Auditing Roles, Responsibilities and Authorities in ISO 9001

Why Clause 5.3 Matters More Than Auditors Often Expect

When auditors plan an ISO 9001 audit, Clause 5.3 rarely tops the priority list. It sits quietly in the leadership section, sandwiched between the quality policy and planning requirements, and it is easy to treat it as a quick tick on the checklist. In practice, auditing roles, responsibilities and authorities in ISO 9001 is one of the most revealing things you can do on an audit. The way an organisation assigns accountability for quality tells you almost everything about how seriously leadership takes the system.

Clause 5.3 requires top management to ensure that responsibilities and authorities for relevant roles are assigned, communicated, and understood throughout the organisation. Those three words, assigned, communicated, and understood, each carry real weight. An organisation can have beautifully written job descriptions and still fail on all three counts when you start asking people questions on the floor.

This article walks through what Clause 5.3 actually requires, how to audit it properly, what evidence to gather, and the nonconformities that come up most often. It is written for internal auditors and quality managers preparing for internal audits, as well as lead auditors who want to get more out of this clause than a document review.

What ISO 9001 Clause 5.3 Actually Requires

The clause is short. That brevity sometimes leads auditors to underestimate it. ISO 9001:2015 Clause 5.3 states that top management shall assign responsibility and authority for ensuring the QMS conforms to the requirements of the standard, that processes are delivering their intended outputs, that performance is reported to top management, that customer focus is promoted throughout the organisation, and that the integrity of the QMS is maintained when changes are planned and implemented.

These five responsibilities do not need to sit with a single person. In many organisations they are distributed across several roles. That is perfectly acceptable under the standard. What is not acceptable is leaving them unassigned, poorly communicated, or assigned on paper but ignored in practice.

The Management Representative Question

One of the changes from ISO 9001:2008 to the 2015 edition was the removal of the mandatory management representative role. The 2008 version required a specific member of management to be designated. The 2015 version deliberately dropped that requirement to encourage broader leadership ownership rather than delegating quality to one person.

In practice, many organisations still appoint a quality manager or quality coordinator to coordinate the QMS. That is fine. The standard does not prohibit it. What the standard does require is that top management retains accountability and does not simply hand quality off to one person and walk away. When you audit this, you are looking for evidence that leadership is genuinely engaged, not just that someone has the title of quality manager.

Planning Your Audit of Clause 5.3

Before you walk into the building, decide what you are trying to find out. Good audit objectives for Clause 5.3 might include: Are responsibilities for QMS conformity clearly assigned? Do the people holding those responsibilities know they hold them? Can they describe what they are responsible for in plain language? Is there evidence that responsibilities were communicated, not just documented?

Your audit checklist for this clause should not be a list of documents to collect. It should be a set of questions that probe whether the system is real. If you want to build a checklist that actually drives useful findings, think about the difference between checking for existence of documented roles versus checking for understanding and practice. The former takes five minutes. The latter takes a conversation.

Who to Interview

Interview top management first. This does not need to be a lengthy session, but you need to establish what they understand about their QMS responsibilities. Ask the CEO, operations manager, or whoever constitutes top management in this organisation what they are personally responsible for under the quality system. Listen carefully. Vague answers like

we are responsible for quality across the board

Then interview the quality manager or coordinator if one exists. Ask them what their role covers, who they report to, and how they report QMS performance to top management. Ask to see evidence of that reporting. Minutes of management reviews, performance dashboards, or email updates all count.

Finally, interview process owners and supervisors. These are the people who often carry responsibilities for ensuring processes deliver their intended outputs. Ask them what they are responsible for in relation to quality. Ask whether they know who to go to if something goes wrong. Ask whether they have been told what their quality responsibilities are, and when they were last reminded.

What Evidence to Gather

Clause 5.3 does not mandate specific documented information. The standard does not say you must have a responsibility matrix or an organisational chart. However, most organisations do maintain some form of documented evidence, and auditors should know what to look for and how to evaluate it.

