ISO 9001:2015 clause 5: Leadership

• Management-review records with top-management attendance and substantive input - verify leaders (not just the quality manager) attend, challenge the data, and make decisions, rather than receiving a presentation and signing off.
• Evidence the QMS is integrated into business decisions - strategic plans, budgets, and resourcing decisions that reflect quality objectives; QMS requirements built into how the business runs, not a parallel 'quality system'.
• Resource decisions - approvals (headcount, equipment, training, improvement projects) showing leadership provides what the QMS needs, with a check on cases where resources were requested and denied.
• Communications from top management about quality - town halls, all-hands, written messages - confirming leaders visibly promote the importance of effective quality management and of meeting requirements.
• Top-management engagement in improvement and corrective action - evidence leaders sponsor improvement initiatives and engage on significant nonconformities, rather than delegating them entirely.

• Major NC: Top management is absent from management reviews or treats them as a quality-department exercise; the quality manager makes and owns all QMS decisions.
• Minor NC: Leadership cannot demonstrate the QMS is integrated with the business; quality runs as a separate compliance system disconnected from strategy.
• Minor NC: Resources needed for the QMS are routinely requested and denied, with quality treated as a cost rather than a business priority.
• Observation: Quality policy and objectives are signed by top management, but there is little other visible leadership involvement or communication about quality.

Review management review attendance records, resource allocation decisions, and internal communications from top management that reference quality objectives or QMS performance.

• How does top management personally demonstrate accountability for the effectiveness of the QMS beyond signing off on documents?
• Can you describe a recent decision where top management prioritized quality over schedule or cost pressures?
• How does top management stay informed about QMS performance between formal management reviews?

• Management review attendance by top management
• Decisions made by top management on QMS issues
• Top management actions on audit findings
• Resource decisions for QMS
• Communications from top management taking ownership

• Top management delegates all QMS decisions
• No top management presence in QMS activities
• Quality manager held accountable instead of top management
• Top management unaware of QMS performance

Review management review minutes for evidence of top management taking ownership of QMS performance issues and directing corrective actions with allocated resources.

• In what specific ways does top management take accountability rather than delegating all QMS responsibilities?
• How does top management respond when audit findings indicate QMS ineffectiveness?

• Quality policy document
• Quality objectives documentation
• Strategic plan showing alignment
• Top management approval of policy/objectives
• Management review of policy/objectives

• No quality policy or objectives
• Policy/objectives disconnected from strategy
• Generic policy not relevant to organization
• Objectives not achievable in current context

Review the quality objectives register and verify that objectives exist for each relevant function, with documented links back to the quality policy commitments.

• How does top management ensure that quality objectives are established at relevant functions and levels?
• What process ensures that the quality policy and objectives are aligned and mutually reinforcing?

• Business processes including QMS requirements
• Strategic plans including quality elements
• Business dashboards with quality metrics
• Process documentation with integrated QMS
• Business decisions considering quality

• QMS separate from business operations
• Two sets of processes (business vs. quality)
• QMS seen as overhead not value
• No quality in business planning

Select one operational process (e.g., procurement, production planning) and verify that QMS requirements are built into the standard operating procedure rather than addressed in a separate quality overlay.

• How has top management ensured that QMS requirements are embedded in business processes rather than treated as a parallel system?
• Can you give an example of a business process where quality requirements are integrated into day-to-day operations?

• Leadership communications mentioning processes/risks
• Meeting minutes showing process/risk discussions
• Training on process approach and risk thinking
• Process maps used in business discussions
• Risk considerations in management decisions

• No awareness of process approach
• Risk not considered in decisions
• Functional silos without process thinking
• Reactive firefighting culture

Review training records or communications from top management promoting process approach and risk-based thinking, then interview two middle managers to assess whether these concepts influence their daily decisions.

• How has top management promoted the process approach throughout the organization?
• What evidence exists that risk-based thinking is applied in operational decision-making, not just in formal risk assessments?

