Why Clause 5 Is the Hardest Clause to Audit Well
Clause 5 sits at the heart of every ISO standard built on the High Level Structure. It covers leadership and commitment, policy, and roles and responsibilities. On paper, it looks straightforward. In practice, it is one of the most consistently misaudited areas in the entire management system.
On this page
The problem is not complexity. The problem is that most auditors treat Clause 5 like a document review exercise. They ask for the policy, confirm it is signed, check that roles are defined, and move on. That approach will not tell you whether top management is genuinely committed to the system or simply tolerating it.
After conducting hundreds of certification audits across ISO 9001, ISO 14001, ISO 45001, ISO 27001, and ISO 42001, the pattern is consistent. Organisations with strong leadership produce better systems, better corrective actions, and better audit outcomes at every level. Organisations where top management treats certification as a compliance exercise struggle to sustain anything meaningful between audit cycles.
This article is about how to actually test Clause 5 commitment, not just verify it on paper. The techniques here apply across standards, though the specific evidence you gather will vary depending on whether you are auditing a quality, environmental, safety, or information security management system.
What Clause 5 Actually Requires
Before you can test commitment, you need to be clear on what the standard is asking for. Clause 5.1 in ISO 9001, ISO 14001, ISO 45001, and ISO 27001 all require top management to demonstrate leadership and commitment. The word demonstrate is doing a lot of work in that sentence.
Demonstration is not the same as declaration. A signed policy is a declaration. Attending management review is a declaration. What the standard wants is evidence that leadership is active, not passive. That means looking at behaviours, decisions, and outcomes, not just documents.
The Core Obligations Under Clause 5.1
Across the major ISO standards, top management is typically required to:
- Take accountability for the effectiveness of the management system
- Ensure the policy and objectives are established and compatible with the organisation's strategic direction
- Ensure the management system is integrated into business processes
- Promote a culture that supports the system
- Ensure resources are available
- Communicate the importance of effective management and conformance to requirements
- Support other relevant management roles to demonstrate leadership in their areas
Each of these obligations generates evidence. Your job as an auditor is to find it, or find its absence.
Exemplar Global Certified Training ProviderRTP No. 310970
Interviewing Top Management: The Most Underused Audit Technique
The single most powerful tool for auditing Clause 5 is a well conducted interview with top management. Most auditors are reluctant to push hard in these sessions. Senior leaders can be intimidating, time pressured, or dismissive. But if you do not interview top management properly, you are leaving the most important audit evidence uncollected.
For a practical guide on how to approach these conversations without losing the room, the article on how to audit top management without losing the room covers the interpersonal side of this in detail. The focus here is on what to probe for.
Questions That Reveal Real Commitment
Avoid questions that invite rehearsed answers. “Do you support the quality management system?” will always get a yes. Instead, ask questions that require specific knowledge or that reveal how decisions are actually made.
Try these instead:
- “Can you walk me through what happened after the last management review? What decisions were made and what changed as a result?”
- “When did you last personally review a corrective action? What was the issue and what did you decide?”
- “If a production deadline conflicted with a quality requirement, how would that decision be made? Who makes it?”
- “What is the biggest risk your management system is currently managing? How do you know it is being managed effectively?”
- “What has the system told you in the last six months that changed how you run the business?”
These questions expose whether the leader is engaged with the system or simply aware that it exists. A leader who can answer these specifically, with examples, is genuinely involved. A leader who defers entirely to the quality manager or gives vague reassurances is not.
Reading the Room During the Interview
Pay attention to how the interview is set up. Was the CEO available, or did you end up with a delegate? Did the quality manager try to answer on behalf of the CEO? Did the leader have to be prompted with the name of the policy before they could discuss it?
None of these observations alone constitute a nonconformity. But they are signals that should sharpen your focus elsewhere in the audit. If top management cannot describe the system's objectives without prompting, it is worth checking whether those objectives are genuinely integrated into business planning or simply documented to satisfy the requirement.