Organisational Charts and Job Descriptions

An organisational chart can confirm the reporting structure but tells you almost nothing about whether responsibilities are understood. Job descriptions are more useful because they should describe the quality related responsibilities attached to each role. When you review a job description, look for specificity. A job description that says

responsible for quality

responsible for ensuring all inspection records are completed before product release and that nonconforming outputs are tagged and quarantined in line with Clause 8.7

Check whether the job descriptions align with what people actually told you in interviews. If the quality manager's job description says they are responsible for reporting QMS performance to top management, ask to see evidence that this has happened. If a production supervisor's job description says they are responsible for process conformity in their area, ask them to walk you through what that means in practice.

Responsibility Matrices and RACI Charts

Some organisations use responsibility matrices or RACI charts to map roles against QMS processes. These can be useful audit tools if they are current and actually used. Ask when the matrix was last reviewed. Ask whether it was updated when people changed roles or when the organisation restructured. A RACI chart that was created three years ago and has not been touched since is a document, not a living part of the system.

Evidence of Communication

This is where many audits fall short. Auditors check whether responsibilities are documented but forget to check whether they were communicated. Ask how new employees are told about their quality responsibilities. Is it part of induction? Is it covered in training? Ask how responsibilities are communicated when they change. If the organisation restructured six months ago and moved quality oversight from one department to another, how did affected staff find out?

Look for induction records, training records, toolbox talks, team meeting minutes, or any other evidence that responsibilities were actively communicated rather than just written down somewhere.

Common Nonconformities Against Clause 5.3

After conducting hundreds of external certification audits across a wide range of industries, the same Clause 5.3 nonconformities come up repeatedly. Knowing what to look for makes your audit sharper.

Responsibilities Assigned but Not Communicated

This is the most common finding. The quality manager has a detailed job description. The organisational chart is current. But when you interview a production supervisor and ask what their quality responsibilities are, they look at you blankly or give a generic answer. The responsibilities exist on paper but have not been communicated to the people who need to carry them out.

A nonconformity here would be written against the requirement that responsibilities are communicated throughout the organisation. The evidence would be the gap between the documented responsibilities and what people actually told you during interviews.

Top Management Not Retaining Accountability

In some organisations, the quality manager has been given full ownership of the QMS and top management has effectively stepped back. When you ask the CEO what they are responsible for under the QMS, they tell you to ask the quality manager. When you ask how QMS performance is reported to them, they are not sure. When you ask whether they were involved in planning any recent changes to the system, they were not.

This is a leadership issue that goes beyond Clause 5.3. It often connects to Clause 5.1 findings around leadership and commitment. However, the specific Clause 5.3 finding is that the responsibilities required by the clause, particularly reporting performance to top management and maintaining QMS integrity during change, have not been effectively assigned or retained at the appropriate level.

Responsibilities Not Updated After Organisational Change

Organisations restructure. People leave. Roles merge. When this happens, QMS responsibilities need to be reviewed and updated. A common finding is that the responsibility matrix or job descriptions still refer to a role that no longer exists, or that a person who left six months ago is still listed as responsible for a critical QMS function. No one has been formally assigned to take over.

Ask specifically about any recent changes to the organisation and whether QMS responsibilities were reviewed as part of that change. This connects directly to Clause 6.3 on planning of changes, but the Clause 5.3 finding is that responsibilities are no longer accurately assigned.

Process Owners Not Knowing They Are Process Owners

Many organisations document process owners in their process maps or procedure documents. When you interview the person listed as process owner for, say, the purchasing process, and they have no idea they hold that role, you have a clear finding. They cannot describe what a process owner is responsible for, they have never been told, and they certainly have not been actively fulfilling the role.

This finding combines a failure of assignment and a failure of communication. Write it clearly, with the specific evidence: the procedure lists this person as process owner, the person was unable to describe their responsibilities in that role, and no records of communication or training regarding this responsibility could be provided.

