Auditing Customer Focus Under Clause 5.1.2: Questions for Top Management

Why Clause 5.1.2 Is One of the Most Revealing Clauses in ISO 9001

Clause 5.1.2 of ISO 9001 sits inside the leadership section of the standard, and that placement is deliberate. Customer focus is not a customer service issue. It is a leadership issue. The standard requires top management to demonstrate that customer requirements are determined and met, that risks to conformity are addressed, and that the focus on enhancing customer satisfaction is maintained.

In practice, this clause is one of the most useful places to probe whether leadership is genuinely engaged with the quality management system or simply tolerating it. An organisation can have a beautifully documented QMS and still fail this clause if the people running the business cannot tell you what their customers actually need, how complaints are tracked, or whether customer satisfaction data is used for anything beyond a monthly report that no one reads.

This article gives you a practical framework for auditing Clause 5.1.2, including the questions to ask top management, the evidence to gather, and the common gaps that auditors find in organisations of all sizes.

What Clause 5.1.2 Actually Requires

Before walking into an interview with a CEO or operations director, you need to be clear on what the clause demands. ISO 9001:2015 Clause 5.1.2 requires top management to demonstrate leadership and commitment with respect to customer focus by ensuring that:

• Customer and applicable statutory and regulatory requirements are determined, understood, and consistently met
• Risks and opportunities that can affect conformity of products and services and the ability to enhance customer satisfaction are determined and addressed
• The focus on enhancing customer satisfaction is maintained

Notice that the standard uses the word ensuring. Top management does not have to personally do all of these things, but they do have to make sure they happen. That is the accountability hook. When you audit this clause, you are not just checking whether processes exist. You are checking whether the person at the top of the organisation is genuinely driving them.

It is also worth reading Clause 5.1.2 alongside the related articles on customer focus in ISO 9001 and ISO 9001 customer satisfaction requirements, which provide useful background on how the standard frames these obligations.

Preparing to Audit Top Management on Customer Focus

Auditing top management is different from auditing a process owner or a team leader. The conversation tends to be shorter, higher level, and more strategic. You are not going to spend two hours walking through a procedure with the CEO. You might get thirty minutes, and you need to make them count.

Review the Right Documents Before the Interview

Before you sit down with top management, pull together the following:

• The quality policy, to check whether customer focus is explicitly referenced
• The most recent management review minutes, looking for how customer satisfaction data was presented and what decisions were made as a result
• Customer satisfaction data, including survey results, net promoter scores, or whatever method the organisation uses
• The complaints register and any trend analysis
• Quality objectives related to customer satisfaction or on-time delivery
• Any documented risk assessments that reference customer-related risks

This preparation gives you a factual baseline before the interview. If management review minutes show that customer satisfaction dropped by twelve percent and there was no discussion of causes or corrective action, that is a finding waiting to be confirmed in the room.

Know Who You Are Talking To

In a small business, top management might be the owner-director who is also the operations manager, the sales manager, and the person who answers the phone. In a large organisation, it might be a CEO, a COO, or a general manager who has delegated almost everything. Tailor your approach accordingly. The questions below work for both, but the depth of answer you expect will differ.

Core Questions to Ask Top Management About Customer Focus

The questions below are grouped by the three main obligations in Clause 5.1.2. Use them as a guide, not a script. Let the answers take you somewhere. If a response raises a flag, probe it.

Questions About Determining and Meeting Customer Requirements

These questions test whether top management understands what customers actually need and whether the organisation has reliable processes for capturing and meeting those needs.

• How does the organisation determine what your customers require, beyond what is written in a contract or purchase order?
• What mechanisms are in place to make sure those requirements are communicated to the people doing the work?
• How do you know when a customer requirement has changed mid-project or mid-contract?
• What happens when a customer requirement conflicts with a regulatory or statutory requirement?
• Can you walk me through a recent example where a customer had a specific requirement that required your team to do something differently?

