Why Clause 7.4 Gets Overlooked
Clause 7.4 of ISO 9001 is one of the shorter clauses in the standard. It takes up barely half a page. Because of that, organisations often treat it as a checkbox item, something to mention in a procedure and move on from. Auditors sometimes do the same, spending a few minutes on it before moving to something that feels more substantial.
On this page
That is a mistake. Communication is the connective tissue of a quality management system. When it breaks down, problems do not get reported, customer requirements do not reach the people doing the work, and improvements stall because nobody knows what needs to change. The standard is right to require it, and auditors are right to take it seriously.
This article explains what ISO 9001 Clause 7.4 actually requires, what it looks like in practice, and how auditors can evaluate it properly during an internal or external audit.
What Clause 7.4 Actually Says
The clause is brief. ISO 9001:2015 requires the organisation to determine the internal and external communications relevant to the quality management system. Specifically, it requires the organisation to determine:
- What it will communicate
- When it will communicate
- With whom it will communicate
- How it will communicate
- Who communicates
That is it. There is no requirement for a specific documented procedure, no mandated communication plan format, and no prescribed method. The standard gives organisations flexibility to decide what works for them.
But that flexibility is not an excuse for doing nothing. The five questions above are genuine requirements. If an organisation cannot answer them in a meaningful way for the communications that matter to its QMS, it has a problem.
Exemplar Global Certified Training ProviderRTP No. 310970
Internal vs External Communication
The clause covers both internal and external communication, and it is worth treating them separately because the risks and the evidence look quite different.
Internal Communication
Internal communication refers to the flow of quality relevant information within the organisation. This includes things like:
- Communicating the quality policy and objectives to staff
- Passing customer requirements from sales or project management to operations
- Reporting nonconformities and corrective actions
- Sharing the results of management reviews
- Notifying relevant people when processes or products change
The breakdown of internal communication is one of the most common root causes of nonconformities. A customer specifies a particular packaging requirement, the salesperson records it in the order, but nobody tells the warehouse. A corrective action is raised, closed on paper, but the team that caused the original problem never hears about it. These are communication failures, and they sit squarely within the scope of Clause 7.4.
External Communication
External communication covers what the organisation communicates outward, to customers, suppliers, regulators, and other relevant parties. This includes:
- Responding to customer enquiries and complaints
- Communicating product or service information
- Notifying suppliers of quality requirements
- Responding to regulatory bodies when required
External communication is often handled well in customer facing functions but poorly in supplier facing ones. An organisation might have a polished customer complaints process but no defined method for communicating quality expectations to its subcontractors. That gap is auditable.
The Five Questions: What Good Looks Like
The five questions in Clause 7.4 are a useful audit framework. Let us walk through each one and what a thoughtful answer looks like.
What Will Be Communicated
The organisation needs to have identified which communications are relevant to its QMS. This does not mean listing every email or meeting. It means identifying the communications that matter for quality, the ones where a failure would create a risk to product or service conformity, customer satisfaction, or system integrity.
In a manufacturing business, this might include customer specifications, production instructions, nonconformity alerts, and supplier quality requirements. In a professional services firm, it might include project briefs, scope changes, and client feedback. The content will vary. What matters is that the organisation has thought about it.
When It Will Be Communicated
Timing matters. A nonconformity reported two weeks after it occurs is less useful than one reported the same day. A change in customer requirements communicated after production has started creates rework. The organisation needs to have considered when communications need to happen, not just that they happen at all.
With Whom It Will Be Communicated
This is about identifying the right audiences. Who needs to know about a customer complaint? Who needs to be told when a supplier is placed on hold? Who receives the outputs of the management review? If the answer is vague or inconsistent, the communication is not working as intended.
How It Will Be Communicated
Method matters, particularly in organisations with dispersed workforces, multiple sites, or a mix of office and field staff. Email works for some things. A toolbox talk works for others. A notice on a screen in a production area works for shift workers who do not sit at desks. The method needs to be appropriate to the audience and the content.
