How to Audit the Quality Policy Against ISO 9001 Clause 5.2

Why the Quality Policy Matters More Than Most Auditors Think

The quality policy sits at the heart of an ISO 9001 quality management system. It is the statement from top management that sets the direction for everything else, including quality objectives, operational decisions, and the culture of the organisation. Yet in practice, auditing the quality policy is one of the areas where both internal auditors and certification auditors tend to go through the motions rather than do real work.

Clause 5.2 of ISO 9001:2015 is deceptively simple. It is only a page long in the standard. But the requirements it contains, when properly tested, reveal a great deal about whether leadership is genuinely committed to quality or just paying lip service to it. This article walks through exactly how to audit the quality policy, what evidence to gather, what questions to ask, and where the common nonconformities hide.

If you want to understand what a well written quality policy actually looks like before you start auditing one, the companion article How to Write a Quality Policy That Meets ISO 9001 Clause 5.2 is worth reading first. It gives you the implementer perspective, which helps enormously when you are sitting on the audit side of the table.

What Clause 5.2 Actually Requires

Before you can audit against a requirement, you need to understand what the requirement actually says. Clause 5.2 breaks into two subclauses: 5.2.1 on establishing the quality policy, and 5.2.2 on communicating it.

Clause 5.2.1: Establishing the Quality Policy

Top management must establish, implement, and maintain a quality policy that does the following:

• Is appropriate to the purpose and context of the organisation
• Provides a framework for setting quality objectives
• Includes a commitment to satisfy applicable requirements
• Includes a commitment to continual improvement of the QMS

That word appropriate is doing a lot of work in that first bullet point. It means the policy cannot be a generic template downloaded from the internet and signed by the CEO. It needs to reflect what the organisation actually does, who it serves, and what quality means in that context.

Clause 5.2.2: Communicating the Quality Policy

The policy must be available as documented information. It must be communicated within the organisation. It must be available to relevant interested parties. And it must be applied.

That last word, applied, is where auditors often find the most interesting territory. A policy that exists on paper but has no visible influence on how the organisation operates is not being applied, regardless of how nicely it is framed on the reception wall.

Planning Your Audit of Clause 5.2

Like any clause, auditing the quality policy requires some preparation before you walk into the building. Do not leave this to chance or assume you can wing it during the opening meeting.

What to Review Before the Audit

Request a copy of the quality policy before your audit day. Read it carefully with the following questions in mind:

• Does it name or clearly imply what the organisation does?
• Does it reference customer satisfaction and applicable requirements?
• Does it mention continual improvement?
• Does it contain commitments that could realistically form the basis for quality objectives?
• Is it signed or otherwise authorised by top management?

You are not making a judgement yet. You are building a mental picture of what you expect to find, and flagging areas you want to probe further. A policy that says nothing specific about the organisation is already raising a question about appropriateness. A policy that has no reference to continual improvement is missing a mandatory element.

Linking Clause 5.2 to the Rest of the Audit

The quality policy does not exist in isolation. When you plan your audit, map out the connections between Clause 5.2 and other clauses you will be auditing. Specifically:

• Clause 4.1 and 4.2: The context of the organisation and the needs of interested parties should be reflected in the policy. If the organisation has identified significant external issues or key interested party requirements, you would expect the policy to address these at some level.
• Clause 5.1: Leadership and commitment. The policy is one of the primary ways top management demonstrates commitment. Auditing leadership and the policy together makes sense.
• Clause 6.2: Quality objectives. The policy is supposed to provide a framework for setting objectives. If the objectives bear no relationship to the commitments in the policy, that is a problem.
• Clause 7.3: Awareness. Personnel are required to be aware of the quality policy and how it relates to their work. This is a direct link from 5.2.2.

Planning these connections before you start means you will gather richer evidence and spot systemic issues rather than just checking boxes against individual clauses.

Gathering Evidence During the Audit

Auditing the quality policy involves three types of evidence: document review, interviews, and observation. You need all three to form a reliable conclusion.

Document Review

Start with the documented quality policy itself. Check the following:

• Is it documented? The standard requires it to be available as documented information.
• Is it current? Check the revision date and version control. A policy last reviewed five years ago in an organisation that has changed significantly may no longer be appropriate to the current context.
• Is it authorised? Look for a signature, approval, or some other indication that top management has formally endorsed it.
• Does it contain all four mandatory elements from Clause 5.2.1?