The last question is particularly useful. It moves the conversation from the abstract to the concrete. A top manager who is genuinely engaged with customer focus will be able to give you a real example without hesitation. One who is not will give you a vague answer about always meeting customer needs.

Questions About Risks and Opportunities Affecting Customer Satisfaction

This is the area where many organisations are weakest. They have a risk register for the business, but it rarely connects clearly to customer satisfaction risks. ISO 9001 requires top management to ensure these risks are identified and addressed.

• What do you see as the main risks to your ability to deliver what customers need?
• How are those risks documented and managed?
• Has the organisation identified any opportunities to improve customer satisfaction that have come out of the risk process?
• When you last reviewed the risk register, were there any items specifically related to customer requirements or satisfaction?
• How are customer-related risks escalated to you personally?

A strong response will reference specific risks, the controls in place, and how the organisation monitors whether those controls are working. A weak response will conflate risk management with complaints handling, which is a reactive process rather than a proactive one.

Questions About Maintaining Focus on Enhancing Customer Satisfaction

This is the forward-looking part of the clause. It is not enough to meet current requirements. Top management must demonstrate that enhancing satisfaction is an ongoing priority.

• How do you measure customer satisfaction?
• What does the current data tell you?
• What decisions have been made in the last twelve months based on customer satisfaction data?
• How is customer feedback communicated to staff?
• What is the organisation doing proactively to improve the customer experience, not just respond to complaints?
• How does customer satisfaction performance feature in your management review?

The question about what decisions have been made based on customer satisfaction data is one of the most diagnostic questions in this list. If the answer is essentially nothing, you have a strong indicator that the data is being collected for the sake of the QMS rather than for genuine improvement.

What Good Looks Like: Benchmarks for Your Assessment

When you are sitting in that room with top management, you need a mental model of what a conforming response looks like so you can recognise both strong practice and gaps.

Strong Evidence of Conformity

A top manager demonstrating genuine customer focus will typically be able to:

• Name specific customer satisfaction metrics and quote recent figures without needing to look them up
• Describe at least one concrete change made in response to customer feedback in the past year
• Explain how the complaints process feeds into the risk register or the improvement process
• Reference customer focus explicitly in the quality policy and explain what it means in practice
• Connect quality objectives to customer outcomes, not just internal process metrics

Common Gaps and Red Flags

After conducting hundreds of external certification audits, the following patterns appear regularly in organisations that are struggling with Clause 5.1.2:

• Customer satisfaction is measured but not acted on. Surveys go out, results come back, and the data sits in a spreadsheet. There is no analysis, no trend identification, and no corrective action. This is a gap against the requirement to maintain focus on enhancing satisfaction.
• The risk register does not mention customers. An organisation might have a thorough risk register covering financial, operational, and safety risks with no reference to risks that could affect product or service conformity or customer satisfaction. This is a direct gap against the clause.
• Top management delegates everything and knows nothing. When a CEO says “you would need to talk to our quality manager about that” for every question about customer requirements, that is a flag. Top management must be able to demonstrate their own engagement, not just point to someone else.
• Complaints are handled but not analysed. Individual complaints are resolved, but there is no trend analysis, no root cause investigation at a systemic level, and no connection to the improvement process.
• Quality objectives are inward-facing. Objectives like “complete all audits on time” or “maintain certification” say nothing about customer outcomes. Objectives should connect to what matters to customers.

Gathering Corroborating Evidence Beyond the Interview

The interview with top management is one data point. Good audit practice requires you to triangulate that evidence against documents, records, and observations elsewhere in the audit.

