ISO 9001 Clauses Explained: A Plain-English Guide to Clauses 4-10
ISO 9001:2015 looks intimidating until you notice that it is built from only seven requirement clauses (4 to 10), arranged around the Plan-Do-Check-Act cycle. This guide walks through each clause in plain English, with examples of what auditors usually look for. If you are deciding whether to go for certification, our ISO 9001 QMS certification service page explains how we can support you.
Edition status (checked October 2026): This guide explains the clause structure of ISO 9001:2015, which existing certificates are based on. ISO 9001:2026 was published on 16 September 2026 and replaces it; certificates to the 2015 edition must be transitioned by 30 September 2029. ISO describes the new edition as a targeted update with clearer wording, a new Annex A and a stronger focus on leadership and quality culture, so check the 2026 text for any changes to the clauses described here.
The big picture: how the standard is organised
ISO 9001:2015 is organised in ten clauses. Clauses 1 to 3 (scope, normative references, terms and definitions) are introductory and contain no requirements you can be audited against. The auditable requirements sit in clauses 4 to 10. They follow Plan-Do-Check-Act: clauses 4 to 7 are mostly Plan (with support), clause 8 is Do, clause 9 is Check and clause 10 is Act. Clause 5, leadership, wraps around the whole cycle.
The same ten-clause layout, known as the high-level structure, is used by ISO 14001, ISO 45001 and many other management system standards. That is why learning ISO 9001 well makes every other ISO system easier. We explore that in our article on integrated vs consolidated management systems.
Clause 4: Context of the organization
Clause 4 asks you to understand the world your quality system lives in. You determine the internal and external issues that affect your ability to deliver results, identify interested parties (customers, regulators, employees, suppliers, owners) and their relevant requirements, set the scope of the quality management system, and identify the processes needed and how they interact (4.4).
Evidence examples: a short context analysis (for example SWOT or PESTLE), a list of interested parties and their needs, a scope statement that names products, services and sites, and a process map. Common pitfall: writing a scope so narrow that it excludes the activities customers care about, or so broad that it cannot be audited.
Clause 5: Leadership
Top management must show leadership and commitment, not just sign a policy. That means taking accountability for the effectiveness of the system, making sure the quality policy and objectives align with strategy, integrating requirements into business processes, promoting the process approach and risk-based thinking, and providing resources. Clause 5.1.2 adds customer focus. Clause 5.2 requires a documented quality policy that is communicated and available, and 5.3 requires roles, responsibilities and authorities to be assigned and communicated.
Evidence examples: the policy, management review minutes showing real decisions, interviews in which managers can explain how quality objectives link to the business. Pitfall: delegating everything to a quality manager. Auditors interview top management precisely to test this.
Clause 6: Planning
Clause 6.1 requires you to determine risks and opportunities that need addressing so the system can achieve its intended results, prevent or reduce undesired effects and drive improvement, and to plan actions proportionate to their potential impact. Clause 6.2 requires measurable quality objectives that are consistent with the policy, monitored, communicated and updated, with a plan stating what will be done, by whom, with what resources and by when. Clause 6.3 covers planning of changes to the system. Our article on the quality mindset goes deeper into risk-based thinking.
Evidence examples: a risk and opportunity register, objectives with owners and targets, a change log. Pitfall: objectives such as "improve quality" that cannot be measured.
Clause 7: Support
Support covers the resources that make the system work: people (7.1.2), infrastructure (7.1.3), the environment for the operation of processes (7.1.4), monitoring and measuring resources including calibration and traceability (7.1.5), and organisational knowledge (7.1.6). Clause 7.2 requires competence, 7.3 awareness of the policy and each person's contribution, 7.4 internal and external communication, and 7.5 documented information, covering creation, updating and control.
Evidence examples: competence matrices, training records, calibration certificates, a document control procedure or equivalent practice. Pitfall: assuming the standard demands a large manual. ISO 9001:2015 removed the mandatory quality manual and required procedures, though you must keep the documented information the standard explicitly requires and what you need for effectiveness.
Clause 8: Operation
Clause 8 is the longest and covers how you deliver products and services. It includes operational planning and control (8.1), customer communication and determining and reviewing requirements (8.2), design and development where applicable (8.3), control of externally provided processes, products and services (8.4), production and service provision, including identification, traceability, customer property, preservation and post-delivery activities (8.5), release of products and services (8.6), and control of nonconforming outputs (8.7).
Evidence examples: contract or order review records, supplier evaluations, work instructions, inspection and test records, nonconformity reports. Pitfall: excluding design and development without a valid justification. Exclusions are only allowed for requirements that are not applicable and that do not affect your ability to deliver conforming products.
Clause 9: Performance evaluation
You must monitor, measure, analyse and evaluate (9.1), including customer satisfaction and the analysis of data to evaluate the performance and effectiveness of the system. Clause 9.2 requires internal audits at planned intervals by auditors who are objective and impartial, and 9.3 requires management reviews that consider defined inputs such as audit results, customer feedback, process performance, risks and opportunities, and produce decisions on improvement and resource needs.
Evidence examples: audit programme and reports, KPI dashboards, customer satisfaction results, management review minutes. Pitfall: internal audits that only tick boxes. The programme should be risk-based and cover the whole scope across the certification cycle.
Clause 10: Improvement
Clause 10 requires you to determine and select opportunities for improvement (10.1), react to nonconformities and take corrective action, including root cause analysis (10.2), and continually improve the suitability, adequacy and effectiveness of the system (10.3). Corrective action must be proportionate to the effects of the nonconformity, and its effectiveness must be reviewed.
Evidence examples: a corrective action log with root cause and effectiveness checks, improvement projects. Pitfall: closing actions by retraining everyone ("human error") instead of fixing the process.
How the clauses fit together in daily work
A helpful way to remember the logic: clause 4 defines what you do and for whom, clause 5 makes leaders accountable, clause 6 decides what could go wrong and what you want to achieve, clause 7 provides resources, clause 8 delivers to the customer, clause 9 checks whether it worked, and clause 10 fixes and improves. When you can tell that story with your own examples, you are ready for an audit. To understand what happens in the audit itself, read how to prepare for a Stage 1 and Stage 2 audit.
Frequently Asked Questions
How many clauses does ISO 9001:2015 have?
Ten clauses in total, but only clauses 4 to 10 contain requirements against which an organisation is audited.
Is a quality manual still required in ISO 9001:2015?
No. The mandatory quality manual and the six required procedures from the 2008 edition were removed. You must keep the documented information that the standard requires and the information you need to be effective.
What is the process approach?
It means managing activities as interrelated processes with defined inputs, outputs, owners, risks and performance measures, rather than as isolated departments.
What changed with Amendment 1:2024?
It added a requirement to determine whether climate change is a relevant issue in the context of the organization and among interested-party needs.
Which clause causes the most audit findings?
Findings commonly arise in clause 7 (competence, calibration, documented information), clause 8 (supplier control and change control) and clause 9.2 (internal audit quality), though it varies by organisation.
Related Articles
- The quality mindset: Connecting risk, culture and performance to create opportunity
- How to Prepare for an ISO Audit: What Happens in Stage 1 and Stage 2
- Integrated vs Consolidated Management Systems: Why the Difference Matters
Need Help? Talk to BRSM Global
BRSM Global supports organisations in Dubai and across the UAE with guidance, implementation, auditing and post-certification support. Explore the related service:
Contact us for a free consultation and quote or call +971 58 623 3144.