We use essential cookies to make the site work and, if you allow it, aggregated analytics cookies to improve the content. We do not use marketing cookies.
ISO 9001 clause 5 transformed the top-management role. Signing the policy isn't enough. Here's what a CEO must show in an audit.
ISO 9001:2015 changed clause 5 with a clear message: top management is responsible for the QMS, not just its sponsor. The management representative disappeared from the standard. Today the auditor interviews the CEO, plant director and operations lead to validate real leadership.
Seven concrete top-management obligations in 5.1.1:
The auditor asks for concrete evidence on each point. Meeting minutes, approved budgets, attendance at management reviews, communications sent to staff.
Clause 5.2 requires the policy to be appropriate to the context. It can't be generic. If your policy could belong to any company in the country, it's poorly written. It should reference your sector, your customers and your concrete operational promise.
Clause 5.1.2 requires leadership to demonstrate customer focus. The typical indicator: when was the last time the CEO visited an angry customer? If the answer is "never" or "two years ago," the clause isn't met no matter how much paper exists.
Clause 5.3 requires clear authority. In mid-sized plants, the typical conflict is between production and quality: who decides to stop a batch? If the answer requires CEO escalation every time, there's no authority. The decision must be made on the floor with documented criteria.
Three documents you must be able to produce:
Without these three pieces of evidence, clause 5 rests on words, not facts.
Ask the CEO to review the quality policy. If they can't explain it in 30 seconds without reading, it needs rewriting. If there's no QMS result in the last board meeting, that's the next focus. The standard doesn't demand heroics, it demands presence.
The quality policy is the most visible QMS artifact. Most of them are poorly written. Here's a template, common mistakes and how to fix yours.
Clause 6.1 introduced risk-based thinking. You can meet it with a well-built matrix — no full ERM system required.
Clause 4.2 requires identifying interested parties and their needs. With AI you can do it in an afternoon, not a month.