• Budget allocation for QMS activities
• Staffing plans for quality roles
• Resource request approvals
• Capital investment in quality
• Training budget allocation
• Management review discussing resources

• Chronic resource shortages
• QMS resource requests consistently denied
• Understaffed quality function
• No budget for quality improvements

Review the QMS budget allocation or resource plans for the current period, and cross-reference with any unfulfilled resource requests documented in management reviews.

• Has there been a recent instance where a resource request for the QMS was denied, and what was the justification?
• How does the budgeting process account for QMS resource needs including training, equipment calibration, and system maintenance?

• Communications from top management about quality
• Town hall presentations mentioning quality
• Email communications about quality importance
• Quality messages in employee communications
• Leaders discussing quality in meetings

• No communication about quality from leadership
• Quality only mentioned during audits
• Mixed messages about quality priority
• Actions contradict quality communications

Review internal communications (town halls, newsletters, email directives) from top management within the last 12 months for quality-related messaging, and interview two frontline employees about their awareness.

• What specific communication methods does top management use to reinforce the importance of quality management?
• How does the organization verify that these communications are understood and taken seriously at the operational level?

• QMS performance reports to top management
• Management review outputs
• Actions taken when results not achieved
• Quality metrics trending toward objectives
• Evidence of QMS producing conforming products

• QMS not meeting objectives
• No monitoring of QMS results
• Poor results with no management action
• QMS exists but doesn't deliver value

Review the most recent management review output for evidence that QMS effectiveness was evaluated against intended results and that actions were assigned where gaps were identified.

• What evidence demonstrates that the QMS is achieving its intended results, and how does top management monitor this?
• When the QMS has not achieved intended results, what actions has top management directed?

• Employee engagement initiatives
• Quality suggestion programs
• Training and development programs
• Recognition for quality contributions
• Leadership accessibility and engagement

• No employee engagement in quality
• Top-down only approach
• No support for employees
• Employees disconnected from QMS

Review employee engagement survey results, suggestion program records, or improvement team participation data for evidence that personnel are actively contributing to QMS effectiveness.

• How does top management engage and support personnel to contribute to QMS effectiveness?
• What recognition or incentive mechanisms exist to encourage employee contributions to quality improvement?

• Improvement initiatives supported by management
• Leadership communications promoting improvement
• Recognition programs for improvements
• Resources allocated for improvement
• Improvement metrics and trends

• No improvement culture
• Status quo accepted
• Improvement ideas rejected
• No resources for improvement

Review improvement project records, innovation initiatives, or Kaizen event logs for evidence of top management sponsorship or active participation in improvement activities.

• How does top management actively promote improvement beyond formal corrective action processes?
• Can you describe a recent improvement initiative that was championed by top management?

• Management development programs
• Delegation of quality responsibilities
• Manager involvement in quality activities
• Recognition of manager quality leadership
• Manager-level quality objectives and accountability

• Only top management involved in quality
• Managers not empowered for quality
• No quality leadership at department level
• Middle management bypassed on quality

Interview two department managers about the support they receive from top management for quality leadership, and review training or development records related to quality management competence for management roles.

• How does top management support department heads and middle managers in demonstrating quality leadership within their areas?
• What development opportunities or resources are provided to help other managers fulfill their leadership role in quality?

• Evidence top management ensures customer and applicable statutory/regulatory requirements are determined, understood, and consistently met - not just delegated to sales/quality.
• Evidence leadership ensures the risks and opportunities that can affect conformity and customer satisfaction are determined and addressed (link to 6.1).
• Customer-satisfaction data and complaint trends reviewed by top management, with action - showing the focus is maintained, not seasonal.
• Customer-focused objectives owned at leadership level, and evidence management acts on customer issues (visits, escalations, improvement initiatives).
• Evidence customer focus reaches across the organization (operations, design, support), not only the sales department.

