ISO 9001 Clauses Explained: Clauses 4 to 10 and What Each Requires

ISO 9001 has ten clauses. The first three are scene-setting (scope, references, definitions) and nobody audits you against them. Clauses 4 to 10 are the requirements: the things you have to do, show evidence of, and keep doing between audits. This guide walks through each one in plain English, says what the auditor will actually look for, and flags what changed in the 2026 edition.

If you are working to ISO 9001:2015, everything below still applies. Certificates issued against the 2015 edition remain valid until September 2029 and certification bodies will not be auditing against 2026 for a while yet, so you have time. The differences are called out clause by clause so you can see what a transition will involve; the ISO 9001:2026 changes article covers them in full.

Download the free ISO 9001 requirements checklist (Excel)

Every sub-clause from 4.1 to 10.3 on one sheet, with a plain-English summary, the evidence an auditor typically asks for, a status dropdown and space to record what you have and where it lives. A summary tab counts your progress by clause. No sign-up needed.

How the clauses fit together

The seven requirement clauses follow the same structure as ISO 27001, ISO 14001 and the other management system standards, so if you already hold one of those, the shape will be familiar (we cover the ISO 27001 clauses separately). Clause 4 asks you to understand your organisation and decide what the quality management system covers. Clause 5 puts leadership on the hook for it. Clause 6 is where you plan: risks, opportunities and objectives. Clause 7 is the support you need to make it work: people, infrastructure, knowledge, documents. Clause 8 is the big one, the operational work of winning, designing, delivering and checking what you sell. Clause 9 is how you measure whether it is working, including internal audit and management review. Clause 10 is what you do when it isn’t.

For most small businesses, clauses 4 to 7 and 9 to 10 are a modest amount of work that is mostly already happening informally. Clause 8 is where the real effort goes, because it has to describe how your business actually operates.

Clause 4: Context of the organisation

What it requires. You identify the internal and external issues that affect your ability to deliver consistently (4.1), work out who your interested parties are and what they need from you (4.2), define the scope of your QMS (4.3), and map the processes that make it up (4.4).

What the auditor checks. A documented scope; some evidence that you have thought about context and interested parties (a short table is fine); and a process map or list showing your core processes and how they connect. They will ask why anything is excluded from scope.

In practice. Keep the context review to a page. Issues are things like reliance on a key supplier, a change in regulation, staff turnover, or a new competitor. Interested parties are customers, staff, suppliers, regulators, your insurer, and anyone else whose requirements shape how you work. The 2024 amendment, now part of the 2026 text, asks you to consider whether climate change is a relevant issue; for most SMEs a reasoned sentence saying it is not material is sufficient.

2026 changes. Minor. The requirement to consider climate change is now in the main text rather than an amendment, and the wording on interested parties is tightened to ask which of their requirements you have chosen to address.

Clause 5: Leadership

What it requires. Top management demonstrates leadership and commitment to the QMS (5.1), keeps a customer focus, establishes a quality policy (5.2), and assigns roles, responsibilities and authorities (5.3).

What the auditor checks. The quality policy, signed off and communicated; evidence that leadership takes part (management review attendance is the usual proof); and clear ownership of the QMS and its processes.

In practice. The quality policy should be short, specific to your business and written in a way your staff could repeat the gist of. The commonest failing is a policy copied from a template that nobody in the company recognises. Roles can be a simple table: process, owner, deputy.

2026 changes. This is one of the clauses with the most new emphasis. Top management is now expected to promote a quality culture and ethical behaviour, and the wording on accountability is stronger. Auditors cannot audit culture directly, so expect them to look for it in records: how complaints are handled, how problems are investigated, whether staff raise issues and what happens when they do.

Clause 6: Planning

What it requires. Determine the risks and opportunities that could affect the QMS and plan actions to address them (6.1); set measurable quality objectives and plan how to achieve them (6.2); and manage changes to the QMS in a controlled way (6.3).

What the auditor checks. A risk and opportunity register, or equivalent; objectives that are measurable, assigned and reviewed; and evidence that significant changes were planned rather than improvised.

In practice. Objectives are where small businesses most often go wrong, by setting vague aims (“improve customer satisfaction”) with no measure. “Reduce first-month defect returns from 4% to 2% by June, owner: operations manager” is an objective; “be the best” is not. Four or five objectives are plenty.

2026 changes. Risks and opportunities are now separate requirements rather than one combined paragraph. You will need to show that opportunities are identified, evaluated, acted on and measured, not just that risks are managed. In practice most businesses already have the evidence (a new service line, a process improvement, a market you entered); the change is about labelling it.

Clause 7: Support

What it requires. Provide the resources the QMS needs (7.1): people, infrastructure, working environment, monitoring and measuring equipment, and organisational knowledge. Ensure people are competent (7.2) and aware of the QMS and their part in it (7.3). Decide what is communicated, when and to whom (7.4). Control your documented information (7.5): creating it, updating it, approving it, and protecting it.

