ISO 9001 performance evaluation

ISO 9001:2015 9.1 asks you to decide what to monitor and measure, including customer satisfaction (9.1.2), and to analyse the results (9.1.3). Clause 9.2 requires internal audits at planned intervals, and 9.3 requires top management to review the quality management system against a set of inputs and record decisions on improvement, change and resources.

The requirement in plain English

Monitoring and measurement (ISO 9001:2015 9.1.1). You decide what needs monitoring and measuring, how, when, and when the results get analysed. You evaluate how the system is performing and keep the results as documented information.

Customer satisfaction (ISO 9001:2015 9.1.2). You track how far customers feel their needs and expectations were met, by methods you choose and review. The 2026 edition keeps the requirement and, by certification-body and consultancy accounts, adds a note listing sources such as complaints and social media (ISO 9001:2026 9.1.2).

Analysis and evaluation (ISO 9001:2015 9.1.3). You turn the data into conclusions: whether products and services conform, how satisfied customers are, whether the system and your plans are working, whether actions on risks worked, how suppliers perform, and where to improve.

Internal audit (ISO 9001:2015 9.2). You audit at planned intervals to check that the system meets your own requirements and the standard’s and is working (9.2.1). The programme weighs how important each process is, what has changed and what earlier audits found. Each audit has criteria and a scope, auditors are objective and impartial, results go to the managers concerned, and corrections and corrective actions follow without undue delay (9.2.2).

Management review (ISO 9001:2015 9.3). Top management reviews the system at planned intervals for suitability, adequacy, effectiveness and, unlike ISO 27001, alignment with your strategic direction (9.3.1). The review considers (9.3.2):

what happened to actions from earlier reviews;
changes inside and around the organisation that affect the system;
how the system is performing, with trends: what customers say, progress on objectives, how processes and products turn out, nonconformities, audits and other measurements, and suppliers;
whether resources are enough;
whether the actions on risks and opportunities worked;
where the system could improve.

The results are decisions on improvement opportunities, changes to the system and resource needs, kept as documented information (9.3.3).

This is guidance to help you understand the requirement, not legal advice.

What good looks like

A 28-person firm that designs and builds control panels for water utilities measures five things monthly: on-time delivery, first-pass test yield, customer returns, supplier on-time delivery and progress on each quality objective. The quality manager writes one paragraph a month on what the trends mean, not just the numbers.

Customer satisfaction comes from three sources: a short survey after each commissioning, a quarterly call with the five largest customers, and the complaints log. A falling survey score with no complaints is treated as a warning, not a success.

The internal audit programme covers every process in a year. Panel wiring and final test, where most returns start, are audited twice. The quality manager and a trained production lead audit each other’s areas, and an external auditor covers the quality manager’s own processes so nobody audits their own work.

The management review runs every January, with a shorter one in July. The managing director, operations and finance directors attend. The pack follows the six input groups, and the minutes record decisions with owners and dates: add a second test bench, drop a late cable supplier, set an objective for first-pass yield. Each decision becomes an action that opens the next review.

Evidence an auditor expects

Monitoring and measurement results (required documented information, 9.1.1): the auditor checks that what you measure matches what your processes and objectives need.
Customer satisfaction data: the auditor asks how you know customers are satisfied and what changed because of it.
Analysis of the data: usual rather than a named record; the auditor looks for trends and conclusions, and for those conclusions in the review pack.
Audit programme and results (required, 9.2.2): the auditor checks coverage, the reasons for frequency, auditor independence and follow-up of findings.
Management review results (required, 9.3.3): minutes showing every 9.3.2 input, top management present, and decisions with owners.
Top management interview: the auditor asks a director what the last review decided.

Common mistakes

Satisfaction measured by silence

“No complaints in 12 months” is not customer satisfaction. Customers often leave without complaining. Ask them, and record what they said.

Numbers with no conclusions

A dashboard of 20 charts with no commentary fails the analysis step in 9.1.3. Write what each trend means and what you will do about it.

Auditing your own work

In a small firm the quality manager often audits the processes they run, which breaks the impartiality rule in 9.2.2. Swap auditors between areas or bring in an outside auditor for those processes.

A calendar, not a programme

The same audit dates every year, whatever changed and whatever the previous round found, is a schedule. Move audits towards processes with new staff, new equipment, complaints or open findings.

External providers forgotten

Packs copied from an ISO 27001 template often miss supplier performance and resource adequacy, both ISO 9001 inputs. Add them as their own agenda items.

How Sted helps

For ISO 9001 clauses 9.1 and 9.2 Sted’s knowledge base carries the Monitoring and Measurement Procedure (PRC-MMP) with its Monitoring and Measurement Framework Record (REC-MMFR) and Monitoring and Measurement Record (REC-MMR), the Customer Feedback and Complaints Procedure (PRC-CFC) with its Customer Feedback Record (REC-CFR), Customer Complaint Record (REC-CCR) and Complaint and Feedback Trend Review Record (REC-CFTR, suggested monthly), and the Internal Auditing Procedure (PRC-IAP) with its Internal Audit Schedule (REC-IAS, suggested annually), Internal Audit Plan (REC-IAP) and Internal Audit Report (REC-IAR).
Nothing is scheduled until an owner picks a first due date, and records are part of the Full Management System plan.
For ISO 9001 clause 9.3 Sted’s knowledge base carries the Management Review Procedure (PRC-MRP) with its Management Review Schedule (REC-MRS), Management Review Record (REC-MRR) and Management Review Action Record (REC-MRA); the schedule and the review record come with a suggested annual frequency.
Nothing is scheduled until an owner picks a first due date, and records are part of the Full Management System plan.
33 periodic record types come with a suggested frequency, but nothing is scheduled until you pick a first due date.
An administrator or the owner of a record type’s document sets how often it repeats and its next due date under Repeating records; a task to complete it opens 30 days before each due date, goes to the document’s owner, and closing that period’s record moves the date on. Event-driven record types never fall due on their own.
Only evidence from the last 12 months counts towards readiness.

Sted holds the audit and review records and raises them when they fall due. It does not audit you, attend the review or make the decisions; your auditors and top management do.

Management review guide: preparing the pack and running the meeting across several standards.
Internal audit guide: building the programme, choosing auditors and grading findings.
Improvement: where audit findings and review decisions go next.
Repeating records: how Sted raises the audit schedule and the review each time they fall due.
ISO 9001: how clause 9 fits the rest of the standard.

Frequently asked questions

How often must an ISO 9001 internal audit happen?

At planned intervals you set yourself; the standard gives no number. Most small organisations audit every process at least once a year and the important or troubled ones more often, and certification bodies expect at least one complete round before stage 2.

Does ISO 9001 require a customer satisfaction survey?

No. Clause 9.1.2 asks you to monitor how customers perceive you and to choose your own methods. Surveys work, but so do account reviews, repeat orders, returns, warranty claims and compliments, as long as you record what you learn and act on it.