ISO 9001 Requirements: A Clause-by-Clause Guide

ISO 9001 requirements are the mandatory rules set out in ISO 9001:2015 that an organization must meet to build a certifiable Quality Management System (QMS) — covering context of the organization, leadership, planning, support, operation, performance evaluation and improvement. In plain terms, the standard tells you what your quality system must achieve, not how to run your business, so it applies to companies of any size or sector. ISO 9001 is a quality management system standard, and certification is awarded to organizations — not to individuals or products.

This guide walks through each requirement so you know exactly what an auditor will expect to see. If you are ready to move from understanding the requirements to certification, IAS provides ISO 9001 certification in the USA under its UQAS accreditation scope.

What Is ISO 9001?

ISO 9001 is the world’s most widely used standard for a Quality Management System. Published by the International Organization for Standardization, the current edition — ISO 9001:2015 — sets the criteria for consistently providing products and services that meet customer and regulatory requirements while driving continual improvement.

The standard is built around a few core ideas: a strong customer focus, engaged leadership, the process approach, risk-based thinking, and the Plan-Do-Check-Act (PDCA) cycle. Meeting these principles is what separates a documented set of procedures from a living management system that actually improves quality over time.

A note on the upcoming revision: ISO 9001 is being updated, with ISO 9001:2026 scheduled to publish on 16 September 2026 and a three-year transition period (ISO 9001:2015 certificates remain valid until around 2029). This page focuses on the current 2015 requirements; for what is changing, see our ISO 9001:2026 revision guide.

The Structure of ISO 9001 Requirements

ISO 9001:2015 follows the High-Level Structure (Annex SL) shared by all modern ISO management system standards. The requirements sit in Clauses 4 through 10. Clauses 1 to 3 cover scope, references and definitions and contain no auditable requirements.

The seven requirement clauses are:

  • Clause 4 — Context of the organization
  • Clause 5 — Leadership
  • Clause 6 — Planning
  • Clause 7 — Support
  • Clause 8 — Operation
  • Clause 9 — Performance evaluation
  • Clause 10 — Improvement

These map neatly onto the PDCA cycle: Clauses 4–7 are Plan, Clause 8 is Do, Clause 9 is Check, and Clause 10 is Act. Below, we break down what each clause requires.

Clause 4 — Context of the Organization

This clause asks you to understand your organization before you design your QMS. You must:

  • Determine internal and external issues relevant to your purpose and strategic direction.
  • Identify interested parties (customers, regulators, suppliers, employees) and their relevant requirements.
  • Define the scope of your QMS — the products, services, sites and processes it covers.
  • Establish the processes needed for the QMS, including their inputs, outputs, sequence, and interactions (the process approach).

The scope statement is a mandatory documented output, so this is where every ISO 9001 project begins.

Clause 5 — Leadership

ISO 9001:2015 places clear accountability on top management. Leaders cannot delegate ownership of the QMS to a lone quality manager. This clause requires management to:

  • Demonstrate leadership and commitment by taking accountability for the effectiveness of the QMS.
  • Establish a quality policy appropriate to the organization (a mandatory documented item).
  • Ensure a strong customer focus so that customer and regulatory requirements are consistently met.
  • Assign and communicate roles, responsibilities and authorities across the organization.

Clause 6 — Planning (Including Risk-Based Thinking)

Planning is where risk-based thinking — one of the most important concepts in the 2015 revision — is applied. This clause requires you to:

  • Determine the risks and opportunities that could affect QMS outcomes, and plan actions to address them.
  • Set measurable quality objectives at relevant functions and levels, with plans to achieve them.
  • Plan changes to the QMS in a controlled way.

Notably, ISO 9001:2015 does not mandate a formal documented risk register or a separate risk methodology — but you must be able to show that risks and opportunities were considered and acted upon.

Clause 7 — Support (Resources)

A QMS only works if it is properly resourced. Clause 7 covers the support elements that underpin your processes:

  • Resources — people, infrastructure, and a suitable work environment.
  • Monitoring and measuring resources — including calibration where measurement traceability is required.
  • Competence — ensuring staff are competent based on education, training or experience, with records kept.
  • Awareness — making sure people understand the quality policy and their contribution.
  • Communication — determining internal and external communication needs.
  • Documented information — creating, updating and controlling the documents and records the QMS needs.

Clause 8 — Operation

Clause 8 is the largest requirement clause and the “Do” of the PDCA cycle. It governs how you actually deliver products and services, including:

  • Operational planning and control of processes.
  • Requirements for products and services — reviewing customer requirements and communication.
  • Design and development controls (where applicable — this can be excluded if you do not design).
  • Control of externally provided processes, products and services — supplier and outsourcing controls.
  • Production and service provision under controlled conditions, including identification, traceability and control of changes.
  • Release of products and services and the control of nonconforming outputs.

Clause 9 — Performance Evaluation

This is the “Check” stage, where you prove the QMS is working. Requirements include:

  • Monitoring, measurement, analysis and evaluation — deciding what to measure and interpreting the results, including customer satisfaction.
  • Internal audit — conducting audits at planned intervals to confirm the QMS conforms and is effectively implemented. Building this capability in-house is why many teams pursue ISO 9001 Internal Auditor Training.
  • Management review — top management reviewing the QMS at planned intervals to ensure its continuing suitability, adequacy and effectiveness.

