ISO 9001 · Step-by-step series · Article 7 of 10

ISO 9001 Clause 9: Performance Evaluation and Internal Audits

Clause 9 of ISO 9001:2015 is the feedback engine of the quality management system. Without it, the QMS would run blind — producing and managing without any way of knowing whether it is improving or deteriorating. Clause 9 sets out how to measure system performance (9.1), how to audit it internally in a systematic way (9.2), and how top management periodically reviews whether the QMS remains suitable, adequate and effective (9.3). This guide explains exactly what you need to satisfy each sub-clause, with worked examples of KPIs, an audit programme and a management review agenda.

9.1 Monitoring, measurement, analysis and evaluation: measure what matters

Clause 9.1 requires the organisation to determine what needs to be monitored and measured, the methods needed to ensure valid results, when monitoring and measurement will be performed, and when the results will be analysed and evaluated.

In practice this means having a defined set of KPIs that show whether the QMS is working well, measured on a defined frequency, with someone responsible for analysing the data and acting on it.

Minimum recommended KPIs for a certified manufacturing SME

• Customer satisfaction: average survey score (1–10 scale) and response rate. Recommended frequency: every six months or after each significant project or delivery.
• Internal nonconformities: total per month, per process or production line, and ratio of NCs to units produced. The trend matters more than the absolute figure.
• Customer nonconformities (complaints): number per month, warranty cost, average resolution time. A direct proxy for customer perception of quality.
• OTD — on-time delivery: percentage of orders delivered on the committed date. A core process KPI connecting production, logistics and sales.
• Achievement of quality objectives: monthly tracking of the objectives defined under Clause 6.2 — direct evidence that objectives are monitored, not just declared.
• Corrective action effectiveness: percentage of corrective actions closed on time and percentage with verified effectiveness — an indicator of system maturity.

9.1.2 Customer satisfaction: beyond the survey

Clause 9.1.2 requires the organisation to monitor customer perceptions of the degree to which their needs and expectations have been fulfilled. The standard does not prescribe a method — it can be a survey, regular customer meetings, complaint analysis, market share data, or distributor reports.

The most common mistake is sending a survey once a year, getting a score, logging it in a spreadsheet and doing nothing further. What the standard requires — and what genuinely adds value — is analysing satisfaction data, identifying areas for improvement and taking concrete action on the lowest-scoring aspects.

9.1.3 Analysis and evaluation of data: turning data into decisions

Clause 9.1.3 requires the results of analysis to be used to evaluate: conformity of products and services, the degree of customer satisfaction, the performance and effectiveness of the QMS, whether planning has been implemented effectively, the effectiveness of actions taken to address risks and opportunities, the performance of external providers, and the need for improvements to the QMS.

In practice this means producing a monthly or quarterly data analysis pack — it can be as simple as a two-page report — that feeds both operational decisions and the management review.

9.2 Internal audit: the system's mirror

The internal audit is the tool that lets an organisation systematically verify whether its QMS is being effectively implemented and whether it meets ISO 9001 requirements. Unlike the certification (third-party) audit, internal audits are carried out by people from within the organisation, or by external auditors contracted to act as internal auditors on the organisation's behalf.

The requirements of Clause 9.2 are:

• Audit programme: plan, establish, implement and maintain an audit programme covering frequency, methods, responsibilities, planning requirements and reporting. The programme must take into account the importance of the processes concerned and the results of previous audits.
• Criteria and scope: every audit has criteria (what it is audited against — ISO 9001 requirements and the organisation's own QMS requirements) and a scope (which processes or areas are audited).
• Independence: auditors cannot audit their own work. A production manager may audit the purchasing process, but not the production process they themselves manage.
• Audit report: the results of audits must be reported to relevant management and retained as documented information.
• Action on findings: management of the area audited must take corrections and corrective actions without undue delay and verify their implementation.

Annual internal audit programme by process

9.3 Management review: the meeting the standard requires you to take seriously

The management review is the periodic meeting at which top management evaluates whether the QMS is suitable, adequate and effective. It is not a production meeting or a sales meeting — it is specifically a review of the quality management system.

Clause 9.3 is very precise about what must be covered. The standard splits the requirements into three parts:

9.3.2 — Management review inputs (what must be analysed)

• Status of actions from previous management reviews.
• Changes in external and internal issues relevant to the QMS (the context of the organisation).
• Information on QMS performance and effectiveness: customer satisfaction and feedback from relevant interested parties, the extent to which quality objectives have been met, process performance and conformity of products and services, nonconformities and corrective actions, monitoring and measurement results, audit results, the performance of external providers.
• Adequacy of resources.
• The effectiveness of actions taken to address risks and opportunities.
• Opportunities for improvement.

9.3.3 — Management review outputs (the decisions that must be made)

The outputs of the management review must include decisions and actions related to:

• Opportunities for improvement of the QMS.
• Any need for changes to the QMS, including resource needs.
• Concrete actions when quality objectives are not being met.

Minimum management review agenda template

IgeraIndustria at Clause 9: real-time data for management

Frequently asked questions about ISO 9001 Clause 9

How often must the management review be held under ISO 9001?

ISO 9001 requires the management review to be carried out "at planned intervals" but does not fix a frequency. Annual review is the most common approach. Some organisations opt for six-monthly or even quarterly reviews for more dynamic systems. What matters is that the frequency is sufficient for management to detect problems and make decisions before they escalate.

Can the quality manager carry out the internal audit without being a certified auditor?

ISO 9001 requires auditors to be "objective and impartial" and to have the competence needed to conduct audits. It does not require a specific certification such as ISO 9001 lead auditor (ISO 17021). In practice, the recommended minimum training is a 16–24 hour internal auditor course based on the ISO 19011 guideline. What matters most is that the auditor does not audit their own work and has sufficient knowledge of the processes being audited.

What happens if not all planned audits are completed within the year?

If planned audits remain outstanding at the end of the annual cycle, that is a deviation that must be justified. The certification auditor will check the audit programme and the completion rate. If the deviation is justified (auditor absence, extraordinary circumstances) and the un-audited processes are prioritised in the next cycle, it may be treated as an observation. If it is a recurring, unjustified pattern, it can become a nonconformity against Clause 9.2.

What minimum indicators does ISO 9001 require for customer satisfaction?

ISO 9001 does not specify minimum indicators. Clause 9.1.2 requires the organisation to "monitor customer perceptions of the degree to which their needs and expectations have been fulfilled". The method is left to the organisation's judgement. The most common approaches are: an annual satisfaction survey, complaint tracking, analysis of repeat orders as a proxy for satisfaction, periodic review meetings with key customers, or Net Promoter Score (NPS).

Can the internal audit be outsourced to an external company?

Yes. ISO 9001 allows internal audits to be carried out by external auditors acting on the organisation's behalf. This is common in SMEs without staff trained as internal auditors. Contracted external auditors must meet the same competence and independence requirements as internal auditors — they cannot audit processes they have advised on or helped implement. Overall responsibility for the audit programme remains with the organisation.

What evidence must be retained from the management review?

Clause 9.3.3 requires documented information to be retained as evidence of the results of the management review. In practice this means meeting minutes that include: the date, attendees, the inputs analysed with the actual data presented, management's conclusions on each point, and the agreed actions with an owner and deadline. The minutes should be signed off or approved by management. A blank sheet titled "management review" with no concrete content does not satisfy the requirement.

Article reviewed by IgeraIndustria Quality Team, updated 2026-07-07. References: ISO 9001:2015 Clauses 9.1–9.3. This article does not constitute legal or certification advice — consult your certification body for scheme-specific requirements.