International Organization for Standardization International Accreditation Forum

Date: 13 January 2016

ISO 9001 Auditing Practices Group

Guidance on:
Policy, Objectives and Management Review

1. Auditing quality policy

The quality policy and its effective deployment can only be truly assessed based on the
overall results of the audit.

Audit methods should include:

Interviewing Top Management to understand their approach and commitment to

quality (see also the ISO 9001 Auditing Practices Group paper on Top
Management).

Evaluating, through the records of management review, the commitment and

involvement of Top Management in the establishment, implementation, monitoring
and updating of the quality policy;

Assessing whether Management has effectively translated the quality policy into
understandable words and guidelines at all levels of the organization, with
corresponding objectives at each applicable process/ function / level;

Conducting interviews with persons to verify if they have the required awareness,
understanding and knowledge of the way the organizations quality policy relates to
their own activity, regardless of the terms used by such people to express their
understanding. Do not ask persons to recite the quality policy.

Collecting evidence of effective dissemination of the quality policy by appropriate

communication

Appropriate conclusion of effective dissemination and understanding of the quality policy can
only be attained at the end of the audit, after evaluation of audit results.

ISO & IAF 2016 All rights reserved 1

www.iaf.nu; www.iso.org/tc176/ISO9001AuditingPracticesGroup
2. Auditing quality objectives

Auditors need to verify that the organizations overall quality objectives:

have been defined,
reflect the quality policy,
are substantially coherent,
are aligned and compatible with the organizations context and strategic direction,
and are aligned with its overall business objectives, including customer expectations.

If this is not the case, the auditors should further evaluate Top Management commitment to
quality.

Quality objectives are to be measurable and verifiable, but not necessarily quantified.
Qualitative results may also be relevant, e.g. an answer of yes/no regarding achieving
objectives is acceptable, providing it is supported by evidence.

There is no specified way of identifying or documenting quality objectives, as these may

appear through business plans, management review outputs, annual budgets, etc. It is up to
the auditors to satisfy themselves that the objectives are adequately documented.

The auditors should obtain evidence of the way the quality objectives are suitably cascaded
throughout the organizations structure and processes, linking the general strategic
objectives to management objectives and down to specific operational activities.

It is recommended that the documented information relating to the quality objectives should
be examined at the stage of the audit when the organizations documented information is
reviewed.

Before the end of the audit, the auditors have to satisfy themselves that the quality objectives
are realistic and relevant, and that the organization has assigned to responsible people the
resources needed to meet their objectives. Evidence of this should be obtained at all levels
of the organization.

Quality objectives are not static and need to be updated in the light of the current business
climate and the quest for continual improvement. Auditors should verify that the overall
performance of the organization reflects the aims of the quality policy and reasonably meets
the quality objectives.

Auditors should also keep in mind that there is a clear link between the dynamic aspects of
revising the quality policy, the quality objectives and the commitment of the organization to
improvement.

3. Auditing Management Review

ISO 9001 requires top management to review the organization's quality management
system, at planned intervals, to ensure its continuing suitability, adequacy and effectiveness.
The review could be carried out at a separate meeting but this is not a requirement of the
standard. There are many ways in which Top Management can review the quality
management system, such as receiving and reviewing a report generated by the
management representative or other personnel, electronic communication, or as part of
regular management meetings where issues such as budgets and targets are also
discussed.

The management review is a process that should be conducted and audited utilizing the
process approach. Organizations need to be able to demonstrate that they have evaluated
ISO & IAF 2016 All rights reserved 2
www.iaf.nu; www.iso.org/tc176/ISO9001AuditingPracticesGroup
the effectiveness of actions taken to address risks and opportunities during management
review; consequently auditors will be able to obtain objective evidence on the use of this
approach.

ISO 9001 specifies a number of inputs to the management review process and these topics
need to be addressed; however, these are not the only subjects that can be included in a
review. It is also acceptable not to address them individually or simultaneously but as part of
an overall review of the business. Auditors should be aware that the inputs could be in many
forms such as reports, trend charts and so on.

As outputs from the management review process, there should be evidence of decisions
regarding:
changes to the quality policy and objectives,
plans and possible actions for improvements,
change of resources,
revised business plans,
budgets.

The outputs may not be only related to improvements or changes, but could also include
decisions on other important issues, such as plans to introduce new products.

Documented information on management reviews is required, but the format of this is not
specified; minutes of meetings are the most common type, but electronic records, statistical
charts, presentations etc. could be acceptable types.

The management review process might also include elements of quality management
system planning, where changes to processes and systems are being considered. Where
this is the case, the auditors should review whether or not the following points have been
considered:

Will changes to the management system, or the business as a whole, have an impact
on other parts of the system or business?
Are proposed changes evaluated before implementation?
In preparing strategic plans, are issues such as those in clause 4 Context of the
organization of the standard considered?
Are the controls needed identified before the outsourcing of a process is begun?

The management review process should not be an exercise carried out solely to
satisfy the requirements of the standard and the auditors; it should be an integral part
of the organizations business management process. An overall management review is a
complex process carried out at various levels in the organization. It will always be a two-way
process, generated by top management with inputs from all levels in the organization. These
activities could vary from daily, weekly, monthly, organizational unit meetings to simple
discussions or reports.

Auditors should look for evidence that the inputs and outputs of the management review
process are relevant to the organizations size and complexity and that they are used to
improve the business. Auditors should also consider how the organizations management is
structured and how the management review process is used within this structure.

ISO & IAF 2016 All rights reserved 3

www.iaf.nu; www.iso.org/tc176/ISO9001AuditingPracticesGroup
For further information on the ISO 9001 Auditing Practices Group, please refer to the paper:
Introduction to the ISO 9001 Auditing Practices Group

Feedback from users will be used by the ISO 9001 Auditing Practices Group to determine
whether additional guidance documents should be developed, or if these current ones should
be revised.

Comments on the papers or presentations can be sent to the following email address:
charles.corrie@bsigroup.com .

The other ISO 9001 Auditing Practices Group papers and presentations may be downloaded
from the web sites:

www.iaf.nu
www.iso.org/tc176/ISO9001AuditingPracticesGroup

Disclaimer

This paper has not been subject to an endorsement process by the International
Organization for Standardization (ISO), ISO Technical Committee 176, or the International
Accreditation Forum (IAF).

The information contained within it is available for educational and communication purposes.
The ISO 9001 Auditing Practices Group does not take responsibility for any errors, omissions or
other liabilities that may arise from the provision or subsequent use of such information.

ISO & IAF 2016 All rights reserved 4

www.iaf.nu; www.iso.org/tc176/ISO9001AuditingPracticesGroup