• Minor NC: Customer focus lives only in the sales/customer-service function; operations and other areas show no customer-requirement awareness.
• Minor NC: Customer complaints and satisfaction data are not reviewed by top management, so leadership is unaware of customer issues.
• Minor NC: Risks/opportunities affecting conformity and customer satisfaction are not determined or addressed by leadership.
• Observation: Customer satisfaction is declining with no leadership-driven response.

Review customer satisfaction data presented to top management, along with evidence of actions taken in response to negative trends or specific customer complaints.

• How does top management ensure that customer focus permeates the entire organization and is not confined to sales or customer service?
• What mechanisms exist for top management to stay directly informed about customer satisfaction trends?
• How does the organization balance customer requirements with statutory and regulatory obligations when they conflict?

• Customer requirements register
• Regulatory requirements register
• Contract review records
• Product specifications
• Compliance verification records
• Customer satisfaction data showing requirements met

• Requirements not documented
• Staff unaware of requirements
• Recurring failures to meet requirements
• Regulatory requirements unknown

Select a recent customer order or project and trace the flow of customer and regulatory requirements from contract review through to production or service delivery.

• How are customer requirements captured and flowed down to operational processes?
• What process exists for identifying applicable statutory and regulatory requirements for each product or service?

• Risk assessments for customer-related risks
• Actions to address customer risks
• Opportunity analysis for customer satisfaction
• Contingency plans for customer delivery
• Management review of customer risks

• No customer risk assessment
• Reactive only approach
• Opportunities ignored
• Customer risks not monitored

Review the risk register for entries related to product/service conformity and customer satisfaction, and verify that mitigation actions have been implemented and are effective.

• How are risks to product and service conformity identified and addressed at the leadership level?
• What process ensures that risks affecting customer satisfaction are escalated to top management?

• Customer satisfaction monitoring system
• Customer satisfaction trends
• Customer-focused improvement initiatives
• Customer feedback mechanisms
• Management attention to customer issues
• Customer objectives and targets

• Declining customer satisfaction ignored
• No ongoing customer focus
• Customer focus only during audits
• No customer satisfaction measurement

Review customer satisfaction measurement methods (surveys, NPS, complaint rates) and trending data, then verify that improvement actions are tracked and reviewed by top management.

• What metrics does the organization use to measure and monitor customer satisfaction?
• How does top management ensure that customer satisfaction improvement remains a strategic priority?

• The documented quality policy - verify it is appropriate to the organization's purpose and context (reflects what it actually does), and is authorized by top management.
• Evidence the policy provides a framework for setting quality objectives - the objectives can be traced to policy commitments.
• Explicit commitments in the policy to satisfy applicable requirements AND to continually improve the QMS (both must be present).
• Evidence the policy is reviewed for continuing suitability as the organization and context change, not frozen since certification.
• A check the policy is meaningful and usable - not a generic template nobody can connect to the work.

• Minor NC: The quality policy is a generic template that does not reflect the organization's actual purpose or context.
• Minor NC: The policy omits a required commitment - to satisfy applicable requirements, or to continual improvement.
• Minor NC: The policy provides no framework from which quality objectives can be derived.
• Observation: The policy has never been reviewed for continuing suitability.

Obtain the current quality policy document, verify the approval date and signatories, then interview two to three employees at different levels to assess understanding and application.

• When was the quality policy last reviewed, and what prompted any revisions?
• How does the quality policy connect to the organization's strategic direction identified in clause 4.1?
• Can members of the operational workforce articulate the quality policy in their own words?

• Quality policy aligned with organization's actual work
• Evidence policy reviewed against context
• Strategic plan showing policy alignment
• Policy specific to industry/products

• Generic copy-paste policy
• Policy disconnected from strategy
• Policy doesn't reflect actual business
• Policy not reviewed for appropriateness

Compare the quality policy statements against recent strategic planning outputs and verify alignment with the context analysis from clause 4.1.

• How does the organization verify that the quality policy remains appropriate when the business context changes?
• Can you explain how the policy's commitments translate into operational decisions?