Testing Integration Into Business Processes
One of the clearest indicators of genuine leadership commitment is whether the management system is integrated into how the business actually operates, or whether it runs as a parallel administrative exercise.
The standard requires top management to ensure integration. Testing this means looking at real business processes, not the management system documentation.
What Integration Looks Like in Practice
Ask to see the business planning process. Does it reference quality objectives, environmental targets, or OH&S performance? Are management system outputs, such as audit results, corrective action trends, or customer satisfaction data, actually used in business decisions?
Look at meeting records. If the organisation holds weekly leadership team meetings, do those meetings ever discuss management system performance? If the safety performance data only appears in the management review meeting once a year, that is a signal that safety is being managed separately from the business, not integrated into it.
Look at capital expenditure and resource allocation decisions. Has the organisation invested in resources to improve the management system? Clause 5.1 requires top management to ensure resources are available. If the internal audit programme has been consistently under resourced, or corrective actions are repeatedly delayed because no one has time to implement them, that is evidence of a resourcing failure that traces back to leadership.
The Resourcing Test
One of the most direct tests of leadership commitment is resource allocation. Ask these questions:
- How many people are dedicated to the management system, and is that adequate for the scope?
- Has the internal audit programme been completed as planned, or have audits been deferred? If deferred, why?
- Are corrective actions being closed within the agreed timeframes? If not, what is the barrier?
- Has the organisation invested in training or competence development for people with management system responsibilities?
Chronic under resourcing of the management system, particularly when the organisation is otherwise profitable, is strong evidence that leadership commitment is not genuine. It may not always result in a major nonconformity, but it is worth documenting as a significant observation or minor finding depending on the impact.
Auditing the Policy for Real Commitment
Clause 5.2 requires top management to establish a policy that is appropriate to the organisation, includes commitments to continual improvement and compliance, and is communicated and available. Most organisations have a policy. What varies enormously is whether that policy reflects genuine strategic intent or was written once and filed away.
The article on how to audit the quality policy against ISO 9001 Clause 5.2 goes into the specific evidence requirements in detail. The broader principle applies across all standards.
Testing Whether the Policy Is Alive
Ask workers at different levels what the policy commits the organisation to. Not the exact words, but the intent. Can a team leader on the shop floor explain what the environmental policy means for their work? Can a project manager describe what the OH&S policy requires of them?
If workers cannot connect the policy to their daily work, the policy has not been communicated effectively. That is a Clause 5.2 and 7.3 issue, but it also tells you something about how seriously leadership takes the communication requirement.
Look at when the policy was last reviewed. A policy that has not been touched in five years, in an organisation that has changed significantly in that time, suggests that leadership is not actively maintaining it. Check whether the policy references current strategic priorities or whether it reads like a generic template.
Auditing Roles, Responsibilities, and Authorities
Clause 5.3 requires top management to assign and communicate responsibilities and authorities for relevant roles. This is another area where document review alone is insufficient.
Having a documented responsibility matrix is not the same as having people who understand and exercise those responsibilities. The test is whether the people assigned to roles actually know what they are responsible for, have the authority to act, and use that authority.
Common Weaknesses in Clause 5.3
In practice, the most common weaknesses in this area are:
- The management representative or quality manager role is documented but the person in the role has no real authority to make decisions or allocate resources
- Responsibilities are assigned in a document but have never been communicated to the people concerned
- Multiple people are listed as responsible for the same thing, with no clarity on who leads
- The person responsible for reporting on management system performance to top management does so but receives no meaningful response or decision
Test this by interviewing the person responsible for management system performance reporting. Ask them what happens when they raise a concern with top management. Do they get decisions, or do issues sit unresolved? Ask them whether they have the authority to stop a process if it is not conforming, or whether they need to escalate and wait. The answers will tell you a great deal about whether the authority assignment is real.
Using Objective Evidence to Support Your Clause 5 Findings
Every finding you raise against Clause 5 needs to be supported by objective evidence, not impressions. This is where many auditors struggle because the evidence for leadership commitment is often indirect.
