The scope (clause 4.3), the quality policy (clause 5.2), and the quality objectives (clause 6.2) are the first three documents of an ISO 9001:2015 quality management system. The scope says what the system covers. The policy says what top management commits to. The objectives turn that commitment into numbers someone owns. A Stage 1 auditor reads all three before opening a procedure.
All three are short. What makes them hard is the questions they must survive: does the scope match what ships, can an operator say what the policy means for their job, and has anyone looked at the objective data since it was written. The worked examples below are for fictional shops.
Scope (clause 4.3): what the system covers and what it does not
Clause 4.3 asks you to determine the boundaries and applicability of the system, considering the issues from clause 4.1, the interested parties from clause 4.2, and your products and services. The scope must be maintained as documented information, state the types of products and services covered, and justify any requirement of the standard you have determined is not applicable.
The standard says boundaries; in practice that means sites, processes, and products. Name the site by address. Name the process families in the order work flows: quoting, purchasing, machining, inspection, shipping. Name the products the way a customer would. The registrar puts the scope on the certificate, so a product line you leave out is one the certificate says nothing about.
Requirements that do not apply
ISO 9001:2008 called these exclusions and limited them to clause 7. The 2015 revision dropped the word and widened the rule: any requirement can be determined not applicable, provided it does not affect your ability or responsibility to ensure conforming products and services and the enhancement of customer satisfaction. Write "not applicable" and give the reason in the scope itself.
The classic case is clause 8.3, design and development, for a build-to-print shop. The test an auditor applies: do you ever decide what the part is? If every dimension, material, and tolerance comes from the customer, 8.3 does not apply. If you quote design assistance, redline a print and own the change, or sell from your own catalog, it applies to that work.
| Requirement | When the claim holds | Where it fails |
|---|---|---|
| 8.3 Design and development | All product definition comes from the customer and the shop never changes it | Design assistance in quotes, catalog products, redlines the shop owns |
| 8.5.3 Customer or external provider property | Almost never. Customer drawings, tooling, and consigned material all count | Any customer print on your server makes it apply |
| 7.1.5.2 Measurement traceability | Traceability is not a customer or regulatory requirement and not needed to trust your measurement results | Calipers and gauge blocks on the floor end the claim |
Quality policy (clause 5.2): a framework, not a poster
Clause 5.2.1 makes top management responsible for a policy that does four things: it is appropriate to the purpose and context of the organization and supports its strategic direction, it provides a framework for setting quality objectives, it includes a commitment to satisfy applicable requirements, and it includes a commitment to continual improvement of the quality management system.
Clause 5.2.2 requires the policy to be maintained as documented information, communicated, understood, and applied within the organization, and available to relevant interested parties as appropriate. Clause 7.3 adds that people doing work under your control must be aware of the policy and of the objectives relevant to them.
"Quality is our top priority" fails the tests that matter: it fits any company, names nothing to measure, and commits to nothing. Framed by the time clock, it is a poster, and auditors know the difference.
A policy that passes runs three to five sentences: who you are and what you make; the things you will measure, which is the framework the objectives hang from; a commitment to customer, statutory, and regulatory requirements; and a commitment to improve through internal audit, corrective action, and management review. Top management approves and dates it, and it carries a revision level.
Quality objectives (clause 6.2): numbers with owners
Clause 6.2.1 requires objectives at the functions, levels, and processes where they are needed. Each must be consistent with the policy, measurable, relevant to conforming products and customer satisfaction, monitored, communicated, and updated as appropriate, and it must take applicable requirements into account. Documented information on the objectives must be maintained.
Clause 6.2.2 is the part most first drafts skip. For each objective you must determine:
- What will be done. The actions, not the target restated: first-article inspection on every setup, a weekly review of scrap tags.
- What resources will be required. Hours, equipment, training, or budget. "None" is honest only if the current process already produces the result.
- Who will be responsible. One named role. A committee is nobody.
- When it will be completed. A date, or a review cadence for a standing metric.
