ISO 9001:2015 clauses 4-10 explained in plain English

The ten clauses, and why only seven get audited

ISO 9001:2015 has ten clauses. Clause 1 is scope, clause 2 lists the normative reference (there's really only one, the ISO 9000 vocabulary standard), and clause 3 just points you to that vocabulary. None of these three generate a requirement, a record or a nonconformity. Auditors skip straight past them.

Clauses 4 to 10 are where the actual requirements sit, and they follow a logical order: clause 4 sets up the system, clause 5 gets leadership to own it, clause 6 makes you plan for risk and objectives, clause 7 gives you the resources and documentation to run it, clause 8 is the operational core — making the product or delivering the service — clause 9 checks whether it's working, and clause 10 makes you fix and improve it. This is often called the Plan-Do-Check-Act structure, and it maps almost exactly onto clauses 6, 7-8, 9 and 10.

If you're preparing for a first audit, work through clauses 4-10 in this order rather than alphabetically by topic. Most of the documentation an MSME already has — approved supplier lists, calibration records, training files — slots into clause 7 or clause 8. The gaps usually show up in clause 6 (no documented risk assessment) and clause 9 (internal audits done but not recorded properly, or management review treated as a formality with no real output).

Clause 4 — context of the organisation

Clause 4 has four sub-clauses: 4.1 (understanding the organisation and its context), 4.2 (understanding the needs and expectations of interested parties), 4.3 (determining the scope of the QMS) and 4.4 (the QMS and its processes). In practice, this clause asks you to write down who you are, who you answer to, and what your QMS actually covers.

4.1 wants a short list of internal and external issues that affect your business — competitor pressure, raw material availability, labour turnover, regulatory change. 4.2 wants a list of interested parties (customers, regulators, owners, employees, suppliers) and what each one expects from you. Neither needs to be a long document; one or two pages of bullet points, reviewed at management review, is normal for a small unit.

4.3 is the scope statement — the sentence that says exactly what the certificate covers: which site, which products or services, and whether design and development is included or excluded. Get this wrong and the certificate itself gets challenged by a tender evaluator later. 4.4 is the clause that requires you to identify your QMS processes (sales, purchase, production, dispatch, service) and show how they interact — usually a one-page process map or flowchart satisfies this. Auditors check the scope statement against what they actually see on the shop floor; a mismatch here is one of the most common nonconformities raised at stage 1 audit.

Clause 5 — leadership

Clause 5 covers leadership and commitment (5.1), quality policy (5.2) and organisational roles, responsibilities and authorities (5.3). This is the clause where the auditor talks to the owner or plant head directly, not just the quality manager.

5.1 requires top management to take accountability for the QMS — not delegate it entirely to a management representative. Auditors test this by asking the owner or managing director a few direct questions: what's your quality policy, what are this year's objectives, when was the last management review. A plant head who can't answer these is a classic finding, even if the quality manager runs an excellent system on paper.

5.2 requires a documented quality policy, appropriate to the business, that includes a commitment to meet requirements and to continual improvement. It has to be communicated and understood, not just framed and hung on a wall — auditors sometimes ask a machine operator what the company's quality policy means in their own words. 5.3 requires defined roles, responsibilities and authorities, typically shown through an organisation chart and a responsibility matrix (who approves purchase orders, who signs off non-conforming material, who conducts internal audits). For a small unit this can be one page; for a multi-site medium unit, it needs to be clear enough that someone covering for an absent colleague knows exactly what they're authorised to do.

Clause 6 — planning for risk and objectives

Clause 6 is where ISO 9001:2015 introduced risk-based thinking, and it's the clause most MSMEs under-document. It has three parts: 6.1 (actions to address risks and opportunities), 6.2 (quality objectives and planning to achieve them) and 6.3 (planning of changes).

6.1 does not require a formal risk-management framework. It requires you to think through, against the context from clause 4.1 and the interested parties from 4.2, what could go wrong with your processes and what you're doing about it. A simple risk register — ten to fifteen rows, listing a risk, its likely impact, and the control in place — is normal and auditable. What fails an audit is having no register at all, or one that was created once and never reviewed.

6.2 requires measurable quality objectives, set at relevant functions and levels, with a plan showing what will be done, by whom, by when, with what resources, and how it will be evaluated. 'Reduce customer complaints' is not measurable; 'reduce customer complaints from 12 to 6 per quarter by June' is. 6.3 covers planned changes to the QMS — a new product line, a new machine, a change in scope — and requires you to think through the consequences before making the change, not after. Auditors look for evidence that a recent change (new supplier, new process) was planned rather than just happened.

Clause 7 — support: people, equipment and documentation

Clause 7 is the resource clause: 7.1 resources, 7.2 competence, 7.3 awareness, 7.4 communication, 7.5 documented information. It's the clause with the most paperwork, and the one most job-work and fabrication units already have partly in place without realising it.

7.1 covers people, infrastructure, work environment, monitoring and measuring resources, and organisational knowledge. The sub-clause that trips units up most is 7.1.5 — calibration. Any gauge, meter or test instrument used to confirm conformity must be calibrated against a traceable standard, with records, and a defined calibration interval. Missing or expired calibration certificates are one of the most common findings at surveillance audit.

