Management system guidance
4.0 Context of the Organization
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
4.4 Quality management system
ISO 9001:2026 includes specific requirements necessary for the adoption of the process approach when developing, implementing and improving a management system. This requires your organization to systematically define and manage processes and their interactions so that they deliver the intended results in line with both the quality policy and its strategic direction.
4.4.1 What the standard requires
Your organization must establish, implement, maintain and continually improve its quality management system (QMS), including the processes it needs and how they interact. For those processes it must:
- Determine which processes the QMS needs and how they apply across the organization;
- Determine the inputs each process requires and the outputs it is expected to deliver;
- Determine how the processes are sequenced and how they interact;
- Determine and apply the criteria and methods, including monitoring, measurement and related performance indicators, that keep the processes operating effectively and under control;
- Determine the resources the processes need and make sure they are available;
- Assign responsibilities and authorities for the processes;
- Address the risks and opportunities determined under Clause 6.1;
- Evaluate the processes and make any changes needed so that they achieve their intended results;
- Improve the processes and the QMS.
4.4.2 Documented information
Documented information must be available, to the extent your organization considers necessary, to support the operation of its processes and to show that the processes are being carried out as planned.
What changed in ISO 9001:2026: the process requirements in 4.4.1 a) to i) are unchanged in substance. In 4.4.2, the 2015 wording to 'maintain' and 'retain' documented information has been replaced by a single requirement for documented information to be 'available'. Annex A also links Clause 4.4 to the process approach principle, which incorporates the PDCA cycle together with risk-based and opportunity-based thinking, and confirms that documentation is not always necessary to demonstrate conformity; your organization decides which processes need documented information and in how much detail.
Certification Auditors will expect to see a process model that explains the key processes of the business and how each relates and links to the others. The depth of process explanation may be as detailed as the company chooses but should be based on its customer and applicable regulations or statutory requirements, the nature of its activities and its overall corporate strategy.
We suggest that you map out which departments and functions are responsible for executing each element (from Section 4.0 to Section 10.0) of the standard as it applies to each process, using a free copy of our 'Process Clause Matrix' template. If you need a procedure to help with determining your organization's processes, click here. Auditors will want to determine:
- How well the ‘process approach’ is understood and deployed within the organization;
- How well the management system aligns with the organizational context and the requirements of interested parties;
- How likely it is that the management system will achieve its intended outcomes and enhance quality performance and customer satisfaction;
- Identification of the processes needed for the management system (e.g. process models, process grouping, process flow diagram);
- Management system processes and their sequence and interaction (e.g. process mapping, turtle diagrams, SIPOC);
- What information exists to ensure effective operation and control of the processes, e.g. defined process requirements, defined roles, required competencies, associated training, guidance material;
- How the expected inputs and outputs from each of the identified processes, together with assignment of responsibilities and authorities are aligned;
- The necessary criteria and methods to ensure effective operation and control of the processes, e.g. process monitoring indicators, performance indicators, target setting, data collection, trend analysis, audit results.
- The arrangements for governing the processes (e.g. process reviews, dashboards, risks and opportunities relating to the process, resource needs, user training and competency, continual improvement initiatives, frequency of reviews, agenda, minutes, actions);
- The organizational approach towards continual improvement and the type of action taken when process performance is not meeting intended results;
- How the capture of customer, statutory and regulatory requirements, and the method used to build these into the QMS (e.g. requirements capture, gap analysis, requirements embedded into the process definition, assigned contract assurance instructions, formal links to information, use of specified documentation).
Existing operational procedures, quality manuals, work instructions and flow charts are valid examples of documented information and can be used to show that documented information is available to support the operation of processes. Check that process inputs and outputs are defined, and review how each of the processes are sequenced and how they interact.
Your organization should begin using quality performance indicators to control and monitor issues, and associated risks and opportunities. These types of objective evidence will indicate that your organization has successfully integrated the management system processes into its business processes.
Evidence may include Top management reviewing management system KPI’s as part of regular business reviews, awareness of contractors and employees of management system goals and expectations, etc. Check that process inputs and outputs are defined and review how each of the processes are sequenced and how they interact. Look for evidence that your organization has:
- Assigned duties/process owners; (Clause 5.3)
- Assessed risks and opportunities; (Clause 6.1)
- Provided resources; (Clause 7.1)
- Made the necessary documented information available; (Clause 7.5)
- Implemented measurement criteria; (Clause 9.1)
- Improved the management system and its processes. (Clause 10.1)
Ensure that your organization makes available the documentation needed to support the operation of its processes. Such documentation might be in the form of a management system manual, staff handbook, documented procedures, work instructions, guidance material, data cards, physical samples, IT systems (including intranet and internet), universal or bespoke software, templates and forms.
Documentation identified and kept by your organization to show that the processes were carried out as planned can be held as physical hard copy records or on electronic media (data servers, cloud storage, hard drives or flash drives etc.).
Specific documentation created and maintained by your organization that includes a description of relevant interested parties (Clause 4.2), scope of the management system including boundaries and applicability (Clause 4.3), description of the processes needed for the QMS together with their sequence, interaction and application and assignment of responsibilities for the processes.
