ISO 9001 Clauses 4 to 10 in Plain Language: What Each One Asks of a Small Business

Open ISO 9001:2015 and the first three clauses will not ask you to do anything. Clause 1 states the scope of the standard, clause 2 points to a reference document, clause 3 defines terms. The requirements — the parts an auditor can raise a finding against — start at clause 4 and run to clause 10. Seven clauses. That is the whole audit.

They follow a simple loop. Clauses 4 to 7 are the planning. Clause 8 is the doing: delivering the product or service. Clause 9 is the checking. Clause 10 is the fixing and improving. Auditors call this the Plan-Do-Check-Act cycle, and once you see it, the standard stops reading like a rule book and starts reading like a sequence.

This walk-through follows the 2015 edition, clause by clause, in plain words. For each clause I will tell you three things: what it asks, what it looks like in a business of about fifteen people, and what an auditor will typically ask to see. If you have not yet settled whether ISO 9001 is even the standard your buyers want, read our guide on which ISO certification your business needs first. If 9001 is settled, start here.

Clause	Title	The ask, in one line
4	Context of the organisation	Know your situation, your interested parties, and the scope of your system
5	Leadership	Top management owns quality personally — policy, customer focus, clear roles
6	Planning	Face risks and opportunities, set measurable quality objectives, plan changes
7	Support	Give the system people, competence, equipment and controlled documents
8	Operation	Run delivery under control, from order review to release
9	Performance evaluation	Measure results, audit yourselves, review the system at the top
10	Improvement	Remove the causes of failure and keep improving the system

Clause 4 — Context of the organisation: know where you stand

Clause 4 asks you to understand your own business before you build a system on top of it. Sub-clause 4.1 asks you to name the internal and external issues that affect your ability to deliver consistent quality — a key machine that keeps breaking down, a single supplier you depend on, a new regulation in your sector, the skilled operator who is about to retire. Sub-clause 4.2 asks who else has a stake: your customers, regulators, suppliers, your own people — the interested parties — and what each of them requires of you. Sub-clause 4.3 asks you to fix the scope of your quality management system: which products, services and sites it covers. Sub-clause 4.4 asks you to map your processes — what goes in, what comes out, how they connect, who owns each one.

Owners often tell me this clause feels like homework. It is not. Think of it the way you would before a long drive in the monsoon: you check the road, the weather, the vehicle and who is travelling with you — not to write an essay on rain, but so nothing on the journey surprises you. Clause 4 is that check, done for the business. Risk-based thinking, the idea the 2015 edition is known for, starts here: you cannot plan for risks you have not first admitted exist.

In a 15-person business, clause 4 is usually two pages. One lists your main issues and interested parties, with what each party needs. The second is your scope statement — one short paragraph, kept as documented information. It matters more than its length suggests: your certificate will repeat it, and your customers will read it.

The auditor will ask: show me your scope. How did you decide these issues matter? What changed since last year? A context page describing the business of three years ago invites a hard conversation.

Clause 5 — Leadership: the owner cannot delegate this one

Clause 5 puts the quality system on top management's desk, personally. Sub-clause 5.1 asks leadership to take accountability for whether the system works, to keep the focus on the customer, and to make sure quality is part of how the business runs — not a side project run by one junior employee. Sub-clause 5.2 asks for a quality policy: a short written commitment, suited to your business, that frames your objectives and is known to your people. Sub-clause 5.3 asks that roles, responsibilities and authorities are assigned and understood.

The 2015 edition removed the old idea that one management representative could carry the system for everyone. There is no escape route now. If the owner cannot explain the policy in their own words, no file will cover the gap.

In a 15-person business, this looks like a one-page policy signed by the owner, displayed where the team can see it, and a simple chart or list that says who is responsible for sales, production, purchasing, dispatch and quality. Fifteen people do not need an organisation chart with boxes and arrows. They need names against duties, with no duty left ownerless.

The auditor will ask: the owner, directly — what is your quality policy, what are your current objectives, what did the last review decide? Then they will ask two or three staff members who does what. The answers need to match.

