Practical guide · Quality management
ISO 9001 in plain language: what each clause asks for and what an auditor looks at
Short answer
ISO 9001 is the international standard that sets out the requirements for a quality management system: how an organization plans its work, controls its processes, checks results and improves. It is published by the International Organization for Standardization (ISO), and an organization can follow it without being certified.
ISO 9001 does not say how to make your product. It asks that you know what your customers and rules require, plan and control the work to meet that, check that it did, and fix the cause when it did not. The requirements sit in clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement. Certification is optional and is done by an outside certification body that audits you against the standard. Many plants follow ISO 9001 because a customer asks for it, and some use it as a frame for their quality system without certifying. The clause titles below are those of ISO 9001:2015, so check the edition your certification body audits against.
Last reviewed:
What is ISO 9001, and who is it for?
ISO 9001 belongs to the ISO 9000 family. It applies to any organization, whatever it makes or sells, because it asks about the system around the work, not the work itself. A machine shop, a food plant and a software team can all use it. Specific industries add their own standards on top, such as IATF 16949 for automotive and AS9100 for aerospace, and both are built on the ISO 9001 frame.
Two words get mixed up. Conforming means you meet the requirements of the standard. Certified means an accredited outside body audited you and issued a certificate. The standard does not require certification, so a plant can conform without a certificate. A customer contract or a tender is the usual reason to certify, and the certificate then has to be renewed through audits by that body.
ISO 9001:2015 does not ask for a quality manual by that name or a fixed list of procedures. It names the documented information it needs in specific clauses, and leaves the rest to you. The standard is sold by ISO and national bodies, so buy the edition your auditor uses and read the clauses themselves. This page explains them in plain words and does not replace the text.
Which edition applies now: ISO 9001:2026 or 2015?
ISO 9001:2026 was published on 16 September 2026 and replaces ISO 9001:2015 as the current edition. ISO's technical committee for the standard (ISO/TC 176/SC 2) says the revision aims for clearer wording, a stronger focus on leadership, quality culture and accountability, and clearer treatment of risks and opportunities. It also adds a new Annex A that explains key terms and the intent of the requirements.
A certificate to ISO 9001:2015 does not stop working on publication day. The committee's transition guidance gives these dates: accreditation bodies must be ready to assess to the 2026 edition by 31 March 2027, new and initial accredited certifications may only be issued to ISO 9001:2026 from 31 March 2028, and organisations already certified to ISO 9001:2015 have until 30 September 2029 to move over. The move can happen at a surveillance or recertification audit, or in a separate transition audit.
The clause walk below uses the ISO 9001:2015 numbering and titles, because that is the text this page was checked against. The standard is paid, so clause numbers in the 2026 edition were not checked here. Before you rely on a number, buy the edition your certification body audits to, and ask that body in writing which edition and which transition date apply to you.
What changed, a worked timeline and a 12 month plan: see ISO 9001:2026.
ISO 9001 clauses 4 to 10 in plain words
Clauses 1 to 3 cover scope, references and terms. The requirements are clauses 4 to 10, and they follow the plan, do, check, act cycle: 4 to 6 plan, 7 and 8 do, 9 checks and 10 acts. Titles and numbers below are from ISO 9001:2015.
| Clause | Plain meaning | What an auditor looks at |
|---|---|---|
| 4 Context of the organization | Know who and what affects your quality system, and set its scope and processes (4.1 to 4.4). | The written scope, a list of interested parties and their needs, a process map |
| 5 Leadership | Top management owns the system. A quality policy, and named roles and authorities (5.1 to 5.3). | The posted policy, who is accountable for what, whether managers can describe the policy |
| 6 Planning | Decide the risks and opportunities to act on, set quality objectives, plan changes before making them (6.1 to 6.3). | Objectives with owners and measures, a risk record, how a change was planned |
| 7 Support | Resources, competent people, awareness, communication, and documented information (7.1 to 7.5). | Training and competence records, calibration of measuring equipment, document control |
| 8 Operation | Plan and control the work: customer requirements, design, suppliers, production, release and nonconforming output (8.1 to 8.7). | A job followed from order to shipment: work instructions, inspection records, supplier approval, held product |
| 9 Performance evaluation | Measure and analyse, audit yourself, review as management (9.1 to 9.3). | Customer satisfaction and quality data, the internal audit programme, minutes of the management review |
| 10 Improvement | Handle nonconformities, take corrective action and keep improving (10.1 to 10.3). | A closed corrective action: cause found, fix made, effectiveness checked |
Clause 8 is where most of a plant's day-to-day control sits. In 8.7, nonconforming output is identified and controlled so it is not used or delivered by mistake. Subclause numbers can change between editions, so match them to the edition you audit against.
Risk-based thinking runs through the 2015 text instead of sitting in one preventive action clause. A simple way to meet clause 6.1 in a plant is an FMEA for the process and a risk register for the rest. See FMEA and risk assessment.