Certification Auditors are likely to audit your organization's processes in sufficient depth and detail to evaluate if those processes are capable of meeting planned results and performance levels. You should therefore audit your organization's management system to focus on process performance and effectiveness. Give priority to the following:
- Review your organization's processes, their sequence and how they interact;
- Identify functions and the assignment of responsibilities;
- Review performance against requirements and defined measures, focusing on processes that directly impact the customer;
- Review your organization's process for monitoring and measurement, validation and approval of processes, and process changes;
- Review the availability of resources and the information required to operate and support associated activities, including appropriate training and competency of personnel;
- Review process-based management techniques, including the examination of process measures that might include level of quality, output effectiveness, control limits, process capability determination;
- Review any existing plans to ensure performance objectives and targets are monitored, measured, and analyzed in order to realize the planned activities and achieve the planned results;
- Review all applicable action taken when objectives and targets are not met to promote continual improvement;
- Pursue audit trails that address customer concerns or requests for corrective actions, performance against objectives, and relevant process controls.
Based upon the extent of your organization’s management system processes, you should seek evidence that your organization has made documented information available to support the operation of its processes, and as evidence that the processes are being carried out as planned.
Identify key processes and supporting processes
Key processes such as design and development, manufacturing, customer service and purchasing are key to giving the customer what they want.
Supporting processes do not contribute directly to what the customer wants but do help the key processes to achieve their output. Support processes often include human resources, finance, document control, training and facilities maintenance, etc.
A good way to do this is to think about how work flows through your organization. Consider how the inputs and outputs to the key processes flow from one process to the next, what sub-processes might exist within it and how the support processes link in. For now, ignore the standard, in fact put it in a drawer and forget it exists. Instead focus on your key processes and how the departments interface with each other.
When defining your processes, try to keep it simple. A process such as 'receiving inspection' could be a sub-process of the 'purchasing' process, for example. Certification Auditors will expect to see a process model that explains the key processes of the business and how each relates and links to the others. The depth of process explanation may be as detailed as your company chooses.
It should be based on its customer and applicable regulations or statutory requirements, the nature of its activities and its overall corporate strategy. In determining which processes should be determined and documented the organization may wish to consider factors such as:
- Effect on quality;
- Risk of customer dissatisfaction;
- Statutory and/or regulatory requirements;
- Economic risk;
- Effectiveness and efficiency;
- Competence of personnel;
- Complexity of processes.
Once you have defined the processes and interfaces; go back to the standard and determine which processes are responsible for meeting which requirements. When defining your organization’s processes, think about each process and department and try to define those processes around the current organizational model and not around the requirements of the standard. For each process, ensure that it has:
- Owner(s) and participants, defined and documented;
- Procedures, work instructions or forms;
- Inputs, activities and outputs;
- Key performance indicators;
- Risks and opportunities.
Determine the sequence and interaction of processes
Certification Auditors will look for evidence that the organization has determined its processes and that their interactions are also defined, for example in a process map or management system manual. Subsequently, this includes the actual and technical inputs and outputs of the processes to show their inter-relationship.
This requires the description of the interactions between the processes and should include process names, process inputs and process outputs in order to define their interactions. Interaction means how one influences the other. Auditors commonly agree that the description of the interactions of the processes cannot be done if the processes are not determined (names).
The organization is not required to produce system maps, flow charts, lists of processes etc. as evidence to demonstrate that the processes and their sequence and interactions were determined.
Such documents may be used by organizations should they deem them useful, but they are not mandatory. Graphical representation such as flow-charting is perhaps the most easily understandable method for describing the interaction between processes.
Controlling outsourced processes
Outsourced processes must be controlled by the organization and these controls must be defined and described within their system. Organizations are required to identify the controls they apply for any outsourced processes. Examples of some outsourced processes include:
A process completed wholly or partially by a sister facility outside the scope of registration. Such as corporate performing design, purchasing or customer related processes, this includes management activities i.e. business planning, goal setting, resources, data analysis, budgeting, etc.
This may include the entire element or a subsection i.e. corporate completes supplier evaluation and re-evaluation of suppliers and the registered site initiates purchase orders.
A process completed by an outside vendor or subcontractor such as heat treating, plating, calibration, painting, powder coating, etc. These types of processes may be controlled by the purchasing process where a formal contract or purchase order may be the controls.
If this is the case, the written documentation would be the purchasing documentation and records; however, the controls applied to these processes should still be described within your QMS documentation (see Clause 8.4).
If an outsourced process is controlled through purchasing, there must be documented objective evidence to ensure that these processes are being controlled beyond the basic purchasing requirements, which are focused on controlling products not processes.
Outsourced processes may be controlled through such methods as, but not limited to, auditing, contractual agreements, process performance data review on an on-going basis or purchasing processes.
Ensuring control over outsourced processes does not absolve the organization of the responsibility for conforming to customer, statutory and regulatory requirements. The type and extent of control to be applied to the outsourced process can be influenced by factors such as, the potential impact of the outsourced process on the organization’s capability to provide a product or service that conforms to requirements, the degree to which the control of the process is shared, or the capability of achieving the necessary control through the application of the purchasing process.
You should expect to see evidence that your organization has determined their processes and interactions. If your organization calls it a ‘process’, it must be monitored for effectiveness and improved.
Look for evidence that your organization evaluates its processes for continuing suitability, adequacy and effectiveness, and that any changes to processes and their interactions are made in a controlled way (see Clause 6.3). Processes should be reviewed when objectives or internal and external circumstances change.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.