. Clause 1 describes the scope of the standard, clause 2 lists normative references and clause 3 points to the terms and definitions in ISO 9000:2015. These clauses contain no requirements for your QMS, so auditors do not raise findings against them.
Can you exclude clauses from ISO 9001?
ISO 9001:2015 does not allow whole clauses to be excluded, but a requirement can be determined not applicable if it does not affect your ability to ensure conformity of products and services or customer satisfaction. You must state and justify this in your QMS scope. Design and development under 8.3 is the most common example.
What documents are mandatory in ISO 9001?
ISO 9001:2015 requires documented information for the QMS scope, the quality policy and quality objectives, plus records such as competence evidence, calibration where applicable, supplier evaluations, nonconforming outputs, monitoring results, internal audits, management reviews and corrective actions. Beyond that, the organisation decides what documentation it needs for effective operation of its processes.
Is there a new version of ISO 9001?
A revision of ISO 9001 has been in development, with a new edition expected around 2026. When it is published, certified organisations will have a transition period to update their systems. Check the current edition and status on the ISO website, and confirm transition dates and audit arrangements with your certification body.
Next steps
If you are implementing or maintaining a QMS, ISO 9001 Essentials: Quality Management Systems and Practical Implementation takes you through the requirements with practical tools. To audit the system yourself, Internal Auditing and Audit Readiness Essentials builds the skills. Both are offered online to learners in India and the GCC.
Read next: ISO 9001 quality management checklist, Risk-based thinking in ISO 9001 and Management review meeting: QMS agenda. Need help choosing a course? Speak to a counsellor.
Looking for structured certification?
Explore Innoryx courses or speak to a counsellor about the right program for you.