Introduction
Many organizations assume ISO 9001 demands a thick binder of formal policies and procedures. It doesn't. The standard asks you to document and control the information your quality management system (QMS) needs to work, and nothing more.
This guide is for U.S. organizations implementing or improving ISO 9001. It covers what policies and procedures do, how they relate to records, and how to avoid over-documenting.
We'll separate three things:
- Documented information the standard requires
- Optional procedures that help
- Organization-specific documents that make work consistent and auditable
The clause map here follows ISO 9001:2015. ISO 9001:2026 was published in September 2026, so confirm exact clause wording against the official ISO text before you finalize anything.
Key Takeaways
- ISO 9001 prescribes no universal list of policy titles or mandatory procedures.
- Documents tell people what to do; records prove the work happened as planned.
- Policies set direction, procedures define methods, work instructions cover tasks, records show results.
- Good documentation matches actual work and supports improvement, not paperwork for its own sake.
ISO 9001 Policies, Procedures, and Documented Information: How They Fit Together
Policy: direction and commitment
A policy is a high-level statement of intent and leadership commitment. The quality policy typically addresses customer focus, applicable requirements, a framework for quality objectives, and continual improvement. It doesn't prescribe operational steps.
Procedure: the controlled method
A procedure describes how a process is performed. A useful one covers:
- Purpose and scope
- Responsibilities
- Inputs and outputs
- Criteria and controls
- Required records
- Actions when results miss requirements
Process, work instruction, and record: the supporting layers
Take handling of a nonconforming output as an example. The process defines the desired result: nonconforming product doesn't reach the customer. The procedure organizes the method for identifying, segregating, and dispositioning it. A work instruction shows an inspector exactly how to tag and move the item. The nonconformance report is the record proving what happened.
The standard also allows flexibility in format. NQA's implementation guide notes that images, videos, models, and prototypes can serve as documented information, electronically or on paper.
What Documentation Does ISO 9001 Require?
Confirm which edition applies. The checklist below reflects the 2015 baseline. Existing accredited 2015 certifications have until September 30, 2029 to transition, so verify clause wording and transition rules for your situation.
Maintained versus retained
ISO uses two verbs. Maintain means keep current (policy, scope, process-support information). Retain means preserve evidence (completed records). Both must be controlled.
Required or conditionally required information
Maintained information:
- QMS scope (4.3)
- Process-support information, to the extent necessary (4.4)
- Quality policy (5.2)
- Quality objectives (6.2)
- Operational controls and product or service characteristics (8.1, 8.5.1)
Retained evidence, with conditions:
- Competence of people affecting QMS performance (7.2)
- Monitoring and measuring fitness for purpose (7.1.5.1); calibration basis only where no measurement standard exists (7.1.5.2)
- Requirements review results (8.2.3)
- Design and development records, only where design applies (8.3)
- Supplier evaluation and resulting actions (8.4.1)
- Traceability, only where required (8.5.2)
- Customer or provider property problems (8.5.3)
- Release authorization (8.6)
- Nonconformities and corrective actions (8.7, 10.2.2)
- Internal audits (9.2.2) and management review results (9.3.3)
Manuals and named procedures are optional
ISO/TC 176 guidance treats a quality manual as an optional useful document, and the standard names no mandatory procedures. Extent depends on organization size, process complexity and personnel competence.
Document a process when:
- Risk or complexity is high
- Staff turnover is high or competence varies
- Customers or regulators require it
- Multiple sites need consistency
- You need objective evidence
Build a document matrix
Map every document and record to:
- Process and ISO clause
- Owner and approver
- Revision status
- Evidence and location
- Retention rule and applicability decision
Do not copy standard text or generic templates without adapting them to your scope, terminology and controls.
Common ISO 9001 Policies and Procedures to Consider
Quality policy and related policies
An effective quality policy commits to meeting customer and applicable requirements, sets the frame for quality objectives, and pledges continual improvement. Leadership must approve it, communicate it, and review it regularly. A starting point to customize (not official ISO wording):
We deliver products and services that meet customer and applicable requirements. We set measurable quality objectives, involve every employee, and continually improve our QMS.
