What the clause requires
Clause 5.3 asks top management to assign, communicate and make understood the responsibilities and authorities for the relevant roles. The standard lists what has to be covered: making sure the quality management system conforms to the requirements of the standard; making sure the processes deliver their intended outputs; reporting the performance of the system and the opportunities for improvement to top management; promoting customer focus throughout the organization; and maintaining the integrity of the system when changes are planned and implemented. Those five items are a checklist an auditor can run through, and usually does.
These responsibilities can sit with one person, the role that used to be called the management representative, or be shared among several roles. What matters is that they are assigned to somebody with enough authority to act, and that the people concerned know it. The 2015 version removed the obligation to nominate a management representative, but it did not remove the duties: somebody still has to report on the system. Final accountability for the effectiveness of the system remains with top management under clause 5.1 and cannot be delegated.
The usual tools are the organization chart, the job descriptions and a responsibility matrix by process. The auditor tests them in practice rather than on paper: who is allowed to release a product with a deviation, who approves a document, who decides what happens to a nonconformity. The answers given on the shop floor are then compared with what is written. When two people claim the same authority, or nobody claims it, the finding is not that the chart is missing; it is that the responsibilities are not understood.
What the auditor asks to see
- An organization chart and job descriptions that are actually up to date
- A named owner for each process and for each of the duties listed in the standard
- Authorities defined for critical decisions: release, approval, concession of a deviation
- Evidence that the responsibilities were genuinely communicated to the people concerned
- Reporting of the performance of the system to top management, usually at the management review
Where companies most often get it wrong
- An organization chart still showing people who have left the company
- Nobody assigned to report the performance of the system to top management
- The authority to release product not defined anywhere in the system
- People who do not know their own responsibilities within the system
Example of a nonconformity
- Requirement
- ISO 9001, 5.3: responsibilities and authorities shall be assigned, communicated and understood within the organization.
- Evidence
- The release procedure states that the "quality inspector" releases batches with a deviation; when interviewed, the production supervisor and the inspector both claimed to hold that authority, and batches from 05/2026 were released by each of them.
- Finding
- The authority to release a batch with a deviation is not consistently understood.
How to comply using PrismaBiz
Ready-made templates for this clause
Frequently asked questions
Do I need a management representative?
It is no longer mandatory. The responsibilities listed in clause 5.3 can sit with one person or be shared among several.
Is an organization chart mandatory?
No. It is the simplest way to communicate the structure, but the standard accepts any means that makes the responsibilities clear.
How do I prove the responsibilities were communicated?
Recorded induction, a signed job description, publication on the intranet or the noticeboard, and people who can answer when asked.