Clause 10 — Improvement

The final clause closes the loop with the “Act” stage. You must:

  • Identify and act on opportunities for improvement.
  • Control nonconformities and take corrective action to eliminate their causes so they do not recur.
  • Pursue continual improvement of the QMS over time.

There is no requirement for “preventive action” as a separate process in the 2015 edition — that intent is now built into risk-based thinking under Clause 6.

ISO 9001 Documentation and Records Requirements

ISO 9001:2015 is deliberately less prescriptive about paperwork than earlier editions, but it still requires certain documented information. The mandatory documents typically include:

  • The scope of the QMS (Clause 4.3).
  • The quality policy (Clause 5.2).
  • Quality objectives (Clause 6.2).

The mandatory records (evidence that processes were carried out) commonly include:

  • Records of calibration / monitoring and measuring resources.
  • Competence and training records.
  • Records of design and development (if applicable).
  • Results of management review.
  • Internal audit results.
  • Records of nonconformities and corrective actions.
  • Evidence of product/service conformity and release.

Beyond these, you keep whatever additional documented information your organization decides is necessary for its processes to be effective. For a broader view across standards, see our overview of ISO certification requirements.

How ISO 9001 Requirements Are Verified: The Certification Audit

Meeting the requirements on paper is only half the journey — an accredited certification body must verify them through a two-stage audit.

  • Stage 1 (Documentation review): The auditor checks that your QMS documentation is in place and that you are ready for assessment, identifying any gaps.
  • Stage 2 (Certification audit): The auditor gathers objective evidence that your QMS is implemented, effective and conforms to ISO 9001:2015 across your operations.

After certification, surveillance audits are conducted (typically annually) and a full recertification takes place at the end of the three-year cycle. You can read more in our guide to the ISO 9001 certification process or review the general certification process followed by IAS.

Benefits of Meeting ISO 9001 Requirements

Organizations that meet ISO 9001 requirements — and maintain them — typically see:

  • More consistent, repeatable processes and fewer defects.
  • Higher customer satisfaction and stronger customer confidence.
  • Improved efficiency and reduced waste and rework.
  • Better decision-making based on data and measurement.
  • Easier access to tenders and contracts that require certification.

For a fuller breakdown, see our article on the benefits of ISO 9001.

How IAS Helps You Meet ISO 9001 Requirements

IAS (Integrated Assessment Services) is a professional certification and training body supporting organizations across the USA. Whether you need accredited ISO 9001 certification or want to build internal expertise through ISO 9001 Lead Auditor Training, our teams guide you from gap analysis through to certificate. The same teams deliver the wider portfolio of ISO certification in the USA, so you can add further management system standards as your business grows. IAS and Empowering Assurance Systems (EAS) are group companies. IAS maintains its UQAS accreditation, while EAS maintains its own applicable accreditation arrangements.

Ready to begin? Contact us to discuss your ISO 9001 requirements and the right path for your organization.

Frequently Asked Questions

What are the main requirements of ISO 9001:2015?
The main requirements are contained in Clauses 4 to 10 of ISO 9001:2015: context of the organization, leadership, planning, support, operation, performance evaluation, and improvement. Together these clauses define a complete Quality Management System. Clauses 1 to 3 cover scope, references and terms and contain no auditable requirements.
Is ISO 9001 certified to a company or an individual?
ISO 9001 is a quality management system standard, and certification is awarded to organizations, not to individuals or products. A company earns and holds the certificate for the scope of activities and sites covered by its QMS. Individuals can, however, become certified ISO 9001 auditors by completing accredited training such as a lead auditor course.
What documents are mandatory for ISO 9001?
ISO 9001:2015 requires a documented scope statement, a quality policy, and quality objectives, plus records such as competence, calibration, internal audit results, management review outputs, and corrective actions. Beyond these mandatory items, you keep whatever documented information your processes need to operate effectively. The standard is intentionally flexible, so the exact document set varies by organization.
What is risk-based thinking in ISO 9001?
Risk-based thinking, introduced in the 2015 revision under Clause 6, requires organizations to identify risks and opportunities that could affect QMS outcomes and to plan actions to address them. It replaces the separate “preventive action” requirement of earlier editions by building prevention into planning. ISO 9001:2015 does not mandate a formal documented risk register, but you must show risks were considered.
How long does ISO 9001 certification last?
An ISO 9001 certificate is typically valid for three years, subject to annual surveillance audits that confirm the QMS is being maintained. At the end of the cycle a recertification audit is carried out to renew the certificate. Maintaining conformity between audits is essential to keep the certification active.
Is ISO 9001 changing in 2026?
Yes. A revised edition, ISO 9001:2026, is scheduled to publish on 16 September 2026, with a three-year transition period during which ISO 9001:2015 certificates remain valid (until around 2029). Organizations should continue to work to the current 2015 requirements now and plan their transition once the new edition is available. See our ISO 9001:2026 revision guide for details.