How to Implement ISO 9001 Clause 5 & 7 Leadership and Resources
If you are starting ISO certification, you are moving into implementation. By this stage you should already have a Quality Management System (QMS) that meets the general requirements described in Clause 4, plus the continual improvement processes described in Clauses 9 and 10. Now is a good time to implement ISO 9001 Clause 5 & 7 leadership and resources.
Ask yourself a blunt question before you start: does your top management treat the QMS as their system, or as the quality department’s paperwork? Clause 5 and Clause 7 are where that answer shows up, because both clauses are long on stated obligations and short on required documents. You cannot pass them by producing another binder.
ISO 9001 Leadership and Resources
By breaking the implementation into stages, the process becomes more manageable and less overwhelming. First you build the foundation processes, followed by the continual improvement processes, and now you address the management and resources process.
| Phase One | Foundation Processes (ISO 9001 Clause 4) |
| Phase Two | Continual Improvement Processes (ISO 9001 Clause 6 and 10) |
| Phase Three | Management Resources (ISO 9001 Clause 5 and 7) |
| Phase Four | Data Management (ISO 9001 Clause 8) |
Meeting quality standards with ISO 9001 leadership focuses on implementing the requirements of Clause 5, Leadership, and Clause 7, Support. While there are a number of required documents you created (currently in draft form) to meet the requirements of Clauses 4, 9 and 10, Clauses 5 and 7 are long on stated requirements (“Top Management shall …”, “The organization shall …”), but they have few required documents.
Management Commitment is Vital to ISO 9001 Success
In Clause 5, the responsibilities of meeting the requirements of the ISO 9001 QMS sit squarely on the shoulders of top management. Anyone familiar with how organizations actually function knows that the success or failure of any organizational endeavor depends on management commitment. The same conclusion sits at the center of the Baldrige leadership criteria published by NIST, which treat senior leadership behavior as the primary driver of performance results.
Top Management
Top management is ultimately responsible for the QMS. If they do not see the QMS as important or a priority, it becomes starved for resources and eventually dies. Whatever top management focuses on, however, becomes a priority for the whole organization. That is certainly true for implementing, maintaining, and improving the ISO 9001 QMS.
Management Review
There are few documentation requirements relating to management review in Clause 9, including a management review meeting record. Otherwise, there is the Quality Policy showing management’s commitment and responsibility. Most of the requirements are generalized to providing evidence of commitment, so the meeting agenda, the attendance list, and the decisions recorded are what an auditor will ask to see.
ISO 9001 Application Depends on the Organization
Many organizations struggle with general “shall statement” requirements. In contrast with specific, straightforward requirements (for example, internal audit includes responsibilities and requirements for planning and conducting internal audits, establishing records and reporting results), these more general “shall statements” require organizations to come up with their own method of compliance.
One way to deal with these less specific requirements is to convert “shall statements” into questions. Top management has to answer the question, “How do we ensure appropriate communication processes are established and that communication takes place regarding the effectiveness of the QMS?” according to Clause 7.4.
The formal language in the standard seems intimidating and adds to the difficulty. Appropriate communication processes? Most organizations already have communication processes; it is just a matter of recognizing them and being aware that those activities meet a requirement of ISO 9001.
For example, perhaps you have monthly department head meetings, and departments have weekly staff meetings. Perhaps you have an online or a printed quality newsletter. These are all communication processes.
Focus on ISO Compliance, Not Unnecessary ISO Documentation
So in a sense, implementation is about reviewing and considering the ISO requirements in Clause 5 and Clause 7, and then recognizing how your organization meets them. That is how you become ISO 9001 compliant. You do not have to have documents in order to comply, unless you feel they are important for the needs of your organization. Simple narratives will do just fine. Just be able to explain your answer.
Obviously, as you work through this, when you recognize a weakness or an area of non-compliance, then it may be time to implement new or altered methods. But as in the communication example, frequently organizations are already doing things that comply with the requirements. It is just a matter of being cognizant of them, plus knowing what evidence exists that verifies compliance.
Fulfilling the requirements of Clause 7, Support, requires a similar approach. Phrase the “shall statements” as questions and then give reflective responses. For Clause 5 and 7 you may want to capture these responses in notes for your own purposes or for training, but there is no requirement to do so.
In terms of compliance, just be sure you can answer the question appropriately when the internal or external auditor asks, and that other members of the organization give answers that are consistent with your compliance methods. Be aware, however, that after you give an auditor the answer, he or she will then seek objective evidence that you do, indeed, do things that way, such as meeting agendas, minutes, or corroboration from other interviewees.
Training Documents Are Important in ISO 9001
Emphasize the training documents in Clause 7.2 of the ISO 9001 QMS requirements. Many ISO 9001 auditors agree that this is a common area of weakness among ISO 9001 certified organizations. So one focus of ISO 9001 QMS implementation should be creating a training document system where education, training, skills, and experience are captured to provide evidence of competence, as well as operational performance, which is used for evidence of training effectiveness.
In larger organizations this probably has to be handled at the department level, but there should still be consistency throughout the organization. This will require a systematic approach that is communicated through training, examples, templates, and similar aids, to department leaders. The Baldrige workforce criteria published by NIST make the same point about competence records: an organization proves training worked through performance, not through attendance sheets alone.
ISO 9001 Clause 5 & 7 Leadership and Resources
Treat the two clauses as one job. ISO clause leadership and the resources behind it are judged together, and an auditor who doubts one will look hard at the other. There is no simple advice or direct method for complying with the requirements found in Clause 5 and Clause 7. It is as much about understanding and awareness, and about how managers use procedures or work instructions, than it is about creating new processes and documentation. Each and every organization has to decide how it currently fulfills the requirements, or how it will fulfill them if they are currently unfilled.
Frequently Asked Questions
What does ISO 9001 Clause 5 require from top management?
Clause 5 requires top management to demonstrate leadership and commitment to the QMS, establish the quality policy, assign responsibilities and authorities, and keep customer focus. Most of it is proven through evidence of behavior rather than through a required document.
What does ISO 9001 Clause 7 cover?
Clause 7, Support, covers resources, competence, awareness, communication and documented information. In practice it is where training records, calibration, infrastructure and the communication processes described in Clause 7.4 are addressed.
How many documents do Clause 5 and Clause 7 actually require?
Very few. The quality policy and evidence of competence are the main ones. Everything else can be a simple narrative, provided you can explain the answer and produce objective evidence that the organization works that way.
How do you turn a โshall statementโ into something you can implement?
Convert the statement into a question and answer it. โThe organization shall determine and provide the resources neededโ becomes โHow do we determine and provide the resources needed?โ The answer, plus the evidence behind it, is your compliance method.
Why do auditors flag training records so often?
Because most organizations capture attendance but not competence. Clause 7.2 expects education, training, skills and experience to be recorded, and it expects operational performance to show the training was effective.