• Quality objectives derived from policy
• Clear link between policy and objectives
• Policy statements that enable objectives
• Documentation showing policy-objective relationship

• Policy doesn't support objectives
• No connection between policy and objectives
• Objectives unrelated to policy statements
• Policy too vague for objectives

Select two quality objectives and trace each back to a specific quality policy statement to verify the framework relationship is maintained.

• Can you demonstrate how the quality policy is used as a framework when setting or revising quality objectives?
• How do objective owners trace their objectives back to specific policy commitments?

• Policy statement including commitment to requirements
• Policy text mentioning customer/regulatory compliance
• Explicit requirement satisfaction commitment

• Policy has no commitment to requirements
• Commitment vague or implied only
• Missing regulatory/statutory commitment
• Only customer requirements mentioned

Review the quality policy text for an explicit commitment to meeting applicable requirements, then verify that a register of applicable requirements exists and is current.

• How does the quality policy address compliance with applicable statutory, regulatory, and customer requirements?
• Is the commitment to satisfy requirements general, or does it reference specific categories of requirements relevant to the organization?

• Policy statement with continual improvement commitment
• Policy text mentioning improvement/enhancement
• Explicit QMS improvement commitment

• No mention of improvement in policy
• Only maintenance, no improvement
• Improvement commitment vague
• No QMS improvement mentioned

Verify the policy includes an explicit continual improvement commitment, then review the improvement log for evidence that improvement initiatives reference or align with this commitment.

• How is the commitment to continual improvement operationalized beyond the policy statement?
• Can you point to specific improvement initiatives that were driven by the quality policy commitment?

• Evidence the policy is available and maintained as documented information (controlled, current, accessible).
• Evidence the policy is communicated AND understood within the organization - confirmed by asking staff what it means for their work, not just whether it is posted.
• Evidence the policy is APPLIED - reflected in how decisions and work are actually done, not just displayed.
• Evidence the policy is available to relevant interested parties where appropriate (e.g. on the website, to customers).
• Communication records - induction, training, intranet, displays - showing the policy was actively shared, not passively posted.

• Minor NC: Employees are unaware of the quality policy or cannot explain what it means for their work, so it is communicated in name only.
• Minor NC: The policy is not accessible to the people who need it (locked in an office, not shared at induction).
• Minor NC: The policy is not made available to relevant interested parties where appropriate.
• Observation: The policy is posted but there is no evidence it is applied in actual decisions and work.

Check for the quality policy display at key locations (reception, shop floor, intranet), verify document control records show it is a controlled document, and ask three employees from different departments to explain it.

• Through what channels is the quality policy communicated to all personnel, and how is receipt confirmed?
• How is the quality policy made available to external interested parties when appropriate?
• When was the quality policy last updated, and how was the revised version communicated?

• Quality policy document
• Policy in document control system
• Policy accessible in multiple locations
• Policy version control
• Evidence policy is maintained current

• Policy not documented
• Policy not accessible
• Policy out of date
• No version control on policy

Verify the quality policy is registered in the document control system with current revision status, approval date, and authorized signatories.

• Is the quality policy maintained under document control with revision history and approval signatures?
• Where is the documented quality policy stored, and who has access?

• Communication records (orientation, training)
• Policy posted in facilities
• Employee awareness verification
• Policy in employee materials
• Evidence of policy application in decisions

• Employees unaware of policy
• Policy not communicated
• No understanding of policy meaning
• Policy not applied in practice

Interview employees at three organizational levels (management, supervisory, operational) and assess whether they can explain how the quality policy applies to their specific role.

• What methods are used to ensure the quality policy is not just communicated but understood and applied?
• How does the organization assess whether personnel at all levels can relate their work to the quality policy?

• Policy on company website
• Policy available on request
• Policy shared with customers/suppliers
• External access to policy documented

• Policy not available externally at all
• Refusal to share policy when requested
• No external access mechanism

Verify the quality policy is accessible to relevant external parties (e.g., posted on the website, included in supplier agreements, available on request) and confirm the version matches the internal controlled copy.