Documented information: what you must keep
Clause 7.5 covers documented information. It has three parts: what you create and update, how you identify and format it, and how you control it so the right version is available where it is used and old versions do not leak into use. Other clauses name particular records, such as evidence of competence in 7.2, the results of internal audits in 9.2, management review outputs in 9.3 and the nature of nonconformities and actions in 10.2.
- A work instruction is a document. Keep the current version at the point of use and remove the old one. See SOP format and meaning.
- An inspection result is a record. Keep it as long as your customer and your own rules say, and keep it readable.
- A training sign-off is evidence for clause 7.2 only if it shows the person can do the job, so a matrix with dates beats a sign-in sheet. See the training matrix template.
- A corrective action closed with no effectiveness check is incomplete. See CAPA.
Internal audit and management review, clauses 9.2 and 9.3
Clause 9.2 asks for internal audits at planned intervals to check that the system meets your own requirements and the standard, and that it is implemented and maintained. The audits follow a programme that takes account of the importance of the processes and the results of earlier audits. Auditors should be objective, so they do not audit their own work. Findings go to the people responsible, and the action is taken without undue delay.
Clause 9.3 is the management review: top management looks at the system at planned intervals, using inputs such as audit results, customer feedback, process performance and the status of actions, and records decisions about improvement, change and resources. Use the internal audit checklist and the management review kit to run both.
| Group | Processes | Audits each per year | Audits per year |
|---|---|---|---|
| Higher risk (8.5 production, 8.7 nonconforming output, 8.4 suppliers, 10.2 corrective action) | 4 | 2 | 8 |
| Standard risk (the other processes) | 8 | 1 | 8 |
| Total | 12 | 16 |
Illustrative. 4 x 2 = 8 and 8 x 1 = 8, so 8 + 8 = 16 audits. With 4 trained internal auditors, each takes 16 / 4 = 4 audits a year. Auditors do not audit their own area. Your own risk ranking decides the groups.
A programme like this puts a real audit in front of the processes that fail most. Findings go to a corrective action log or your CAPA record, and the pattern across them is a management review input. See layered process audits for the audits that run on the floor between formal ones.
How to start without a consultant's binder
- 1
Draw the processes
List the 8 to 15 processes that move an order from request to shipment, with an owner for each. This answers most of clause 4.
- 2
Read the clauses against what you do
Mark each requirement as met, partly met or not met, with the evidence. Be honest about the gaps. Our TQM self-assessment can help if you want a structured start.
- 3
Fix the gaps that matter to customers first
Document control, calibration, nonconforming product and corrective action are the usual places. Fix the process, then write down only what people need.
- 4
Run one internal audit and one management review
Do both before any outside audit. They show what the system looks like when it is used.
- 5
Decide on certification
Choose a certification body that is accredited, ask what it audits and how often, and agree the edition and any transition dates in writing.
Common ISO 9001 mistakes
- Writing procedures to copy the standard instead of the work. An auditor checks what people do, not what the binder says.
- Treating the audit as a once-a-year event. Findings should be closed between audits.
- Closing corrective actions with retraining as the only action. Look for the cause in the process.
- A management review that is only a meeting about sales. Clause 9.3 asks for specific inputs and recorded decisions.
- Objectives nobody can measure, or that nobody checks after they are set.
- Uncontrolled copies of work instructions at the machine, so the audit finds two versions.
- Assuming certification means the product is good. It shows the system meets the standard; the product still needs its own checks.
Go deeper
This page is the short version. These guides cover each part in full.
- Standard Work vs SOPs vs Work InstructionsHow the documents an auditor asks for differ and which one belongs at the machine.
- How to Audit Standard Work: A Verification GuideHow to check that the written method is the one in use, the core of a process audit.
- Visual Work Instructions: Effective DocumentationDocumentation that operators use, for clause 7.5 and clause 8.5.
- OSHA Audit Preparation: Reducing 40 Hours to 4 HoursHow keeping records current all year cuts the scramble before any external audit.
All our articles on this subject are in the quality management topic.
Free templates and tools
- Internal audit steps posterThe steps of an internal audit from plan to follow-up, for the quality office wall.
- Quality terms posterPlain definitions of the terms used in quality systems.
- ISO 9001 internal audit checklist (production area)46 audit questions for the production floor in 11 processes, each with its ISO 9001:2015 clause, what evidence to look for and the sample to take, plus five defined grades, a findings log, a finding report and a summary by clause.
- ISO 9001 management review kitA 90-minute agenda, data sheet, minutes and action log for the clause 9.3 review, with an Excel planner that flags the next review due.
- Internal audit schedule templateA year of internal audits planned by risk: the programme, the register, the auditors and the findings.
- Non-conformance report (NCR) formA two-page NCR from the requirement against what was found to disposition and closure, and an Excel NCR log.
- CAPA log templateAn Excel CAPA tracker with status, days open, late flags and counts by source, plus a printable log and monthly review.
- Standard operating procedure (SOP) templateA full SOP in the hierarchical step format, from purpose and scope to the steps, records, revision history and approvals, with review checks and an SOP register.