Who Communicates
Someone needs to own each communication. If everyone is responsible, nobody is. Defining who is responsible for communicating what prevents important information from falling through the cracks because each person assumed someone else had done it.
How This Connects to Other Clauses
Clause 7.4 does not sit in isolation. It connects to several other parts of the standard, and understanding those connections helps auditors see the full picture.
Clause 5.2 requires the quality policy to be communicated within the organisation. That is a specific communication requirement that feeds into Clause 7.4. If the policy is not reaching people, that is both a Clause 5.2 and a Clause 7.4 issue.
Clause 7.3 on awareness requires people to be aware of the quality policy, their contribution to quality objectives, and the implications of not conforming. Awareness is the outcome that communication is supposed to produce. If you are auditing awareness under ISO 9001 Clause 7.3, you will often find the root cause of awareness gaps in communication failures that sit under Clause 7.4.
Clause 6.3 on planning of changes requires that changes to the QMS are carried out in a planned manner. Communication is a core part of change management. When a process changes, the people affected need to know. That is a Clause 7.4 obligation.
Clause 9.3 on management review requires that the outputs of the review are communicated. If the review produces decisions and actions but nobody outside the room ever hears about them, the system is not functioning properly.
What Auditors Should Look For
When auditing Clause 7.4, the goal is to establish whether the organisation has a coherent, functioning approach to quality relevant communication, not just a documented one. Here is how to approach it.
Start with Documents and Records
Ask to see how the organisation has addressed Clause 7.4. This might be a communication plan, a section in the quality manual, a procedure, or simply a defined approach embedded in other documents. There is no mandated format, so do not insist on one. What you are looking for is evidence that the five questions have been considered.
Check whether the documented approach is specific enough to be useful. A statement that says we communicate relevant quality information to relevant people at relevant times tells you nothing. A statement that says nonconformities are logged in the system within 24 hours and the relevant team leader is notified by the system automatically tells you something real.
Interview People at Different Levels
Talk to people who are not in quality roles. Ask a production operator how they find out about customer requirements. Ask a supervisor how they learn about changes to procedures. Ask a sales person what happens when a customer raises a complaint. The answers will tell you whether communication is actually working, not just whether it is documented.
If the operator says they find out about changes when a colleague mentions it informally, or when they notice the procedure on the noticeboard has been updated, that is a red flag. If the supervisor says they get a notification through the system and attend a briefing, that is more reassuring.
Follow a Communication Chain
Pick a real example and trace it. Choose a recent customer complaint, a recent nonconformity, or a recent change to a process. Then ask who was told, when, how, and by whom. Follow the chain from the triggering event to the people who needed to know about it. Where does the chain break? Where is it strong?
This approach produces concrete evidence rather than general impressions. It also tends to surface issues that a document review alone would miss.
Look for Evidence of External Communication
Do not neglect the external side. Ask how the organisation communicates quality requirements to its key suppliers. Ask how it handles customer enquiries about product or service quality. Ask what happens when a regulator requests information. These are all relevant external communications under Clause 7.4.
Common Nonconformities Under Clause 7.4
In practice, Clause 7.4 nonconformities tend to fall into a few recognisable patterns.
No Defined Approach at All
Some organisations have never formally addressed Clause 7.4. They rely on informal communication and assume it is working. This is more common in smaller organisations where the founder or quality manager knows everything and assumes others do too. When that person is absent, the system stops working. This is a genuine nonconformity, not just an observation.
Documented Approach That Does Not Match Reality
The procedure says nonconformities are communicated to the relevant team leader within 24 hours. In practice, they sit in a register that nobody reads until the monthly quality meeting. The documented approach and the actual practice are not aligned. This is also a nonconformity, and it is more frustrating than having no procedure at all, because someone took the time to write it down and then ignored it.