After your top management interview, check the following:

• Management review records: Do they include customer satisfaction data as a mandatory input? Are the outputs linked to decisions about customer-related objectives or processes? The requirements for management review outputs are covered in detail in our article on management review outputs and what auditors expect.
• Customer complaint records: Are complaints being categorised? Is there trend data? Is there evidence of root cause analysis for recurring issues?
• Customer satisfaction survey data: Is it statistically meaningful? Is the response rate sufficient to draw conclusions? Are results broken down in a way that allows targeted improvement?
• Quality objectives: Are any objectives directly linked to customer satisfaction? Are they being monitored and reported?
• Risk register: Are customer-related risks present? Are they being reviewed and updated?
• Communication records: Is customer satisfaction performance being communicated to staff? Can frontline workers tell you what the current customer satisfaction score is?

If top management tells you customer focus is a priority but the management review minutes show it was discussed for two minutes at the end of a three-hour meeting, that inconsistency is worth noting. Evidence from multiple sources that tells a consistent story is what you are looking for.

Writing Up Your Findings

When you identify a gap against Clause 5.1.2, be specific about which element of the clause has not been met. The three requirements in the clause give you a clear structure.

A nonconformity might read:

The organisation collects customer satisfaction survey data quarterly. However, there is no evidence that this data has been analysed for trends or used to inform quality objectives, corrective actions, or management review decisions. This does not meet the requirement of Clause 5.1.2(c) that top management ensure the focus on enhancing customer satisfaction is maintained.

An observation might note that while customer satisfaction data is reviewed in management review, the quality objectives do not include any customer-facing measures, which limits the organisation's ability to track improvement over time.

Avoid vague findings like “customer focus could be improved.” Every finding needs to reference a specific requirement and be supported by specific evidence. For guidance on structuring findings clearly, see our article on writing nonconformity reports that actually get fixed.

Connecting Clause 5.1.2 to the Rest of the Audit

Customer focus does not live in isolation. When you find gaps in Clause 5.1.2, they usually connect to gaps elsewhere in the system. A few common linkages:

• Clause 8.2 (Customer requirements): If top management cannot explain how customer requirements are determined, check whether the process for reviewing customer requirements before accepting orders is functioning properly.
• Clause 9.1.2 (Customer satisfaction): This clause requires the organisation to monitor customer perceptions. If top management is not using this data, the monitoring process may be superficial.
• Clause 6.1 (Risks and opportunities): Customer-related risks should appear in the risk register. If they do not, this may be a planning gap as well as a leadership gap.
• Clause 9.3 (Management review): Customer satisfaction is a mandatory input to management review. If it is not being addressed substantively, this is a separate finding under Clause 9.3.

Recognising these connections allows you to build a coherent picture of how well the organisation is managing customer focus across the system, rather than treating Clause 5.1.2 as an isolated checkbox.

Practical Tips for the Top Management Interview

A few practical points that make a real difference when auditing at this level:

• Ask open questions and then be quiet. Resist the urge to fill silence. Let the person think and answer. What they choose to say, and what they leave out, is informative.
• Do not lead the witness. Avoid questions like “So you would say customer focus is a priority, right?” Ask the question and let the answer come.
• Take note of what they are proud of. Top managers who are genuinely engaged with customer focus will often volunteer examples unprompted. That is a good sign.
• Do not turn it into an interrogation. The goal is to understand how customer focus works in this organisation, not to catch someone out. If you approach it that way, you will get defensive answers that tell you very little.
• Confirm what you heard. At the end of the interview, briefly summarise what you understood. This gives the person a chance to correct any misunderstanding and demonstrates that you were listening.

Building Your Skills in Auditing Leadership Clauses

Auditing leadership clauses like Clause 5.1.2 requires a different skill set from auditing operational clauses. You need to be comfortable asking strategic questions, interpreting indirect evidence, and making judgements about whether commitment is genuine or performative. These skills develop with practice, but they can also be accelerated through structured training.

At Audit Workshop, our ISO 9001 internal auditor and lead auditor courses cover the full range of auditing skills, including how to audit leadership and top management effectively. The training is built around real audit scenarios, not abstract theory, so you come away with questions you can actually use and a framework for making sound audit judgements. Whether you are preparing for your first internal audit or building towards lead auditor certification, the courses are designed to give you practical skills that hold up in the field.