The article on how to gather audit evidence that stands up to scrutiny is worth reading alongside this one. The principles of triangulation apply directly here. You are looking for evidence from multiple sources that tells a consistent story.
Building a Clause 5 Evidence Trail
Your evidence for Clause 5 findings should typically come from at least three sources:
- Interviews: What did top management say about their involvement, decisions, and awareness of system performance?
- Documents: What do management review records, corrective action logs, objective tracking records, and resource allocation decisions show?
- Observation: What did you observe during the audit that is consistent or inconsistent with what was claimed?
For example, if the CEO tells you they review corrective action performance monthly but the management review records show no discussion of corrective actions in the last two cycles, you have a contradiction. That contradiction is your evidence. Document both the interview statement and the record review finding, and let the gap speak for itself.
Common Clause 5 Nonconformities and How to Frame Them
When Clause 5 nonconformities are raised, they are often poorly written because auditors struggle to articulate the specific failure. Here are the most common patterns and how to frame them clearly.
Nonconformity: Policy Not Reviewed or Updated
The policy has not been reviewed following significant changes to the organisation's scope, structure, or operating context. The requirement is for top management to establish and maintain the policy. A policy that has not been reviewed in three years in a business that has expanded significantly is not being maintained. Reference the clause, state the evidence, and describe the gap.
Nonconformity: Management Review Not Attended by Top Management
Management review records show that the review was conducted by the quality manager alone, with no attendance by any member of top management. The requirement is for top management to conduct the review. Delegation to the quality manager does not satisfy the requirement.
Nonconformity: Objectives Not Monitored or Reported to Top Management
Quality objectives have been established but there is no evidence that performance against those objectives has been monitored or reported to top management during the audit period. This is both a Clause 5 and Clause 6.2 issue, and it is worth noting both references in your finding.
Observation: Limited Integration Into Business Planning
Where you cannot establish a clear nonconformity but the evidence suggests weak integration, document this as an observation or opportunity for improvement. Be specific: note that management system objectives are not referenced in the annual business plan and that there is no mechanism for management system performance data to feed into strategic decisions.
Exemplar Global Certified Training ProviderRTP No. 310970Clause 5 Across Different Standards
The approach described above applies across all ISO standards, but the specific evidence you gather varies by standard.
For ISO 45001, the leadership requirements are particularly strong. Clause 5.1 includes specific requirements for top management to take overall responsibility for worker health and safety, to ensure that OH&S policies and objectives are established and compatible with the strategic direction, and to ensure that the OH&S management system achieves its intended outcomes. The article on auditing leadership commitment under Clause 5.1 of ISO 45001 covers the safety specific requirements in detail.
For ISO 27001, leadership commitment to information security is tested by looking at whether the ISMS is resourced appropriately, whether information security risks are reported to and acted on by top management, and whether the security policy reflects the organisation's actual risk appetite. The consequences of weak leadership in information security are significant, and certification bodies take this seriously.
For ISO 14001, the 2026 revision has strengthened the leadership requirements, particularly around climate change and the organisation's environmental obligations. Top management commitment in this context means being able to demonstrate that environmental considerations are genuinely factored into business decisions, not simply managed as a compliance activity.
Building Your Clause 5 Audit Approach
Before you enter the audit, plan your Clause 5 approach deliberately. Identify who you will interview, what documents you will review, and what observations you will make. Do not leave Clause 5 to a single interview slot at the beginning of the audit.
The most effective approach is to gather Clause 5 evidence throughout the entire audit. Every interview you conduct with any process owner is an opportunity to test whether leadership commitment is visible at that level. Every document you review is an opportunity to check whether top management decisions are reflected in how the system operates. By the time you reach your closing meeting, your Clause 5 picture should be built from evidence gathered across the entire audit, not just the opening interview.
If you want to build these skills in a structured environment with practical exercises and real audit scenarios, the auditor training courses at Audit Workshop cover Clause 5 auditing in depth across ISO 9001, ISO 14001, ISO 45001, and ISO 27001. The training is built around what actually happens in audits, not just what the standard says.