7.2 requires competence records: for every role that affects product quality, you need evidence of education, training, skill or experience — typically a training matrix cross-referenced to individual training records and certificates. 7.3 requires awareness of the quality policy and objectives among staff whose work affects conformity. 7.4 covers internal and external communication — who tells the customer about a delay, who tells the regulator about a recall. 7.5 is documented information: how documents are created, approved, reviewed, controlled and retained. A small unit rarely needs software for this — a controlled master document list with version numbers and a simple approval signature satisfies the clause.

Clause 8 — operation: making the product or delivering the service

Clause 8 is the longest clause and the one that varies most by industry. It covers 8.1 (operational planning and control), 8.2 (requirements for products and services), 8.3 (design and development), 8.4 (control of externally provided processes, products and services), 8.5 (production and service provision), 8.6 (release of products and services) and 8.7 (control of nonconforming outputs).

8.1 and 8.2 require you to plan how each job will be produced and to confirm the customer's requirements are understood and can be met before you accept the order — this is where sales order review and contract review records sit. 8.3, design and development, is the clause most job-work and contract manufacturing units legitimately exclude from scope, because they manufacture to a customer's drawing rather than designing the product themselves; this exclusion has to be stated in the scope statement under clause 4.3 and justified.

8.4 covers supplier control: how you select, evaluate and re-evaluate suppliers, with an approved supplier list and periodic scoring. 8.5 is the shop floor itself — work instructions, process parameters, identification and traceability of material through the process, and care of customer property. 8.6 is release — who signs off a batch before dispatch, and against what criteria. 8.7 is the control of nonconforming output: how a rejected or reworked item is identified, segregated, recorded and disposed of, with a corrective action raised if the nonconformity is recurring. Weak traceability and inconsistent nonconforming-material tagging are among the most frequent findings under clause 8.

Clause 9 — checking whether the system actually works

Clause 9 has three parts: 9.1 (monitoring, measurement, analysis and evaluation), 9.2 (internal audit) and 9.3 (management review). This is the clause that proves the QMS isn't just a binder of policies — that someone is actually checking the numbers.

9.1 requires you to decide what needs to be monitored (customer satisfaction, process performance, product conformity), how, when and by whom, and to analyse the results. Customer satisfaction specifically has to be measured — a feedback form, a complaint log analysed for trends, or a simple satisfaction score works, as long as it's recorded and reviewed, not just collected.

9.2 requires an internal audit at planned intervals — typically once a year for a small unit, covering every clause and every department over the cycle — carried out by someone independent of the area being audited, with a written audit report and findings. For a very small unit, this can be done by a trained staff member from a different department, or outsourced; it cannot be the same person auditing their own work.

9.3 requires a formal management review, at least annually, with defined inputs (audit results, customer feedback, process performance, status of corrective actions, risks and opportunities, resource adequacy) and defined outputs (decisions on improvement, changes needed, resource decisions). The most common finding here is a management review meeting held, but with no recorded minutes showing inputs were discussed and outputs decided — an attendance sheet alone does not satisfy clause 9.3.

Clause 10 — fixing problems and improving

Clause 10 covers 10.1 (general — improvement is continuous, not a one-off project), 10.2 (nonconformity and corrective action) and 10.3 (continual improvement). This is the clause that closes the loop on everything found under clauses 8 and 9.

10.2 is the one that generates the most audit evidence. Whenever a nonconformity occurs — a customer complaint, a rejected batch, an internal audit finding — the standard requires you to react to it, evaluate whether similar nonconformities exist elsewhere, determine the root cause, decide and implement a corrective action, review its effectiveness, and update the risk register from clause 6.1 if needed. A corrective action log, showing each entry through from root cause to closure with a date, is the single most checked record at surveillance audit.

Where units fall short is stopping at 'containment' — reworking the rejected batch — without ever getting to root cause. An auditor will ask, for a sampled entry in the CAPA log, why the nonconformity actually happened, not just what was done about the specific defective piece. A root cause of 'operator error' with no further digging is usually rejected as too shallow.

10.3 is the general requirement to use the outputs of management review, internal audit and corrective action to actually improve the QMS over time — process changes, training improvements, better supplier selection. There's no separate record required for 10.3 beyond showing that clause 9.3 management review decisions were followed through, which is why clauses 9 and 10 are usually assessed together at audit.

What gets a certificate rejected

Across clauses 4-10, the same handful of gaps come up repeatedly at stage 1 and stage 2 audits, and they're worth checking before you book a date with a certification body. A mismatch between the scope statement under 4.3 and what's actually produced on site is the most common stage 1 finding. Expired or missing calibration records under 7.1.5 is the most common finding in manufacturing units. A management review with no documented inputs or decisions under 9.3 is close behind, especially in first-time applicants who treat it as paperwork rather than a real meeting.

Corrective actions that never reach root cause under 10.2, and a corrective action log that exists but hasn't been updated in months, are also flagged often — auditors sample the log and ask follow-up questions on two or three entries. A risk register under 6.1 that was written once for the application and never touched again is another frequent minor nonconformity; it doesn't fail the audit on its own but it shows up as an observation that has to be closed before the certificate is finalised.

None of these gaps are hard to fix once they're identified — most take a few days of documentation work, not a redesign of the QMS. What takes longer is the man-day calculation itself: the certification body sets audit duration based on headcount and site count, and that, along with document maturity, is what actually drives the overall timeline and the all-inclusive range on our cost page. PraxisQ works through all ten clauses with you before the auditor arrives — we prepare the documentation and close the gaps, but the certificate itself is always issued by an IAF-accredited certification body (NABCB, UKAS, JAS-ANZ or ANAB), never by us.