Internal Communication That Works, External That Does Not
Organisations often have reasonable internal communication mechanisms but pay little attention to external communication. Supplier quality requirements are assumed rather than stated. Customer complaints are acknowledged but not tracked through to resolution communication. This partial approach still falls short of what the clause requires.
Communication That Reaches Management but Not Workers
Management review outputs, quality objectives, and policy updates are communicated to managers and team leaders, but they do not reach the people doing the work. The standard does not limit communication to management. If operators, technicians, or field staff are relevant to the QMS, they need to receive relevant communications.
Practical Examples From the Field
Here are two scenarios that illustrate what Clause 7.4 looks like in practice.
A Medium Sized Construction Subcontractor
During an internal audit, the auditor asks a site supervisor how he finds out about changes to the inspection and test plan for a particular work package. The supervisor says he gets a revised copy from the project manager, usually at the weekly site meeting. The auditor asks whether there is a record of that communication. There is not. The auditor then asks what happens if a change occurs between weekly meetings. The supervisor says he would probably find out from the project manager directly, but there is no formal process for that.
The organisation has a quality procedure that says changes to ITPs are communicated to relevant site personnel prior to commencement of affected work. But there is no defined method, no defined timing, and no record. The auditor raises a nonconformity against Clause 7.4 for failing to define how and when this communication occurs, and a related finding under Clause 7.5 for the absence of records.
A Professional Services Firm
The quality manager shows the auditor a communication matrix developed when the QMS was first implemented. It lists key communications, their frequency, their audience, their method, and the person responsible. The auditor selects three communications from the matrix and asks for evidence that they occurred as described. Two of the three have clear evidence. The third, a quarterly update on quality objectives to all staff, has not occurred for eight months. The matrix says it should happen quarterly via a team meeting. The auditor raises a nonconformity for failure to implement the defined communication approach.
The lesson in both cases is the same. The clause requires a defined and implemented approach. Having one without the other is not enough.
Tips for Quality Managers Preparing for Audit
If you are a quality manager preparing for an internal or external audit, here is what to focus on for Clause 7.4.
- Make sure you can describe your approach to the five questions in concrete terms, not just in general statements
- Check that your documented approach matches what actually happens, not what you intended to happen when you wrote the procedure
- Review your external communications, particularly how quality requirements are communicated to suppliers and how customer feedback is handled
- Make sure communications reach the shop floor, not just management
- Have some evidence ready, records of toolbox talks, system notifications, meeting minutes, or whatever method you use
You do not need a complex communication plan. You need a coherent, implemented approach that you can explain and demonstrate.
If you want to strengthen your understanding of how Clause 7.4 fits into the broader support section of ISO 9001, it is worth reviewing how auditors approach Clause 7 as a whole, including competence, awareness, and documented information alongside communication.
Exemplar Global Certified Training ProviderRTP No. 310970A Note on Documented Information
Clause 7.4 does not require documented information as evidence of communication. The standard does not include a note requiring records of communications in the way it does for some other clauses. However, without some form of record, it is very difficult to demonstrate that communication has occurred as intended.
In practice, most organisations will have some records, meeting minutes, email trails, sign off sheets, system notifications, or induction records. These records become the audit evidence. If an organisation relies entirely on informal verbal communication with no records at all, it will struggle to demonstrate conformance, even if the communication is actually happening.
This does not mean you need to document every conversation. It means you need enough of a record to show that key communications are occurring as planned.
Auditing Clause 7.4 in an Integrated System
Many Australian organisations run integrated management systems that combine ISO 9001 with ISO 14001 and ISO 45001. In these systems, communication requirements appear in all three standards under equivalent clauses. The approach to communication needs to cover quality, environmental, and safety relevant information.
When auditing an integrated system, check whether the communication approach genuinely covers all three domains or whether quality communication is well defined but environmental and safety communication is assumed to be covered by the same mechanisms without being explicitly addressed. That assumption is often wrong in practice.