Then look at the quality objectives documented under Clause 6.2. Ask yourself whether there is a logical connection between the commitments in the policy and the objectives that have been set. If the policy commits to on time delivery and customer responsiveness, but none of the quality objectives address these areas, the policy is not functioning as a framework for objective setting. That is a finding worth raising.

Also check where the policy is published. Is it on the intranet? Displayed in the workplace? Available on the organisation's website for external interested parties? The standard requires it to be available to relevant interested parties, which for most organisations includes at minimum their customers.

Interviewing Top Management

You should always try to interview the person or people who constitute top management when auditing Clause 5.2. This is not always easy, particularly in large organisations where the CEO or managing director may not be available. But if you are auditing a small to medium business, there is no good reason to skip this.

The questions you ask should be open and designed to draw out genuine understanding rather than rehearsed answers. Some examples that work well in practice:

• Can you walk me through what the quality policy means for this organisation?
• How does the policy connect to the quality objectives you have set for this year?
• When did you last review the policy, and what prompted any changes?
• How do you make sure staff understand the policy and can relate it to their work?

What you are listening for is whether top management actually understands and owns the policy, or whether it was written by the quality manager and signed without much thought. A top manager who cannot explain the policy in their own words, or who is visibly surprised by questions about it, is telling you something important about how seriously leadership takes the QMS.

For more on interviewing technique in audit settings, the article Audit Interviewing Techniques Every Auditor Should Master covers this in depth.

Interviewing Operational Staff

Clause 5.2.2 requires the policy to be communicated within the organisation. The only reliable way to verify this is to ask people who are not the quality manager whether they know what the quality policy is and what it means for their work.

Pick a cross section of people. A warehouse worker, a customer service representative, a supervisor on the production floor. Ask them:

• Have you seen the quality policy?
• Can you tell me roughly what it says?
• How does it relate to what you do in your role?

You are not expecting people to recite the policy word for word. But they should be able to give you a reasonable summary of what the organisation stands for in terms of quality, and connect it in some way to their own responsibilities. If five out of five workers you interview have never heard of the quality policy, or cannot tell you anything about it, you have strong evidence of a nonconformity against Clause 5.2.2.

Be careful here about how you record this. Document the specific conversations, the roles of the people interviewed, and what they said. Vague notes like staff unaware of policy are not sufficient to support a nonconformity. You need specifics.

Observation

Walk around the workplace with your eyes open. Is the quality policy displayed anywhere? Is there any visible evidence that it influences how work is done? This is a softer form of evidence, but it contributes to the overall picture.

In some industries, particularly manufacturing, construction, and professional services, you might also look for evidence that the policy commitments are reflected in operational documents. If the policy commits to meeting customer specifications, are those specifications documented and referenced in work instructions? That kind of connection demonstrates the policy is being applied, not just displayed.

Common Nonconformities Against Clause 5.2

After conducting hundreds of audits, certain patterns emerge. These are the nonconformities you are most likely to find when auditing the quality policy.

Generic Policies With No Organisational Specificity

This is the most common issue. The policy reads like it could apply to any organisation in any industry. It contains phrases like we are committed to quality and we strive for customer satisfaction but says nothing about what the organisation actually does, who its customers are, or what quality means in its specific context.

This is a conformity issue against the requirement that the policy be appropriate to the purpose and context of the organisation. It is also often a sign that the policy was written by a consultant during implementation and never really owned by management.

Missing Mandatory Commitments

Occasionally you will find a policy that simply omits one of the two mandatory commitments, either the commitment to satisfy applicable requirements or the commitment to continual improvement of the QMS. This is a clear nonconformity and easy to raise because the evidence is in the document itself.

No Connection to Quality Objectives

The policy is supposed to provide a framework for setting quality objectives. If the objectives have no logical relationship to the policy commitments, this is a finding. It suggests the policy and the objectives were developed independently, which means the policy is not functioning as intended.

Staff Unaware of the Policy

As described above, if operational staff cannot demonstrate any awareness of the quality policy, this is a nonconformity against Clause 5.2.2. The standard requires the policy to be communicated within the organisation, and communication means more than sending an email once a year.

