What the clause requires
Clause 8.2 covers everything that happens before the organization commits to the customer. It starts with communication: providing information about products and services, handling enquiries, contracts and orders including amendments, obtaining customer feedback including complaints, handling or controlling property belonging to the customer, and establishing contingency arrangements when relevant. In practical terms this is the commercial front of the quality system: who answers the customer, through which channel, how quickly, and where that answer is recorded so that production, engineering and purchasing all work from the same version of what was agreed.
The organization then determines the requirements for the products and services it offers: the ones specified by the customer, including delivery and post-delivery requirements; the applicable statutory and regulatory requirements; and the ones the organization itself considers necessary. Before committing to supply, it carries out a review to confirm that it is able to meet the specified requirements, the requirements not stated by the customer but necessary for the known intended use, its own requirements and the legal ones, and that any difference between the purchase order and what was previously quoted has been resolved.
The review has to leave a record of its results and of any new requirement agreed for the products and services. When requirements change, the relevant documented information is amended and the people involved are informed, and this is exactly where most organizations fail: the change reaches the salesperson but never reaches the shop floor. The classic nonconformity in this clause is accepting a delivery date or a specification that the organization cannot meet, because nobody checked capacity, technical capability or material availability before the order was confirmed.
What the auditor asks to see
- Records of the review of orders and contracts, dated before the order was accepted
- Statutory and regulatory requirements applying to the product or service identified and kept current
- Order amendments handled with evidence that every affected area was informed
- Defined channels for communicating with the customer, including enquiries and complaints
- Contingency arrangements defined where relevant, such as alternative supply or backup capacity
Where companies most often get it wrong
- Order accepted without checking capacity for the delivery date or the specification
- Order amendment agreed by telephone and never passed on to production
- A statutory requirement applying to the product is simply not known by anyone
- Difference between the quotation and the purchase order left unresolved at acceptance
Example of a nonconformity
- Requirement
- ISO 9001, 8.2.4: when requirements are changed, ensure that the relevant documented information is amended and that the relevant persons are made aware of the changed requirements.
- Evidence
- Order 4410: on May 12, 2026 the customer changed the plate thickness from 2.0 to 2.5 mm by e-mail; the production order issued on May 14 still specified 2.0 mm, and the batch was rejected at the customer goods-in inspection.
- Finding
- A change to a customer requirement was not incorporated into the documented information and was not communicated to production.
How to comply using PrismaBiz
Ready-made templates for this clause
Frequently asked questions
Does every sale need a documented review?
The standard requires a review before committing to supply and a record of the results. For catalogue sales the review can be simplified, such as confirming availability and lead time, but it still has to happen and still has to leave evidence.
What about online sales?
The standard accepts that a formal review of each individual order may be impractical. In that case the review can instead cover the relevant product information published to the customer, such as the catalogue, the specification and the published terms of sale.
Do customer complaints belong to clause 8.2?
Obtaining customer feedback, including complaints, sits in 8.2.1. Treating that complaint as a nonconformity, finding the cause and taking corrective action sits in 10.2.