• Which external interested parties have been provided access to the quality policy, and through what means?
• Is the quality policy published on the organization's website or included in customer-facing documentation?

• Evidence responsibilities and authorities for relevant roles are assigned, communicated, and understood - job descriptions, a RACI, or process-owner assignments, confirmed by asking people what they own.
• Specific assignment of authority for ensuring the QMS conforms to ISO 9001 and for reporting QMS performance to top management (the named 5.3 responsibilities).
• Assignment of authority for ensuring processes deliver intended outputs (process owners) and for promoting customer focus across the organization.
• Assignment of authority for maintaining QMS integrity when changes are planned and made.
• Evidence authority matches responsibility - people held accountable for outcomes actually have the authority to act.

• Minor NC: Roles and responsibilities for the QMS are not assigned or communicated, so accountability is unclear.
• Minor NC: No one is assigned authority for ensuring QMS conformance or for reporting QMS performance to top management.
• Minor NC: Responsibility is assigned without matching authority, so owners cannot actually act.
• Observation: All QMS responsibility effectively rests with the quality manager, with no distribution to process owners.

Review the organizational chart, responsibility assignment matrix, and job descriptions for key quality roles; interview two role holders to confirm they understand their authority boundaries.

• How are roles, responsibilities, and authorities communicated to personnel, and how is understanding verified?
• What happens when a key quality role becomes vacant, and how is continuity ensured?
• Are there any responsibilities that overlap or create conflicts of interest between roles?

• Assignment of QMS conformance responsibility
• Job description for quality role
• Organizational chart showing quality function
• Documentation of responsibility assignment

• No one assigned this responsibility
• Responsibility unclear or informal
• No authority to act
• QMS conformance nobody's job

Verify the appointment of the management representative or equivalent role, and review evidence of their reporting to top management on QMS conformity.

• Who has been assigned responsibility for ensuring QMS conformity to ISO 9001, and what authority do they have to stop nonconforming work?
• How does this person escalate systemic QMS issues to top management?

• Process ownership assignments
• Process documentation with owners identified
• Performance metrics by process
• Process owner accountability

• Processes with no owners
• Owners not accountable for results
• No monitoring of process outputs
• Process failures without accountability

Interview one process owner and verify they can demonstrate current process performance data, recent process changes, and how deviations are managed.

• How do process owners ensure that their processes deliver intended outputs consistently?
• What reporting mechanism exists for process owners to flag when processes are not performing as planned?

• QMS performance reports
• Management review input reports
• Regular quality reports to leadership
• Improvement recommendations

• No reporting to top management
• Top management unaware of QMS status
• No regular performance updates
• No one responsible for reporting

Review the last two QMS performance reports submitted to top management and verify they cover key metrics including customer satisfaction, process performance, and nonconformity trends.

• Who is responsible for reporting on QMS performance to top management, and how frequently does this reporting occur?
• What format does the performance reporting take, and does it include both quantitative metrics and qualitative assessments?

• Assignment of customer focus responsibility
• Customer communication activities
• Customer awareness training
• Customer focus programs

• Customer focus only in sales
• No one promoting customer awareness
• Customer feedback not shared
• Customer issues hidden from organization

Interview personnel in a non-customer-facing function (e.g., warehouse, maintenance) and assess whether they understand how their work affects customer satisfaction.

• How is customer focus promoted across functions that do not have direct customer contact?
• What mechanisms exist for customer feedback to reach personnel in production, design, or support functions?

• Change management process including QMS
• QMS impact assessment for changes
• Documentation updates after changes
• Verification of QMS after changes

• QMS ignored during organizational changes
• Changes break QMS processes
• Documentation not updated
• No QMS oversight of changes

Review records from a recent organizational change (restructuring, system migration, process redesign) and verify that QMS integrity was explicitly considered and maintained throughout the transition.

• How is QMS integrity maintained during organizational changes such as restructuring, mergers, or system transitions?
• What change management controls exist to prevent uncontrolled changes that could compromise QMS integrity?