ISO 9001 context and leadership

ISO 9001:2015 clause 4 asks you to understand your issues and interested parties (4.1, 4.2), set the scope (4.3) and define the processes the quality management system runs on (4.4). Clause 5 makes top management accountable for it: leadership and customer focus (5.1), a quality policy (5.2) and assigned roles (5.3).

The requirement in plain English

Context (ISO 9001:2015 4.1 and 4.2). You work out the internal and external issues that affect your ability to deliver what customers need, and the interested parties whose requirements matter to your quality management system. You keep both under review. Since Amendment 1:2024 you also decide whether climate change is one of those issues.

Scope (ISO 9001:2015 4.3). You set the boundaries: which products, services and sites the system covers. Every requirement applies unless it cannot, and a requirement you set aside needs a reason in the scope that does not weaken your ability to deliver conforming products or satisfy customers. The scope is kept as documented information.

Processes (ISO 9001:2015 4.4). You define the processes the system needs and how they connect: what goes in and comes out, how each is run and measured, who owns it, what resources it needs, and its risks and opportunities. You keep enough documented information to run them and to show they ran as planned.

Leadership (ISO 9001:2015 5.1). Top management is accountable for the system working (5.1.1). They make sure the policy and objectives fit the business direction, that quality is part of normal business processes rather than a separate project, and that people have the resources and support to do it. Customer focus is its own duty: requirements are met and satisfaction is the aim (5.1.2). The 2026 edition adds promoting a quality culture and ethical behaviour (ISO 9001:2026 5.1.1), with staff awareness of both (ISO 9001:2026 7.3).

Policy (ISO 9001:2015 5.2). The quality policy suits your purpose, gives a frame for objectives, and commits to meeting applicable requirements and to continual improvement (5.2.1). It is documented, communicated, understood and applied inside the organisation, and available to interested parties as appropriate (5.2.2).

Roles (ISO 9001:2015 5.3). Top management assigns who makes sure the system conforms, that processes deliver, that performance is reported to them, that customer focus is promoted, and that the system holds together through changes.

This is guidance to help you understand the requirement, not legal advice.

What good looks like

A 22-person translation and localisation agency keeps a one-page context register: issues such as machine translation changing client expectations, reliance on freelance translators, and client confidentiality; interested parties such as clients, freelancers, the professional body and, for its life sciences clients, their regulators. Climate change is recorded as not relevant beyond a client’s question about remote working, with the date of that decision.

The scope reads “translation, proofreading and localisation services delivered from the Leeds office and by contracted freelancers”. Design and development is set aside with a reason: the agency translates clients’ content and does not design products or services of its own (ISO 9001:2015 8.3).

A process map on one page shows quoting, project management, translation, review, delivery and invoicing, with an owner and two measures each. The managing director chairs a quarterly quality meeting and signs the policy, which names the two commitments in plain words and links to the agency’s objectives. New starters and freelancers read the policy at onboarding and confirm they understand it.

Evidence an auditor expects

Scope (required documented information, 4.3): the products, services and sites covered, and a reason for any requirement set aside.
Quality policy (required, 5.2.2): the auditor checks both commitments are there and asks staff what it means for their job.
Process information (required to the extent needed, 4.4.2): how processes connect, their owners and their measures.
Issues and interested parties: no named record, but auditors expect to see how you determined and review them.
Roles and authorities: job descriptions, an organisation chart or a responsibility matrix.
Top management interview: the auditor asks a director how quality fits the business plan and what they did about the last review.

Common mistakes

A policy that could belong to anyone

A downloaded policy full of “excellence” and “exceeding expectations” with neither required commitment fails 5.2.1 and tells staff nothing. Write what quality means for your customers, then add the two commitments.

Setting aside what you actually do

A software company that writes its own product declares design not applicable to avoid clause 8.3. The auditor will find the design work in the backlog. Set aside only what you genuinely do not do.

Leadership delegated to the quality manager

The quality manager presents everything and the directors appear once a year. Auditors interview top management on purpose. Give directors visible decisions: objectives, resources and the review.

Context that never changes

The register written for certification still lists the competitors of the year it was written. Review issues and interested parties at management review and date the review.

How Sted helps

Sted’s knowledge base carries a Quality Policy (POL-QMP), shared with ISO 13485, for ISO 9001’s leadership clauses 5.1 to 5.3, planning of changes (6.3) and communication (7.4); it has no record template of its own.
Management-system registers (scope, interested parties, obligations, issues, objectives, risks and opportunities, processes) are edited by administrators; the first three are drafted from your onboarding answers and the rest start empty.
When onboarding finishes, Sted drafts the management systems, scope, interested parties and compliance obligations registers from your answers, labels each drafted row “Derived from your onboarding answers” until someone edits it, and never overwrites an edited row; issues, objectives, risks and opportunities, and processes start empty, every register hangs off a management system, nothing is deleted, and only issues, objectives and risks can be retired.
Training in Sted is the person’s own attestation, on the current approved version, that they are aware of and understand the document and accept their role in it; nobody can complete it for someone else.

Sted drafts the policy and the first registers from your answers. Top management still owns them; Sted does not set your direction or lead the system.

Policy adoption and rollout: approving the quality policy and getting people to read and understand it.
Planning: the risks, opportunities and objectives that follow from your context.
Management-system registers: where scope, interested parties, issues and processes live in Sted.
Documented information: what the scope, policy and process records count as.
ISO 9001: how clauses 4 and 5 start the loop.

Frequently asked questions

Does ISO 9001 still need a management representative?

No. The 2008 edition asked for one named manager; the 2015 edition spreads the duties across roles that top management assigns. Many small companies still give one person the job of reporting on the system, which is fine, but top management keeps the accountability.

Do we have to consider climate change for ISO 9001?

Yes, as a question. Amendment 1:2024 asks you to decide whether climate change is a relevant issue and adds a note that interested parties can have climate-related requirements, and the 2026 edition keeps that. For many service firms the answer is a short recorded judgement, such as a customer asking about delivery emissions.