- How the results will be evaluated. The data source, the calculation, and the meeting where the number is read.
That last item is the link to clause 9.3, where management review inputs include the extent to which quality objectives have been met. An objective missed at review leaves the room as an action with an owner, or, where it exposes a nonconformity, as corrective action under clause 10.2. An objective met leaves raised or replaced. That is what "updated as appropriate" looks like on a record.
A usable objective has a metric, a baseline, a target, an owner, a review date, and a plan. "Improve quality" has none of them. "Get certified" is a project, not a quality objective.
Worked example: a build-to-print CNC machine shop
The shop is fictional: one site, milling and turning, in-house inspection, no design authority. Bracketed text is yours to fill in.
Scope statement
The quality management system of [Company] covers the quoting, purchasing, CNC machining, inspection, and shipment of precision machined components produced to customer-supplied drawings and specifications at [street address, city, state]. Clause 8.3, design and development, is not applicable: all product definition is supplied by the customer, and [Company] does not design product or alter customer designs. All other requirements of ISO 9001:2015 apply.
Quality policy
[Company] machines precision components to customer drawings for aerospace and industrial equipment manufacturers. We commit to shipping parts that conform to the customer print and to every applicable customer, statutory, and regulatory requirement. We measure on-time delivery, first-pass yield at final inspection, and customer complaints, and we set annual objectives against each. We improve the quality management system through internal audit, corrective action, and management review. Every employee has the authority to stop work on a part that does not conform.
Quality objectives
| Objective | Measure and source | Owner and plan | Evaluated |
|---|---|---|---|
| On-time delivery at or above 95 percent of order lines | Lines shipped by the acknowledged date, divided by lines due, from the ERP shipment report | Production manager. Weekly capacity review; second shift on the lathes from the second quarter | Monthly by the owner; reported at every management review |
| First-pass yield at final inspection at or above 98 percent | Lots accepted without rework or scrap, divided by lots inspected, from inspection records | Quality manager. First-article inspection on every setup; scrap tags reviewed weekly; CMM training by the third quarter | Monthly by the owner; reported at every management review |
| Customer complaints at or below two per quarter, each closed with a verified corrective action | Complaints in the corrective action log, from customer emails and returned parts | Quality manager. Each complaint opened as a corrective action on arrival; root cause reviewed with the operator | Quarterly, at management review |
Worked example: a contract electronics assembler
Also fictional: surface-mount and through-hole assembly, test, and box build. The shop gives design-for-manufacturability feedback but never owns the design.
Scope statement
The quality management system of [Company] covers the procurement, surface-mount and through-hole assembly, test, and shipment of printed circuit board assemblies and box-build products manufactured to customer-released designs at [street address, city, state]. Clause 8.3, design and development, is not applicable: the customer owns and releases every design, and design-for-manufacturability feedback from [Company] is advisory until the customer issues a revised release. All other requirements of ISO 9001:2015 apply.
Quality policy
[Company] assembles printed circuit board assemblies and box-build products to our customers' released designs for industrial controls and communications equipment makers. We commit to shipping product that conforms to the released design, to the IPC-A-610 class the customer specifies, and to every applicable statutory and regulatory requirement. We measure first-pass test yield, on-time delivery, and customer-reported defects, and we set objectives against each. We improve the system through internal audit, corrective action, and management review. Every operator has the authority to stop the line when product does not meet the acceptance criteria.
Quality objectives
- First-pass yield at in-circuit and functional test at or above 97 percent, measured monthly from the test-system logs. Owner: test engineering lead. Plan: automated optical inspection after reflow by the second quarter; weekly review of the top three defect codes. Evaluated at management review.
- On-time delivery at or above 95 percent of shipments against the acknowledged date, measured monthly from the ERP shipment report. Owner: planning manager. Plan: shortages reviewed daily against the build schedule; a second distributor qualified under clause 8.4 for the highest-risk components. Evaluated at management review.