Clause 6 — Planning: risks, objectives, and changes with a plan

Clause 6 turns clause 4's understanding into action. Sub-clause 6.1 asks you to work out the risks and opportunities that could affect your results — building on the issues and interested parties from clause 4 — and to plan what you will do about them. Sub-clause 6.2 asks for quality objectives that are measurable, set at the levels that matter, with a simple plan for each: what will be done, what it needs, who owns it, by when, and how you will know it worked. Sub-clause 6.3 asks that changes to the system are planned and carried out in a controlled way, not improvised.

One relief, stated plainly: the standard does not order you to maintain a formal risk register or use any particular risk method. A simple table that your team actually updates beats a colour-coded matrix nobody opens. What you must be able to show is that risks were thought about and acted on.

In a 15-person business, clause 6 is a one-page risk and opportunity list — say, eight to twelve honest entries with an action and an owner against each — and an objectives sheet with three or four numbers on it. On-time delivery at 95%. Rework below 2%. Complaints answered within two working days. Numbers your team already cares about, written down and reviewed.

The auditor will ask: pick one risk and show me the action you took. Show me last quarter's objective results. Vague objectives fail here — "improve quality" cannot be measured, so it cannot be audited, so it does not count.

Clause 7 — Support: people, competence, and documents under control

Clause 7 is the supply line of the system. Sub-clause 7.1 covers resources: the people, infrastructure, work environment and knowledge the system needs — and, under 7.1.5, the measuring equipment you rely on, kept accurate and calibrated where traceability matters. Sub-clause 7.2 covers competence: each person must be competent for their work on the basis of education, training or experience, and you keep evidence of it. Sub-clause 7.3 covers awareness: your people should know the policy, the objectives and what happens if the system is not followed. Sub-clause 7.4 covers communication — who communicates what, when, and to whom. Sub-clause 7.5 covers documented information: creating it, updating it, and controlling it, so the current version is the one in use and old versions do not drift back onto the floor.

The 2015 edition uses that one term, documented information, for both kinds of paper: documents you maintain, like procedures, and records you retain, like a calibration certificate. Our ISO 9001 documents checklist lists both sets in full. Keep the set lean. A fifteen-person company that documents everything documents nothing well.

In a 15-person business, clause 7 looks like a competence matrix — names down one side, jobs across the top, ticks where a person is trained and signed off — a training record for each person, and a calibration record for the one vernier, gauge or weighing scale your quality depends on. Plus one shared, controlled folder. That is usually enough.

The auditor will ask: show me the training record of the person who did this job. Show me the calibration record for that instrument. Show me the current version of this procedure — and convince me the old one is gone.

Clause 8 — Operation: where the work itself is controlled

Clause 8 is the largest clause, and the only one where leaving a requirement out is a real conversation. It governs delivery end to end. Sub-clause 8.1: plan and control your processes. Sub-clause 8.2: agree the customer's requirements properly, and review them before you commit. Sub-clause 8.3: control design and development, if you design. Sub-clause 8.4: control what you buy and what you outsource — your suppliers' failures arrive at your customer's door with your name on them. Sub-clause 8.5: produce or serve under controlled conditions, with identification and care of customer property where it applies. Sub-clause 8.6: release the product or service only after the planned checks pass, with a named person authorising release. Sub-clause 8.7: when output goes wrong, identify it, keep it apart, and decide its fate on record — never let it slip out quietly.

Now the exception, stated carefully, because it is widely misused. Under clause 4.3, you may treat a requirement as not applicable only when it genuinely cannot apply to your work and leaving it out does not affect your ability or responsibility to deliver conforming products and services and keep customers satisfied. You must justify it in your scope statement. The classic case is 8.3: a job-work unit machining strictly to customer drawings does no design, so design and development can be recorded as not applicable. A trading firm with no measuring equipment sometimes makes the same case for parts of 7.1.5. What you cannot do is drop a clause because it is inconvenient, expensive, or outsourced — an outsourced process stays inside your control duties under 8.4. Auditors test every claim of non-applicability, and a false one is a serious finding.