What the auditor checks. Competence records (training, qualifications, experience) for the roles that affect quality; calibration or verification records where measurement matters; a document control approach that shows what the current version is and who approved it; and staff who can say what the quality policy means for their job when asked.

In practice. Document control does not need a document management system. A folder structure, a version in the footer and an approval record are enough for most SMEs. Organisational knowledge is the one people forget: what does the business know that it would hurt to lose, and how is it captured?

2026 changes. The organisational knowledge requirement is expanded. It is no longer enough to retain knowledge; the expectation is that you share it, apply it and acquire new knowledge as the business changes. Think onboarding notes, lessons-learned records, and how know-how moves between people.

Clause 8: Operation

This is the longest clause and the one that has to describe your actual business, so it carries the most work. It has seven parts.

8.1 Operational planning and control. Plan how you deliver your products and services: the criteria, the resources, the records. For a service business this is often a single process description per service line.

8.2 Requirements for products and services. How you communicate with customers, how you capture and review what they are asking for before you commit, and how you handle changes to requirements. The auditor wants to see that you review orders or contracts before accepting them, and that changes are recorded.

8.3 Design and development. If you design products or services, you need a controlled process: planning, inputs, controls, outputs, changes. If you do not design anything, you can exclude this sub-clause, but you must justify the exclusion in your scope and the auditor will test it. Many software and service businesses do design, whether they call it that or not.

8.4 Control of externally provided processes, products and services. How you choose, approve, monitor and re-evaluate suppliers and subcontractors in proportion to their effect on what you deliver. An approved supplier list with evaluation criteria is the usual evidence.

8.5 Production and service provision. Controlled conditions for delivery, identification and traceability where it matters, care of customer or supplier property, preservation, post-delivery activities and control of changes. For a services firm this means being able to show what was done, by whom, to what standard, and what happens after handover.

8.6 Release of products and services. Evidence that what you delivered was checked against the requirements before it went out, and who authorised release.

8.7 Control of nonconforming outputs. What you do when something does not meet requirements: how it is identified, contained, corrected, and recorded. A nonconformance log is the standard evidence; our guide to non-conformance and corrective action has a free one.

What the auditor checks. This is where the auditor spends most of stage 2. Expect them to follow a real order or project from enquiry to delivery and ask for the records at each step. If the records exist because that is how you work, this is straightforward. If they were created for the audit, it shows.

2026 changes. Largely structural and wording changes to align with the other standards. The substance of what you must control is the same.

Clause 9: Performance evaluation

What it requires. Monitor, measure, analyse and evaluate how the QMS performs, including customer satisfaction (9.1); run internal audits at planned intervals (9.2); and hold management reviews (9.3).

What the auditor checks. Performance data against your objectives; some measure of customer satisfaction (surveys, complaints trend, repeat business, it does not have to be a questionnaire); an internal audit programme, audit records and the resulting actions; and management review minutes covering the inputs the standard lists.

In practice. Internal audit is the requirement most small businesses find hardest to do credibly, because the auditor must be independent of what they audit and in a ten-person company that is difficult. Many use an external internal auditor for exactly this reason. Management review should be a working meeting with decisions in the minutes, not a form. Our free ISO 9001 audit checklist covers how to run the audit itself.

2026 changes. Management review inputs now include the new culture and ethics expectations and the separate treatment of opportunities, so your agenda needs those items. The leadership accountability emphasis means management review records carry more weight than before.

Clause 10: Improvement

What it requires. Identify and act on opportunities to improve (10.1); deal with nonconformities and take corrective action to stop them recurring (10.2); and improve the QMS continually (10.3).

What the auditor checks. A corrective action process that goes beyond fixing the symptom: root cause, action, and a check that it worked. Evidence that complaints and audit findings feed into it. Something, anywhere, that shows the system got better over the year.

In practice. The commonest finding here is corrective actions closed without any check that they were effective. Add a “verified by, date” column to your log and use it. We cover the whole process, with a worked example, in non-conformance and corrective action in ISO 9001.

2026 changes. Minimal. The continual improvement wording is aligned with the other standards.

Clauses 1 to 3, briefly

Clause 1 is the scope of the standard itself, clause 2 lists normative references, clause 3 points to the definitions in ISO 9000. You will not be audited against them, but clause 3 is worth a look if a term in the standard seems unclear.

Where to go next

If you want to check your current position against each requirement, the free requirements checklist above lists every sub-clause with space to record where your evidence lives, and the free ISO 9001 toolkit has the templates to fill the gaps. If you would rather have someone take you through it, our ISO 9001 consultancy programme covers all seven clauses in five workshops, with clause 8 getting a session of its own. Working towards ISO 27001 as well? See how we run both standards together.

Frequently asked questions