- Training matrix template with expiry datesPeople by required trainings with expiry dates, OK, due, expired and missing flags, compliance by person and area, cover per training and a renewal list.
- Supplier audit checklistA supplier process audit of 32 questions scored 0 to 3, with section scores, a rating and the findings.
- First pass yield (FPY) calculatorFirst pass yield at each step and rolled throughput yield (RTY) across the whole process.
- Cost of poor quality (COPQ) calculatorTotal COPQ and cost of quality, and each as a share of revenue, from the four quality cost categories.
Doing this in LeanSuite
Audit Management
Build, schedule and run any shop floor audit or inspection, and turn every finding into a tracked action. Walk into any internal or external audit with a time-stamped record of every check and corrective action.
See Audit ManagementCompetency Management
Shows who is qualified for each job, on every shift, with the evidence an auditor asks for: a trainer's observation, a passed quiz, a signed procedure or an outside certificate.
See Competency ManagementSOP management
Every SOP is versioned, routed for approval and signed, with a history of who changed what and when. Whether that meets a specific ISO 9001 clause for your site is for you and your auditor to decide.
See SOP management
See it on your own lines
Bring the problem you are working on to a 45-minute demo. Or look around with sample data first, or pilot LeanSuite on your own lines for 90 days, with the setup done by our team.
FAQ
Questions about iSO 9001
Yes. ISO 9001:2026 was published on 16 September 2026. Organisations certified to ISO 9001:2015 have until 30 September 2029 to transition, and from 31 March 2028 new accredited certifications may only be issued to the 2026 edition. Ask your certification body which date applies to you.
ISO 9001 is the international standard for a quality management system. It asks an organization to know what its customers and rules require, plan and control its work to meet that, check the results, and fix the cause when something goes wrong. It applies to any size and type of organization.
The requirements are in clauses 4 to 10: context of the organization, leadership, planning, support, operation, performance evaluation and improvement. Clauses 1 to 3 cover scope, references and terms. These titles are from ISO 9001:2015, so check the edition your auditor uses.
No. The standard does not require certification. An organization can follow it without a certificate. Customers, tenders or contracts often ask for certification, and an accredited certification body then audits the organization against the standard.
ISO 9001:2015 does not set a fixed list of procedures or require a quality manual by name. It requires documented information where specific clauses ask for it, such as evidence of competence, internal audit results, management review outputs and records of nonconformities and corrective action, plus the documents the organization decides it needs.
ISO 9001 clause 9.2 requires internal audits at planned intervals and does not set a number. The organization sets an audit programme that considers the importance of each process and the results of earlier audits, so higher-risk processes are audited more often.
ISO 9001 is a standard with requirements an auditor can check, and it can be certified. TQM is a management philosophy of company-wide quality, with no certificate. Many plants use TQM thinking to run the system and ISO 9001 to give it a frame.
Related guides and tools
- Total quality management: the wider philosophy, and how TQM, Six Sigma and ISO 9001 differ
- CAPA: the corrective action steps behind clause 10.2
- Non-conformance report: how to record a nonconformity for clause 8.7 and 10.2
- Quality metrics: the measures to bring to the clause 9.1 review
- Layered process audits: the floor-level audits between formal ones
More method guides
- The 6 Ms of production
- Poka-yoke
- Model area 90-day plans
- Moving from Excel to one system
- Reducing machine downtime: a worked month
- Andon
- Cycle time vs lead time, worked through
- Root cause analysis
- How many operators a line needs
- Reducing scrap and rework: a worked month
- Unsafe acts and unsafe conditions
- Just culture
- Stop-work authority
- Material review board (MRB)
- Nonconformance and NCRs
- Problem solving methods
- Quad chart
- OEE calculation
- Quality assurance vs quality control
- SOP meaning and format
- Job hazard analysis
- Near miss reporting
- Fishbone diagram
- Pareto chart
- Histogram
- Control chart
- What is a gemba walk
- What is lead time
- What is operational excellence
- How to improve product quality
- Preventive vs predictive maintenance
- Kanban
- FMEA
- PDSA cycle
- Safety moments
- Just-in-time manufacturing
- Kaizen
- 5S
- Total quality management (TQM)
- CAPA (corrective and preventive action)
- Layered process audit (LPA)
- Lean tools
- Lockout tagout (LOTO)
- A3 problem solving
- Preventive maintenance
- APQP
- High reliability organization (HRO)
- Manufacturing KPIs
- Quality metrics
- Practical problem solving
- CMMS
- Risk assessment
- Production efficiency
- Total productive maintenance (TPM)
- Reliability-centered maintenance (RCM)
- Hierarchy of controls
- Personal protective equipment (PPE)
- Emergency action plan
- Safety signs
- Warehouse safety
- SIPOC diagram
- Pugh matrix
- Flowchart
- Project charter
- ISO 9001:2026
Or browse the topics, the full library and the lean glossary.
Rather see it on your own problem?
Bring the problem you are stuck on, and we will show you on a call how LeanSuite handles it.