- Customer-reported defects at or below 200 parts per million of units shipped, measured quarterly from return authorizations and complaints. Owner: quality manager. Plan: every return opened as a corrective action under clause 10.2; failure analysis within five working days. Evaluated at management review.
What Stage 1 auditors find on these three documents
Stage 1 is largely a documentation review, and these three are read first. The Stage 1 report lists what it finds as areas of concern; any still open at Stage 2 can be raised as nonconformities. The findings repeat from shop to shop.
- The scope omits a site or product line that ships under the company name. The auditor compares it to the website, the quote log, and the shipping dock.
- Design is marked not applicable with no justification, or with one the quote log contradicts. A single quote for design assistance reopens clause 8.3.
- The policy is a slogan. Nothing in it can be measured, so no objective traces to it, failing 5.2.1 and 6.2.1 at once.
- The policy on the wall, in the manual, and on the website do not match, or none of them shows an approval and a date (clause 7.5.2).
- Objectives are activities, such as achieving certification, or have a target with no owner and no clause 6.2.2 plan.
- Objectives were written but never monitored: no data since the date on the document, and no management review minutes mention them.
Wording findings are cheap to fix, because the documents are short. The expensive finding is the missing trail behind the objectives: if the first data point is dated the week before the audit, the finding is on 6.2.1 and 9.3.
Write them in this order
Scope first, because it fixes what the policy and objectives are about. Policy second, because the objectives must trace to it. Objectives third, with the 6.2.2 plan written the same day. Then put the first management review on the calendar. Six to nine months is typical for a first certification. That clock starts when the objectives begin producing records, not when they are signed.
You can write all three in a week if the owner is in the room. If you would rather have the whole set written from a structured questionnaire, ISO Delivered's Full documentation, sized to how your company runs, is one option: a flat $8,000, typically 2–4 weeks after a complete intake, an estimate, not a commitment. Either way, the owner signs the policy and owns the objectives.
Sources
- ISO 9001:2015 — Quality management systems — Requirements. Every ISO 9001 clause cited on this page is from this text.
- ISO 9000:2015 — Quality management systems — Fundamentals and vocabulary. Source of the definition of top management used in the FAQ.
Frequently asked questions
Can we still call a non-applicable requirement an "exclusion"?
Auditors will understand the word, but the 2015 edition does not use it. ISO 9001:2008 allowed exclusions only within clause 7. ISO 9001:2015 lets you determine any requirement not applicable, provided it does not affect your ability or responsibility to ensure conforming products and services and the enhancement of customer satisfaction, and it requires the justification in the scope. Write "not applicable" and give the reason.
Does the quality policy have to be posted on the wall?
No. Clause 5.2.2 requires the policy to be documented, communicated, understood, and applied, and to be available to relevant interested parties. A poster is one way to communicate it. The auditor checks whether people can connect it to their work, not whether it is framed.
How many quality objectives do we need?
The standard does not set a number. Three to five company-level objectives is common at a small manufacturer, with process-level objectives only where a process owner will track them. Every objective you write must be monitored and reviewed, so each one is a standing chore. Fewer objectives with real data beat a long list with none.
Can the scope cover only one site or one product line?
Yes. Clause 4.3 lets you set the boundaries, and the certificate carries them. A site or product line you leave out is not covered by the certificate, and customers of that line will read the certificate the same way the auditor does. If you leave something out, make sure the shared processes the certified work depends on, such as purchasing or calibration, are still inside the scope.
Do the objectives have to change every year?
Clause 6.2.1 says updated as appropriate, which is a judgment for management review. An objective you keep missing should produce an action or a corrective action, not a quieter target. An objective unchanged for years with no data behind it is the one an auditor writes up.
Who signs the quality policy?
Top management, which ISO 9000:2015 defines as the person or group who directs and controls the organization at the highest level. In a small manufacturer that is the owner or general manager, not the quality manager. Clause 5.1.1 makes top management accountable for the effectiveness of the system, and the signature on the policy is where that accountability is first visible.