ISO Clause 4: Context of the Organization Explained

ISO Clause 4: Context of the Organization Explained — this guide is part of our series on the ISO harmonized structure, the shared clause framework behind most ISO management system standards.

Most ISO management system standards share the same skeleton. It is set out in Annex SL, Appendix 2 of the ISO/IEC Directives Part 1 — the harmonized structure — and it gives every adopting standard the same ten clauses, the same core text and the same defined terms. Learn clause 4 once and you have learned it for ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22301, ISO 42001 and the rest.

What ISO clause 4 actually asks for

Clause 4 is the foundation the rest of the management system stands on. It asks four questions:
what is going on around you, who cares about it, what are you putting inside the system, and how do
the parts fit together. Auditors start here because everything downstream — risks, objectives,
controls — has to trace back to it.

4.1 Understanding the organization and its context

You must determine the external and internal issues relevant to your purpose that affect your
ability to achieve the intended outcomes of the management system. External issues are things like
regulation, market conditions, supply chain and technology change. Internal issues cover culture,
capability, resourcing and existing systems.

The February 2024 climate amendment applies here. On 22 February 2024 ISO and the
IAF issued a joint amendment adding climate change to 31 harmonized structure standards. Clause 4.1
now carries the requirement that the organization shall determine whether climate change is a
relevant issue. This is not optional and it is not satisfied by silence — you need a
recorded determination either way. Certification bodies have been raising findings against it since
2024, and it is the single most common gap on otherwise mature systems.

4.2 Understanding the needs and expectations of interested parties

Identify the parties relevant to the management system, determine their relevant requirements, and
decide which of those requirements you will address through the system. Interested parties typically
include customers, employees, regulators, shareholders, suppliers and neighbours.

The 2024 amendment adds a note here too: relevant interested parties can have requirements
related to climate change. A note is guidance rather than a requirement, but it signals what
auditors will look for.

4.3 Determining the scope

The scope defines the boundaries and applicability of the system. It must consider the issues from
4.1, the requirements from 4.2, and the products and services involved. It must be available as
documented information.

Scope is where certification goes wrong most expensively. A scope that is too broad commits you to
auditing things you did not intend to; one that is too narrow gets challenged at stage 1 or produces a
certificate that customers will not accept. Write it so a reader can tell exactly which sites, legal
entities, activities and technologies are in and which are out.

4.4 The management system and its processes

Establish, implement, maintain and continually improve the system, including the processes needed
and their interactions. In practice this is the process map or interaction diagram plus the
determination of inputs, outputs, sequence, criteria, resources, responsibilities and risks for each
process.

Documented information ISO clause 4 expects

• A context or issues log, showing external and internal issues and a climate change determination
• An interested parties register with their relevant requirements
• A documented scope statement — explicitly required by 4.3
• A process map or list of processes with their interactions

Common audit findings against ISO clause 4

• No climate change determination. The most frequent 2024–2026 finding. Add an
  explicit line to the issues log recording whether climate change is relevant and why.
• Context recorded once and never revisited. Clause 9.3 requires changes in external
  and internal issues as a management review input, so a context log with a single date on it is a
  finding waiting to happen.
• Scope that lists departments instead of boundaries. Name locations, legal entities
  and activities, and state exclusions with justification.
• Interested parties identified but no requirements captured. Naming a regulator is
  not the same as recording what it requires of you.

Which standards ISO clause 4 applies to

The harmonized structure covers the great majority of ISO management system standards, including ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22301, ISO 20000-1, ISO 22000, ISO 42001, ISO 37301, ISO 50001, ISO 55001, ISO 41001, ISO 21001, ISO 28000 and ISO 39001. Adopting standards may add sub-clauses of their own, but they do not renumber the ten top-level clauses.

Two exceptions worth knowing. ISO 13485:2016 deliberately did not adopt the harmonized structure — its technical committee kept the older clause 4 to 8 layout to stay closer to medical device regulation, so the clause numbers on this page do not map to it. ISO/IEC 17025 and ISO 15189 are conformity assessment standards for laboratories rather than management system standards in the Annex SL sense, and they use their own structure.

Toolkits that implement ISO clause 4

Each of these standards uses the harmonized structure, so clause 4 applies to all of them. The toolkit for each ships the documented information the clause requires.

ISO 9001 · ISO 14001 · ISO 45001 · ISO 27001 · ISO 22301 · ISO 42001 · ISO 20000 · ISO 22000 · ISO 27701 · ISO 37301 · ISO 50001 · ISO 55001 · ISO 41001 · ISO 21001 · ISO 28000 · ISO 39001

ISO clause 4: frequently asked questions

Is clause 4 the same in every ISO standard?

The four sub-clauses and their core text are shared across harmonized structure standards. Adopting standards add specialisations — ISO 14001 layers environmental aspects onto the same frame — but 4.1 to 4.4 mean the same thing everywhere.

Do we have to document climate change under clause 4?

You must determine whether climate change is a relevant issue, and a determination you cannot show is a determination an auditor cannot accept. Record the conclusion and the reasoning in your issues log, whichever way it goes.

References for ISO clause 4

• ISO/IEC Directives and Policies — where Annex SL and the harmonized structure are published.
• ISO management system standards — the full list of standards that adopt this structure.

Beyond ISO clause 4: the rest of the series

Clauses 4 to 10 are the harmonized structure shared by most ISO management system standards. Each guide in this series covers one clause across every standard that uses it.

• Clause 4: Context of the Organization — you are here
• Clause 5: Leadership
• Clause 6: Planning
• Clause 7: Support
• Clause 8: Operation
• Clause 9: Performance Evaluation
• Clause 10: Improvement