Linking Clause 5.3 to the Rest of the Audit

Clause 5.3 does not exist in isolation. The findings you make here often connect to findings in other parts of the audit. If responsibilities for internal auditing are unclear, you may find that internal audits have not been conducted as planned, which connects to Clause 9.2. If responsibilities for corrective action are vague, you may find that nonconformities are not being properly closed out, which connects to Clause 10.2. If process owners do not know their responsibilities, you may find that processes are not being monitored effectively, which connects to Clause 9.1.1.

Good auditors follow these threads. When you find a Clause 5.3 issue, ask yourself where else in the system it might be having an effect. The role of an auditor is not just to identify individual nonconformities but to help the organisation understand the systemic issues that sit behind them. For a deeper look at how to approach this kind of connected auditing, the article on what auditors look for in an ISO 9001 quality management system covers the broader picture well.

Auditing Clause 5.3 in Small Organisations

In a small business, one person often wears many hats. The owner might be the quality manager, the sales manager, and the operations manager all at once. This is not a nonconformity. The standard does not require separate people for separate roles. What it does require is that the responsibilities are still clearly assigned, even if they all sit with the same person, and that they are understood by everyone in the organisation who needs to know.

In a small organisation, the audit of Clause 5.3 might be quite brief. Interview the owner, confirm they understand their QMS responsibilities, check that any other staff members who carry quality responsibilities know what those responsibilities are, and look for evidence of communication. The depth of the audit should be proportionate to the size and complexity of the organisation. For more on how ISO 9001 applies in smaller businesses, the article on ISO 9001 for small business provides useful context.

Writing Findings Against Clause 5.3

When you write a finding against Clause 5.3, be specific. Do not write

responsibilities are not clearly defined.

The procedure for internal auditing (QP-08, Rev 3) identifies the Quality Manager as responsible for scheduling and reporting on internal audits. The current Quality Manager (interviewed on [date]) was unable to confirm awareness of this responsibility and stated they had not been involved in scheduling any audits. No records of communication of this responsibility to the current Quality Manager could be provided. This is a nonconformity against ISO 9001:2015 Clause 5.3, which requires that responsibilities and authorities for relevant roles are assigned, communicated, and understood.

That finding is specific, evidence based, and directly referenced to the clause. The auditee knows exactly what the problem is and can take meaningful corrective action. For guidance on writing findings that hold up to scrutiny, the article on how to write audit findings that stand up to challenge covers the structure and language in detail.

Practical Tips for Getting More Out of This Clause

Start with a process walk before your interviews. Walking through the process gives you a feel for how the organisation actually works, which helps you ask better questions when you sit down with people. You will notice things that the documentation does not tell you.

Use the five responsibilities in Clause 5.3 as a framework. For each one, ask yourself: who is responsible for this, do they know it, and can they show you evidence? Work through them systematically rather than asking a generic question about roles and responsibilities.

Do not accept

it is all in the job descriptions

If you find that responsibilities are well assigned and communicated, say so in your report. Positive observations matter. They tell top management what is working and give the quality manager something concrete to point to. Audit reports that only contain findings and observations of concern are less useful than reports that give an accurate picture of the whole system.

For auditors who want to build stronger skills across the full range of ISO 9001 leadership clauses, the guide to auditing leadership and commitment in ISO 9001 is worth reading alongside this article. Clauses 5.1, 5.2, and 5.3 work together, and auditing them as a connected set gives you a much richer picture of how leadership is actually functioning.

Building Competence as an ISO 9001 Auditor

Auditing Clause 5.3 well requires more than knowing what the clause says. It requires interview skills, the ability to read organisational dynamics, an understanding of how responsibilities flow through a management system, and the confidence to pursue a finding when the evidence points to a problem even if the auditee pushes back.

These are skills that develop through training and practice. If you are working towards your internal auditor or lead auditor credentials, Audit Workshop offers practical, scenario based training for ISO 9001 at Foundation, Internal Auditor, and Lead Auditor levels. The courses are designed by Dilawar Laghari, a certified lead auditor with over 14 years of compliance experience and more than 500 external certification audits conducted across Australia, the Middle East, and South Asia. The training is built around real audit situations, not just theory, so you leave with skills you can apply immediately.