What the clause requires
Clause 9.1.3 requires the organization to analyze and evaluate appropriate data and information arising from monitoring and measurement. The results of that analysis have to be used to evaluate seven things: the conformity of products and services; the degree of customer satisfaction; the performance and effectiveness of the quality management system; whether planning has been implemented effectively; the effectiveness of actions taken to address risks and opportunities; the performance of external providers; and the need for improvements to the quality management system.
The standard notes that the methods used may include statistical techniques, but nothing sophisticated is required. A trend chart, a Pareto of nonconformities by type, a comparison with the same period last year and a simple stratification by product line, by shift or by customer are usually enough to see what is actually happening. What matters is that the analysis reaches a conclusion and that the conclusion leads to a decision, rather than producing a thick pack of charts with no interpretation attached to any of them. Data that nobody has drawn a conclusion from has not been analyzed, it has only been collected and formatted.
This clause is the bridge between measuring, in 9.1.1, and deciding, in 9.3. A practical way to meet it is to prepare, before the management review, a short report that walks through each of the seven items in turn with the data behind it, the conclusion reached and a proposed action where one is needed. The auditor then checks two things: that all seven items were genuinely evaluated and not merely mentioned, and that the conclusions written down are consistent with the data presented alongside them. Two of the seven, the effectiveness of risk actions and the performance of external providers, are the ones most often missing.
What the auditor asks to see
- Analysis of data explicitly covering all seven items listed in the clause, item by item
- Trend charts, Pareto analysis or stratification used wherever they add understanding
- Conclusions and proposed actions recorded, not just the raw figures and the charts
- The result of the analysis carried forward as an input to the management review
Where companies most often get it wrong
- Evaluation of external providers or of the effectiveness of risk actions quietly left out
- Data presented in charts with no conclusion drawn from any of them
- Analysis performed hastily in the week before the external audit, to produce a record
- A negative trend going unnoticed because no comparison with earlier periods is ever made
Example of a nonconformity
- Requirement
- ISO 9001, 9.1.3 e): the results of analysis shall be used to evaluate the effectiveness of actions taken to address risks and opportunities.
- Evidence
- The data analysis report feeding the 2026 management review covers conformity, customer satisfaction and external providers, but does not evaluate the effectiveness of any of the 9 actions listed in the risk matrix.
- Finding
- The analysis of data does not cover the effectiveness of actions taken to address risks and opportunities.
Ready-made templates for this clause
Frequently asked questions
Are statistical techniques mandatory?
No. The standard says the methods may include statistical techniques. Simple charts and comparisons are usually enough, provided they support a defensible conclusion.
Where should the analysis be recorded?
In a data analysis report, or directly in the management review record, as long as the document covers all the items listed in the clause.
What is the difference between 9.1.3 and 9.3?
Clause 9.1.3 analyzes the data and draws conclusions. Clause 9.3 is top management deciding what to do about those conclusions.