In a 15-person business, clause 8 is your daily paperwork done properly: an order review note before acceptance, an approved supplier list with a yearly re-check, job cards or service checklists, a final inspection or sign-off before dispatch, and a small register for rejected pieces and what was decided about them.

The auditor will ask: pick any recent order and walk me through it — enquiry, review, purchase, production, checks, release. Then: show me a rejected piece and its record. Clause 8 is audited by following real work, not by reading your manual.

Clause 9 — Performance evaluation: check the system before someone else does

Clause 9 asks whether the system is working, with evidence. Sub-clause 9.1: decide what to monitor and measure, measure it, and evaluate the results — including, under 9.1.2, how satisfied your customers are. Sub-clause 9.2: run internal audits at planned intervals, with auditors who do not audit their own work, and report the results to management. Sub-clause 9.3: top management reviews the whole system at planned intervals — audit results, customer feedback, process performance, nonconformities, risks, the resources needed — and leaves with decisions and actions on record.

Small companies stumble here in a predictable place: they run the business well and review it badly. A review that produced no minutes and no decisions is, to an auditor, a review that did not happen. Our ISO 9001 internal audit guide covers 9.2 in depth, including who audits the owner's own work when the team is small.

In a 15-person business, clause 9 looks like a complaints and feedback log that someone actually reads, a simple internal audit programme covering the whole system across the year, and one honest management review meeting with two or three pages of minutes. The minutes are the artefact the auditor reaches for first.

The auditor will ask: show me the last management review minutes. What did you decide, and did it happen? Show me your internal audit reports — and show me one finding you closed.

Clause 10 — Improvement: fix the cause, not only the incident

Clause 10 closes the loop. Sub-clause 10.1 asks you to identify and act on opportunities to improve. Sub-clause 10.2 is the working heart of it: when a nonconformity occurs — a defect, a complaint, an audit finding — you react and control it, then evaluate whether action is needed to remove its cause so it does not recur, act on that, check whether the action worked, and update your risks if the picture changed. Records of the nonconformity, the action and the result must be kept. Sub-clause 10.3 asks for continual improvement of the system itself, using what clauses 9 and 10.2 have taught you.

Notice what is missing: there is no separate preventive action clause in the 2015 edition. Prevention did not disappear. It moved — into clause 6, where you plan for risks before they become nonconformities. An auditor who hears "we will be careful next time" as your corrective action has heard nothing. Care is not a cause removed.

In a 15-person business, clause 10 is a corrective action register: date, what went wrong, the immediate fix, the cause you found, the change you made, and a later check confirming the problem stayed away. Five honest entries a year teach you more than fifty closed in a hurry before the audit.

The auditor will ask: show me a closed corrective action and how you verified it worked. Repeat failures are what they are hunting — the same defect, the same complaint, quarter after quarter, with a fresh signature each time.

Which edition are you reading — 2015 or 2026?

This walk-through follows ISO 9001:2015 because that is the edition most certificates in India still run on today. ISO published a 2026 edition on 16 September 2026. It keeps the same clauses 4 to 10 and the same skeleton — every explanation above still points the right way — while tightening a few areas, including quality culture in leadership and climate considerations in clause 4. Businesses holding 2015 certificates have a transition window running to around September 2029. If you are certifying fresh, ask your certification body which edition your audit will run against before you build your files.

Two honest limits before you budget for any of this. An ISO 9001 certificate is not a government licence, and it guarantees no order, no tender and no customer. It is evidence, checked by an accredited body, that your quality runs as a system. Buyers treat it that way, and so should you.

If you want these seven clauses turned into a working system — documents sized to a small team, a proper internal audit, preparation for Stage 1 and Stage 2 — our ISO 9001 certification support starts at ₹9,999 for the Standard tier (up to 25 employees) and ₹19,999 for the Growth tier (26 to 100 employees), with certification body audit fees charged separately at actuals. Bring us your current paperwork first. In most small companies, half of clause 7 and clause 8 already exists — it just has no names, dates or owners yet.