What the clause requires
Interested parties are people or organizations that affect, are affected by, or believe they are affected by the decisions the company takes. Clause 4.2 does not ask for a list of everybody: it asks for the parties that are relevant to the quality management system, meaning the ones that influence the company's ability to deliver conforming products and services and to satisfy the customer. Casting the net too wide is a common mistake, because a matrix with thirty parties and no criterion of relevance is far harder to keep alive than a short list of the five or six that really matter.
For each relevant party the company determines the requirements that matter to the system: what the customer demands in the contract, what the regulator demands by law, what information a critical supplier needs to receive, what employees expect in terms of working conditions. Those requirements have to be monitored and reviewed, because they change. A new contract, a new regulation or a new certification demanded by a customer can add obligations from one month to the next, and a matrix frozen two years ago will show none of it.
The usual output is a matrix with five columns: the interested party, its need or expectation, whether that turns into a binding requirement, how the company meets it and how it is monitored. The connection with the rest of the system is what the auditor checks. Statutory and regulatory requirements identified here have to appear as controls inside the processes; expectations the company decided to take on have to be visible in the risks and opportunities and in the quality objectives. A matrix that ends in itself proves nothing at all.
What changes in ISO 9001:2026
In ISO 9001:2026 climate change also enters as a possible requirement of interested parties: customers, investors and regulators may have climate-related demands that have to be taken into account. See everything that changed in the revision.
What the auditor asks to see
- A list of the interested parties that are relevant to the quality management system
- The requirements of each party: contractual, statutory, regulatory and those the company sets itself
- How each requirement is monitored, and by whom
- Periodic review of the matrix, showing the date it was last updated
- Consistency between the statutory requirements listed and the controls inside the processes
Where companies most often get it wrong
- A huge list of parties with no criterion for what counts as relevant
- Needs copied from a generic template ("society expects jobs")
- Statutory requirements listed with no corresponding control anywhere in the system
- A matrix not reviewed after a relevant change, such as a new customer or a new regulation
Example of a nonconformity
- Requirement
- ISO 9001, 4.2: monitor and review the information about the interested parties and their relevant requirements.
- Evidence
- The 2024 interested parties matrix lists "automotive customers" with generic requirements; the new customer signed in 02/2026 requires PPAP and batch traceability, requirements that appear neither in the matrix nor in the procedures.
- Finding
- The requirements of a relevant interested party were not identified or incorporated into the system.
How to comply using PrismaBiz
Ready-made templates for this clause
Frequently asked questions
Which interested parties are mandatory?
No list is imposed. The customer is almost always relevant; regulators, critical suppliers, employees and shareholders usually are. The criterion is the impact on the quality management system.
Do I have to meet every expectation?
No. The company decides which expectations become requirements that it commits to meeting. Statutory and contractual requirements are mandatory.
How do I monitor the interested parties?
With the sources you already have: contracts, satisfaction surveys, complaints, tracking of legislation, supplier evaluations and meetings with employees.