ISO 9001 Quality Policy: What It Must Say, With Examples and a Free Template

The quality policy is the shortest document in an ISO 9001 system and the one auditors read first. It is a statement from top management of what quality means in your business and what you commit to doing about it. Most are a page. The good ones could be read aloud to a new starter on their first morning and make sense; the bad ones are three paragraphs copied from a template that nobody in the company could repeat the gist of.

Clause 5.2 of ISO 9001 sets out what the policy has to contain and what you have to do with it (where it sits among the other requirements is in our ISO 9001 clauses guide). This guide covers both, with a full example you can adapt and the Word template from our toolkit.

Download the free quality policy template (Word)

The template is the one we use with clients. It has example wording for each required element, placeholders for your name and signature, and a version control table. Replace the bracketed text, cut any commitment you would not measure, and have it signed. No sign-up needed.

What clause 5.2 requires

The standard asks for a quality policy that:

• Is appropriate to the purpose and context of the organisation and supports its strategic direction. In other words it should sound like your business, not a generic one.
• Provides a framework for setting quality objectives. The objectives you set under clause 6.2 should trace back to commitments in the policy.
• Includes a commitment to satisfy applicable requirements: customer, statutory, regulatory and contractual.
• Includes a commitment to continual improvement of the quality management system.

And a policy that is:

• Available as documented information, which means written down and controlled like any other QMS document.
• Communicated, understood and applied within the organisation.
• Available to relevant interested parties as appropriate: customers, suppliers, regulators, anyone who asks.

That is the whole of the requirement. Everything else is good practice.

What a good quality policy looks like

Short. One page, ideally less. If it runs to two, it has become a quality manual.

Specific. “We are committed to excellence” tells an auditor nothing and tells your staff less. “We deliver every project to the agreed scope and date, and when we cannot we tell the client before they find out” is a commitment someone can be held to.

Written by the people who run the business. Top management has to own it under clause 5.1, and the easiest way to show that at audit is for the managing director to be able to explain it without looking at it.

Connected to objectives. Each commitment in the policy should have at least one measurable objective sitting underneath it. If the policy promises on-time delivery and there is no delivery objective, the auditor will ask why.

Signed and dated. Not strictly required by the standard, but a signature from the top is the simplest evidence of leadership commitment there is.

Worked example

Here is a complete policy for a fictional 15-person software consultancy, so you can see the shape. Swap the specifics for your own.

Northfield Software Ltd: Quality Policy

Northfield builds and supports custom software for financial services clients. Our customers rely on us to deliver what we agreed, on the date we agreed, to a standard that passes their own audits. Quality for us means exactly that.

We commit to:

1. Understanding each client’s requirements before we commit, and recording changes to them as the project runs.
2. Delivering releases that pass the client’s acceptance criteria first time, and telling the client early when a date is at risk.
3. Meeting the regulatory and contractual requirements our clients pass on to us, including those relating to data protection and secure development.
4. Reviewing every project at close and feeding what we learn into how we run the next one.
5. Setting measurable quality objectives each year, reviewing them quarterly, and continually improving the way we work.

The managing director is accountable for this policy and for the effectiveness of our quality management system. Every member of the team is responsible for following our processes and for raising problems and improvement ideas when they see them.

This policy is reviewed at management review and whenever the business changes significantly.

Signed: [MD name], Managing Director, [date]

Notice what it does not contain: no mission statement, no values list, no history of the company, nothing about ISO 9001 itself. Those belong elsewhere.

How to write yours

1. Start with what your customers actually buy. Not the product, the outcome. For a courier it is parcels arriving intact and on time; for an accountant it is accurate filings submitted before the deadline. That sentence becomes the opening of your policy.
2. List three to six commitments. Take them from how the business really wins and keeps customers. Avoid anything you would not be prepared to measure.
3. Add the two commitments the standard requires. Meeting applicable requirements and continual improvement. They can be one sentence each.
4. Name who is accountable. Top management, by role.
5. Say how it is reviewed. Management review is the usual answer.
6. Get it signed. Then put it where people can see it: the intranet, the office wall, the onboarding pack.
7. Set the objectives. Go through each commitment and write at least one measurable objective for it. That is clause 6.2, covered in our quality objectives guide, and it is where the policy becomes real.

Communicating it, and proving you did

The requirement that stings most at audit is “communicated, understood and applied”. Auditors test it by asking staff, usually not the managers, what the quality policy means for their job. They are not looking for recitation; they are looking for someone who can say “we do not release a report without a second pair of eyes on it, because getting it right first time is the main thing the clients care about”.

Ways that work in small businesses:

• Cover it in onboarding and record that you did.
• Put a one-line version in the email signature or on the intranet home page.
• Refer to it when you discuss a complaint or a non-conformance at a team meeting: “this is the on-time commitment in the policy”.
• Mention it at management review and minute that you reviewed it.

What does not work is laminating it and putting it in reception.

Mistakes auditors see most

• The template policy. Placeholder commitments, generic language, and a managing director who has never read it. The giveaway is when it describes a business that does not match the one being audited.
• No link to objectives. Policy commits to customer satisfaction; no objective measures it.
• Not reviewed. Policy dated four years ago, business has doubled in size and changed what it sells.
• Nobody can explain it. Staff interviewed on the audit have not seen it.
• Too long. A two-page policy is a sign that the manual and the policy have been merged.

What changed in ISO 9001:2026

The content requirements in clause 5.2 are unchanged from 2015. What has changed sits next to it in clause 5.1: top management is now expected to promote a quality culture and ethical behaviour, and the wording on leadership accountability is stronger. Nothing in the standard says the policy must mention culture or ethics, but many businesses transitioning to 2026 are adding a line, and auditors will read the policy as one piece of evidence of the culture the leadership is promoting. If your policy already reads like something the leadership believes rather than something they signed, you are most of the way there. The ISO 9001:2026 changes article covers the rest.

Where to go next

The template above is one of the 32 documents in the free ISO 9001 toolkit, which also has the objectives register that sits underneath the policy. Once the policy is written, the next job is the quality objectives under clause 6.2. If you want help getting the whole system to audit, our ISO 9001 consultancy programme covers leadership and planning in the first workshop.

Frequently asked questions