Policy Not Available to Interested Parties

Many organisations overlook the requirement to make the policy available to relevant interested parties. For most businesses, this means customers at minimum. If the policy is not on the website, not included in tender documents, and not provided to customers on request, this requirement may not be met.

Outdated Policy That No Longer Reflects the Organisation

An organisation that has changed significantly since its policy was last reviewed may have a policy that is no longer appropriate to its current context. This is particularly common after mergers, significant scope changes, or major shifts in the customer base. The policy should be reviewed periodically and updated when the context changes.

For a broader look at where organisations commonly trip up across Clause 5, the article The Most Common ISO 9001 Clause 5 Nonconformities is a useful reference.

Grading Your Findings

Not every issue you find against Clause 5.2 will be a major nonconformity. Grading requires judgement.

A major nonconformity is typically warranted when a mandatory requirement is completely absent. For example, the policy contains no commitment to continual improvement, or there is no documented policy at all, or staff across the organisation have no awareness of the policy whatsoever. These represent a systemic failure of a fundamental requirement.

A minor nonconformity might be appropriate where the policy exists and contains the required elements, but there are isolated gaps in communication, or the connection to quality objectives is weak but not entirely absent.

An observation or opportunity for improvement might be appropriate where the policy is technically compliant but could be strengthened, for example where it is very generic but still references the organisation's context in some way, or where most staff are aware of it but a small number are not.

The key is that your grading must be supported by evidence. Do not raise a major nonconformity based on a single interview with one worker who happened to be new. And do not downgrade a genuine systemic failure to an observation just because the quality manager seems embarrassed.

Writing Up Your Findings

When you document a finding against Clause 5.2, be specific. Reference the clause, describe the evidence you gathered, and explain why it does or does not conform to the requirement.

A well written nonconformity against Clause 5.2.2 might read something like this:

Clause 5.2.2 requires the quality policy to be communicated within the organisation. During interviews with four operational staff members across the warehouse and customer service functions, none were able to describe the quality policy or explain how it related to their work. The quality manager confirmed that the policy had been emailed to staff at the time of certification three years ago but no subsequent communication had occurred. This represents a failure to maintain ongoing communication of the quality policy.

Notice that the finding names the clause, describes the evidence in specific terms, identifies the root of the problem, and explains the gap. That is what a finding needs to contain to be useful and defensible.

For more on writing findings that hold up, the article How to Write Audit Findings That Stand Up to Challenge is worth reviewing before you write your report.

Tips for Auditing Clause 5.2 More Effectively

A few practical points from experience conducting audits across a wide range of industries and organisation sizes:

• Do not spend all your time on the document. The document is just the starting point. The real audit work happens in conversations and observations.
• Ask for the policy to be explained to you. If top management or the quality manager can only point you to the document rather than explain it in their own words, that tells you something.
• Connect the policy to real decisions. Ask how the policy influenced a recent operational decision. Did a commitment in the policy drive a change in process, an investment in training, or a response to a customer complaint? Real application leaves traces.
• Check induction records. Many organisations communicate the quality policy during induction. If the induction records show this is covered, that is positive evidence. If the records show it is not covered, that is a gap.
• Look at management review records. Clause 9.3 management reviews should consider the continued suitability of the quality policy. If management review records make no mention of the policy, either the review is not covering everything it should, or the policy is not being actively maintained.

Developing Your Skills as an Auditor

Auditing Clause 5.2 well requires more than knowing what the clause says. It requires the ability to ask good questions, read between the lines of what people tell you, connect evidence across multiple clauses, and make sound judgements about what you find. These are skills that develop with practice and with proper training.

If you are working towards your credentials as an internal auditor or lead auditor, Audit Workshop offers practical, hands on training across ISO 9001, ISO 14001, and ISO 45001 at Foundation, Internal Auditor, and Lead Auditor levels. The courses are built around real audit scenarios, not just theory, and are delivered by Dilawar Laghari, a certified lead auditor with over 14 years of experience and more than 500 external certification audits across Australia, the Middle East, and South Asia. Whether you are just starting out or looking to sharpen your skills before a certification audit, the training at auditworkshop.com is worth exploring.