Management system guidance
3.0 Terms and Definitions
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
3 Terms and definitions
What changed in ISO 9001:2026
In ISO 9001:2015, clause 3 contained no definitions of its own; it simply referred readers to ISO 9000:2026. ISO 9001:2026 now defines its core terms within the standard itself. There are 20 numbered entries (3.1 to 3.20), three of which have a quality-specific sub-entry: quality management system (3.4.1), quality policy (3.5.1) and quality objective (3.6.1).
Most of these terms mirror the common vocabulary shared by ISO management system standards, so ISO 9001, ISO 14001 and ISO 45001 now speak the same basic language. This is helpful if you run, or plan to run, an integrated management system.
ISO 9000:2026, Quality management — Fundamentals and vocabulary, remains the normative reference in clause 2. Every other term used in ISO 9001, such as customer, product, service, external provider, quality, nonconforming output, correction, verification, validation and traceability, takes its meaning from ISO 9000:2026. In practice you need both documents: ISO 9001:2026 for the requirements and core terms, and ISO 9000:2026 for the wider vocabulary and the seven quality management principles.
The core terms explained
The table below explains each core term in plain English and shows why it matters for your quality management system. The explanations are our own paraphrase; refer to the published standard for the exact definitions.
| Term | What it means | Why it matters |
| 3.1 Organization | A person or group of people with its own functions, responsibilities, authorities and relationships, working to achieve its objectives. It can be anything from a sole trader to a corporation, charity or public authority. Where the organization is part of a larger entity, the term means only the part inside the scope of the QMS. | Defines who the requirements apply to and links directly to how you set your scope in 4.3. |
| 3.2 Interested party (stakeholder) | Any person or organization that can affect, be affected by, or believes it is affected by your decisions or activities: customers, owners, employees, providers, bankers, regulators, unions, partners and society, including competitors. | 4.2 asks you to decide which interested parties are relevant, what they require and which of those requirements the QMS will address. |
| 3.3 Top management | The person or group who directs and controls the organization at the highest level, with the power to delegate authority and provide resources. If the QMS covers only part of the organization, it means those who direct and control that part. | Clause 5 places leadership duties on top management, including promoting a quality culture and ethical behaviour (5.1.1). |
| 3.4 Management system 3.4.1 Quality management system |
The set of interrelated elements, such as structure, roles, planning, operation, policies, practices and beliefs, that an organization uses to set policies and objectives and the processes to achieve them. The QMS is the part of that overall system related to quality. | Shows that the QMS is part of how the business is run, not a separate system. It also makes integration with ISO 14001 or ISO 45001 easier. |
| 3.5 Policy 3.5.1 Quality policy |
The intentions and direction of the organization, formally expressed by top management. The quality policy is the policy related to quality; it is usually consistent with the overall policy, can be aligned with the vision and mission, and provides a framework for quality objectives. | See 5.2. The quality management principles of ISO 9000:2026 can be used as a basis for your quality policy. |
| 3.6 Objective 3.6.1 Quality objective |
An objective is a “result to be achieved”. It can be strategic, tactical or operational, and may be called an aim, goal or target. A quality objective is an objective related to quality, usually based on the quality policy and set for relevant functions, levels and processes. | See 6.2.1. Calling something a target or KPI does not take it outside the requirement. |
| 3.7 Risk | Risk is the “effect of uncertainty”. An effect is a deviation from what is expected, which can be positive or negative. Uncertainty is a lack, even partial, of information, understanding or knowledge about an event, its consequences or its likelihood. Risk is often expressed as a combination of consequence and likelihood. | Underpins 6.1.2. Although the definition allows for positive deviations, ISO 9001:2026 deals with opportunities separately in 6.1.3 and its Annex A describes risks and opportunities as distinct. Avoid describing opportunities as “positive risks”. |
| 3.8 Process | Linked or interacting activities that take inputs and use or transform them to produce a result. The outputs of one process are usually the inputs of another. A process whose output cannot be readily or economically checked for conformity is often called a special process. | The foundation of the process approach and of 4.4. |
| 3.9 Competence | The “ability to apply knowledge and skills to achieve intended results”. | Competence is shown by results, not just certificates. See 7.2. |
| 3.10 Documented information | Information the organization is required to control and maintain, together with the medium it is held on. It can be in any format, from any source, and covers the management system and its processes, the information needed to operate (documentation) and evidence of results achieved (records). | Replaces the older split between “documents” and “records”. See 7.5. |
| 3.11 Performance | A “measurable result”, which may be quantitative or qualitative, and can relate to activities, processes, products, services, systems or organizations. | Underpins monitoring, measurement, analysis and evaluation in 9.1. |