Supporting policies (supplier quality, training, risk, document control, ethics) are optional. ISO 9001 doesn't require these titles.
Common QMS procedures
Organizations often write procedures for:
- Control of documented information
- Internal audit
- Corrective action and nonconforming outputs
- Supplier evaluation
- Customer requirement review
- Training and competence
- Monitoring and measurement
- Design and development, and production or service provision
Tailor the list. A manufacturer needs tighter controls for equipment, calibration, traceability, and release. A service firm leans toward customer requirements, delivery, competence, and feedback.
Connecting policy, procedure and records
For example, leadership commits to supplier quality. The supplier evaluation procedure sets criteria and roles. A work instruction explains scoring a new supplier. The scorecard in your software is the record an auditor samples.
Multi-site documentation
Multi-site organizations can share corporate policies and procedures while controlling local work instructions. Practical controls include:
- Assign site responsibilities
- Approve local differences formally
- Restrict edit access
- Ensure local documents never conflict with the organization-wide QMS
How to Create ISO 9001 Policies and Procedures That Work
Begin with scope and actual processes
Start with products or services, customers, interested parties, a process map, applicable requirements, risks and existing controls, not a blank page or generic template. Then interview the people doing the work to find real inputs, handoffs, decision points, failure risks and records.
Build a consistent structure
Include these fields in each document:
- Title, number, revision, owner and approver
- Effective date, purpose, scope and definitions
- Responsibilities, steps and acceptance criteria
- Required records, related documents and revision history
Use a flowchart, checklist, form or matrix when it communicates better than pages of narrative.
Write for use, not just for an audit
- Use plain language, active verbs and consistent terms
- Name specific roles, not "management"
- Set measurable acceptance criteria
- Separate mandatory actions from notes and examples
- Name the records each procedure produces
- Don't document steps nobody follows
Validate, approve and communicate
Process owners test the draft in real work. Affected employees confirm it's usable. Leadership approves it, and training records are completed. Then verify it works in practice:
- Observe the work and sample records
- Interview employees
- Review process measures
- Feed findings into internal audits and management review
Get support when resources are limited
Synergistic Systems helps organizations translate complex operations into modular documentation, organizational systems and training for each stage of ISO implementation. It's most useful for teams needing practical, process-specific documentation or a consistent QMS across multiple sites. Start with an implementation consultation.
Control, Implement, and Improve Your QMS Documentation
Controls to put in place
Required controls cover ISO/IAF auditing guidance topics:
- Approval and version identification
- Access, distribution and retrieval at point of use
- Change review and prevention of obsolete document use
- Protection and backup (periodically tested)
- Control of external documents
- Retention and secure disposition
Put documents into daily use
Use role-based training, an accessible repository, supervisor reinforcement and onboarding. Check periodically that people use current versions. Auditors look for understanding and relevance to the work, not memorized policy text.
Feed improvement
Audit findings, customer feedback, nonconformities, corrective actions, process results and management-review decisions all signal when a procedure or form needs revision. A 2020 DQS surveillance audit of a government office found no nonconformities, yet suggested simpler revision tracking and IDs for registers and forms. That's improvement, not failure.
Retention periods
ISO 9001 sets no universal retention period. Base yours on applicable law, customer contracts, product or service life, risk and certification-audit needs. For example, FAR 52.246-2 ties inspection record retention to the contract term on applicable fixed-price supply contracts.
Frequently Asked Questions
Can you give me an example of a policy?
"We meet customer and applicable requirements, set measurable objectives, involve all employees, and continually improve our QMS." Customize it; this isn't official ISO text.
What is the difference between a policy and a procedure?
A policy states leadership direction and commitments. A procedure explains the controlled method: responsibilities, steps, criteria and records.
What are the different types of policies?
The quality policy is required. Supplier, training, risk, document-control or customer-focused policies are optional. ISO 9001 prescribes no universal set of names.
Does ISO 9001 require written procedures?
It requires applicable documented information and evidence of effective processes, not a procedure for every activity. Decide based on QMS needs.
Does ISO 9001 require a quality manual?
Not under the 2015 edition; it's an optional tool for explaining QMS structure, scope and document relationships. Verify the current edition's wording.
