What the clause requires
The quality policy is top management's statement of what the company intends to do about quality. Clause 5.2 asks for it to be appropriate to the purpose and context of the organization and to support its strategic direction, to provide a framework for setting the quality objectives, and to include two mandatory commitments: to satisfy applicable requirements and to continually improve the quality management system. Everything else in the wording is free, which is exactly why so many policies end up saying nothing at all. It is also one of the few pieces of documented information the standard names by title.
The policy has to be maintained as documented information, communicated, understood and applied within the organization, and made available to relevant interested parties as appropriate. "Understood" is the word that brings most companies down in an audit. The auditor does not ask whether the policy is framed on the wall; the auditor asks an operator what the policy means for the work he does every day. If the answer is a blank look, the policy has been published but not communicated, and the finding writes itself.
A good policy is short and specific. Generic phrases such as "we pursue excellence" are useless when the time comes to set objectives, because nothing measurable follows from them. A construction company can commit to delivery dates and to the performance of the finished building; a testing laboratory can commit to the reliability of its results; a distributor can commit to order accuracy. Each commitment should cascade into at least one measurable quality objective, and that is the trail the auditor follows: policy, objective, target, plan, result.
What changes in ISO 9001:2026
In ISO 9001:2026 the policy is tied more explicitly to the context and the strategic direction of the organization. A generic policy becomes even harder to defend. See everything that changed in the revision.
What the auditor asks to see
- The policy maintained as documented information, approved by top management and dated
- The two mandatory commitments: satisfying applicable requirements and continual improvement
- Quality objectives that clearly cascade from the commitments in the policy
- Communication: induction, noticeboards, meetings, and people able to explain it
- The policy available to relevant interested parties where appropriate, such as the website or contracts
Where companies most often get it wrong
- A policy copied from another company, with no connection to this business
- Commitments that never turn into a single measurable objective
- Employees who cannot say what the policy means for their own work
- A policy never reviewed after a change in the strategy of the company
Example of a nonconformity
- Requirement
- ISO 9001, 5.2.2 b): the quality policy shall be communicated, understood and applied within the organization.
- Evidence
- Five employees from production and dispatch were interviewed; none was able to say how the policy ("deliver on time with zero defects") relates to their activities, and the induction of new employees does not cover the policy.
- Finding
- The quality policy is not understood by the people in the organization.
How to comply using PrismaBiz
Ready-made templates for this clause
Frequently asked questions
Does the policy have to be signed?
The standard does not require a signature. It requires the policy to be established by top management; a signature is simply the easiest way to evidence that.
Do employees have to memorise the policy?
No. They have to understand what it means for their own work. Being able to explain it in their own words is worth more than reciting it.
Can I have an integrated policy for quality, environment and safety?
Yes, provided the commitments required by ISO 9001 are present in it.