| 3.12 Continual improvement | A recurring activity to enhance performance. | See 10.1 Continual improvement, which now absorbs the old clause 10.3. |
| 3.13 Effectiveness | The extent to which planned activities are carried out and planned results are achieved. | Effectiveness is not the same as efficiency. Management review (9.3) and the evaluation of actions on risks and opportunities are about effectiveness. |
| 3.14 Requirement | A need or expectation that is stated, generally implied (custom or common practice) or obligatory. A specified requirement is one that is stated, for example in documented information. Requirements can come from interested parties or from the organization itself. | Applies throughout, especially when determining and reviewing requirements for products and services (8.2). |
| 3.15 Conformity 3.16 Nonconformity |
Conformity is the fulfilment of a requirement; nonconformity is the failure to fulfil one. The term “conformance” is no longer preferred. | See 8.7 and 10.2. |
| 3.17 Corrective action | Action to eliminate the cause or causes of a nonconformity and prevent it happening again. Preventive action, by contrast, aims to stop something happening in the first place, and correction (defined in ISO 9000:2026) simply deals with the nonconformity itself. | Corrective action is required by 10.2. Preventive thinking is built into risk-based thinking rather than being a separate required process. |
| 3.18 Audit | A systematic and independent process for obtaining evidence and evaluating it objectively to decide how far the audit criteria are met. Audits can be internal (first party) or external (second or third party), combined or joint. Independence can be shown by auditors having no responsibility for the activity audited. | See 9.2. ISO 19011:2026 gives guidance on auditing management systems. |
| 3.19 Measurement 3.20 Monitoring |
Measurement is a process to determine a value. Monitoring is determining the status of a system, process, activity, product or service, often by checking, supervising or observing at different stages or times. | Both are used in 7.1.5 and 9.1.1. Monitoring does not always involve a measured value. |
Risk and opportunity are treated separately
The definition of risk as the “effect of uncertainty” is deliberately broad. ISO 9001:2026 nevertheless separates the two ideas in its requirements: clause 6.1.1 determines risks and opportunities, clause 6.1.2 deals with actions to address risks and the new clause 6.1.3 deals with actions to address opportunities. Annex A explains that risks are usually understood as uncertainty that could harm the ability of the QMS to achieve its intended results, while opportunities are circumstances that make beneficial effects possible. They can be determined and addressed through separate processes.
If your risk register or procedures describe opportunities as “positive risks”, consider rewording them so that opportunities are identified, analysed and acted on in their own right. Remember also that risk-based thinking does not require a formal risk management method or a documented risk management process.
Clarification of key words (Annex A.2)
Annex A.2 of ISO 9001:2026 clarifies several words that are often misunderstood. In summary:
- Appropriate and applicable - these are not interchangeable. ‘Appropriate’ means suitable for your context and calls for judgement. ‘Applicable’ means the requirement applies if it is relevant or possible. ‘As applicable’ means a requirement that generally applies may still be determined not to apply in particular situations;
- Consider and take into account - to ‘consider’ is to think about a topic and decide whether to include it in decisions or actions. To ‘take into account’ is to think about it and include it;
- Continual and continuous - ‘continual’ describes something that happens over time with breaks between, which is how improvement works in quality management. ‘Continuous’, meaning without interruption, is not used in ISO 9001;
- Ensure - means being responsible and accountable for a result existing or happening. It does not mean doing every task yourself; activities can be delegated to people under the organization’s control;
- Available as documented information and available as evidence - ‘shall be available as documented information’ is about information that the organization obtains, uses or provides (what 2015 called ‘maintain’). ‘Documented information shall be available as evidence of’ is about keeping objective evidence (what 2015 called ‘retain’). ‘Evidence’ here does not imply legal evidential requirements;
- Strategic direction - the coordinated decisions, plans and actions that steer the organization towards its objectives.
Annex A.2 also confirms that the lettering of items in lists is there only to help identification and citation. Unless stated otherwise, the order of a list does not imply sequence, priority or importance, and every item applies.
Applying clause 3 in practice
- There is no requirement to copy the definitions into your own documents, and your documented information does not need to follow the clause structure of the standard. Use the terms your people already understand, but make sure they mean the same thing as the standard;
- A short glossary in your quality manual or induction material helps people use terms such as risk, opportunity, nonconformity, correction and corrective action consistently;
- Review existing procedures and forms for outdated wording, for example ‘documents and records’, ‘preventive action’ as a separate required process, or ‘opportunities are positive risks’;
- Check that internal auditors use the clause 3 and ISO 9000:2026 terms when writing audit findings, so that nonconformities are clearly linked to requirements.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.