What the clause requires
Clause 4.1 opens the standard with a strategic question: what, inside and outside the company, affects its ability to deliver the result the quality management system promises? The organization has to determine those internal and external issues that are relevant to its purpose and to its strategic direction, and then keep track of how they change. This is not a one-off exercise for the certification audit: the standard asks for the information about these issues to be monitored and reviewed, because a market, a technology or a single key customer can change the whole picture within a year.
External issues come from the environment the company operates in: legislation, the market, competitors, technology, the economy, culture, customers and suppliers. Internal issues come from inside: values, culture, knowledge, performance, and the capability of the processes and of the people. They can be positive or negative, and most companies find both inside the same topic. The output of this analysis feeds directly into the risks and opportunities of clause 6.1 and into the scope of the system in clause 4.3, which is why a weak context analysis tends to weaken everything that comes after it.
The standard does not require a specific document or a specific method. SWOT analysis is the most widely used format because it organises strengths and weaknesses (internal) alongside opportunities and threats (external) in a way that top management actually understands. PESTEL and the five forces work just as well, and a structured list is enough for a small company. What the auditor looks for is consistency: do the issues raised in the analysis show up later in the risk assessment, in the quality objectives and in the decisions taken at the management review, or does the document live a life of its own?
What changes in ISO 9001:2026
With the 2024 amendment, carried into ISO 9001:2026, the organization has to determine whether climate change is a relevant issue for its context. It does not require climate action; it requires the relevance to be assessed and the conclusion recorded. See everything that changed in the revision.
What the auditor asks to see
- A record of the internal and external issues, using SWOT, PESTEL or a structured list
- The date of the analysis and evidence that it is reviewed periodically, not only before an audit
- A visible link between the issues identified and the risks and opportunities of clause 6.1
- Changes in the context discussed and minuted at the management review (clause 9.3)
- Participation of top management in the analysis, not only of the quality department
Where companies most often get it wrong
- A SWOT produced once for certification and never revisited afterwards
- Generic issues that would fit any company in any sector ("economic crisis")
- A context determined on paper and then ignored in the risks and in the objectives
- An analysis carried out by the quality team alone, without the view of top management
Example of a nonconformity
- Requirement
- ISO 9001, 4.1: monitor and review the information about internal and external issues.
- Evidence
- SWOT matrix dated 03/2023. Since then the company has lost its largest customer (35% of revenue, 2025) and replaced its management software (2026); neither fact appears in any review of the context or in the 2026 management review.
- Finding
- The internal and external issues are neither monitored nor reviewed.
How to comply using PrismaBiz
Ready-made templates for this clause
Frequently asked questions
Does ISO 9001 require a SWOT analysis?
No. It requires the internal and external issues to be determined and kept under review. SWOT is simply the method most companies use to do that.
How often should the context be reviewed?
The standard asks for monitoring and review without setting a deadline. The reasonable minimum is to review it at the management review and whenever something relevant changes.
Is climate change mandatory in the context analysis?
The company has to assess whether the subject is relevant to it. If the conclusion is that it is not, that conclusion has to be justified.