ISO Clause 7: Support Explained

ISO Clause 7: Support Explained — this guide is part of our series on the ISO harmonized structure, the shared clause framework behind most ISO management system standards.

Most ISO management system standards share the same skeleton. It is set out in Annex SL, Appendix 2 of the ISO/IEC Directives Part 1 — the harmonized structure — and it gives every adopting standard the same ten clauses, the same core text and the same defined terms. Learn clause 7 once and you have learned it for ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22301, ISO 42001 and the rest.

What ISO clause 7 actually asks for

Clause 7 is the support layer: the people, infrastructure, knowledge, communication and documents
that let the system function. It contains the single most-cited sub-clause in all of ISO auditing,
7.5 documented information.

7.1 Resources

Determine and provide the resources needed to establish, implement, maintain and continually improve
the system. Adopting standards expand this: ISO 9001 breaks it into people, infrastructure, environment
for the operation of processes, monitoring and measuring resources, and organizational knowledge.

7.2 Competence

Determine the necessary competence of people doing work under your control that affects performance,
ensure they are competent on the basis of education, training or experience, take actions to acquire
competence where needed, and retain documented information as evidence.

7.3 Awareness

People doing work under your control must be aware of the policy, their contribution to
effectiveness including the benefits of improved performance, and the implications of not conforming.

Awareness is not training. This is one of the most misunderstood distinctions in the
standard. Competence under 7.2 is about being able to do the job. Awareness under 7.3 is about
understanding why the system exists and what your part in it is. A contractor may need awareness
without needing competence in your processes. Auditors test awareness by asking people on the floor,
not by inspecting a training matrix.

7.4 Communication

Determine the internal and external communications relevant to the system, including on what, when,
with whom, how, and who communicates. ISO 45001 goes further and requires consultation and
participation of workers, which is a genuinely heavier obligation than in the other standards.

7.5 Documented information

Three parts. 7.5.1 General: the system must include documented information required
by the standard plus that which you determine is necessary. 7.5.2 Creating and updating:
appropriate identification, format and review for suitability and adequacy. 7.5.3 Control:
it must be available and suitable where needed, and adequately protected, with control over
distribution, access, retrieval, storage, version control, retention and disposition.

Note the deliberate absence of the words “procedure”, “manual” and “record” from the harmonized
structure. There is no requirement for a quality manual, and no mandatory list of six procedures.
Anything that must exist is signalled by the phrase “documented information” in a specific clause.

Documented information ISO clause 7 expects

• A competence matrix and training or qualification records
• Evidence of awareness activity — inductions, briefings, campaigns
• A communication plan covering the five elements: what, when, with whom, how, who
• A documented information or document control procedure covering creation, review, approval,
  version control, access and retention

Common audit findings against ISO clause 7

• Awareness treated as a training record. Staff cannot state the policy or why the
  system matters, even though the matrix is complete.
• Uncontrolled documents in circulation. Superseded versions on shared drives,
  undated printouts on walls.
• No external communication defined. Clause 7.4 covers external as well as internal.
• Competence assumed from job title rather than evidenced by education, training or
  experience.

Which standards ISO clause 7 applies to

The harmonized structure covers the great majority of ISO management system standards, including ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22301, ISO 20000-1, ISO 22000, ISO 42001, ISO 37301, ISO 50001, ISO 55001, ISO 41001, ISO 21001, ISO 28000 and ISO 39001. Adopting standards may add sub-clauses of their own, but they do not renumber the ten top-level clauses.

Two exceptions worth knowing. ISO 13485:2016 deliberately did not adopt the harmonized structure — its technical committee kept the older clause 4 to 8 layout to stay closer to medical device regulation, so the clause numbers on this page do not map to it. ISO/IEC 17025 and ISO 15189 are conformity assessment standards for laboratories rather than management system standards in the Annex SL sense, and they use their own structure.

Toolkits that implement ISO clause 7

Each of these standards uses the harmonized structure, so clause 7 applies to all of them. The toolkit for each ships the documented information the clause requires.

ISO 9001 · ISO 14001 · ISO 45001 · ISO 27001 · ISO 22301 · ISO 42001 · ISO 20000 · ISO 22000 · ISO 27701 · ISO 37301 · ISO 50001 · ISO 55001 · ISO 41001 · ISO 21001 · ISO 28000 · ISO 39001

ISO clause 7: frequently asked questions

What is the difference between competence and awareness?

Competence is the ability to do the job, evidenced by education, training or experience. Awareness is understanding the policy, your contribution and the consequences of nonconformity. A visitor or contractor may need awareness without competence.

Do we need a quality manual?

No. The harmonized structure has no requirement for a manual and no fixed list of mandatory procedures. You need the documented information the standard names, plus whatever you determine is necessary for effectiveness.

References for ISO clause 7

• ISO/IEC Directives and Policies — where Annex SL and the harmonized structure are published.
• ISO management system standards — the full list of standards that adopt this structure.

Beyond ISO clause 7: the rest of the series

Clauses 4 to 10 are the harmonized structure shared by most ISO management system standards. Each guide in this series covers one clause across every standard that uses it.

• Clause 4: Context of the Organization
• Clause 5: Leadership
• Clause 6: Planning
• Clause 7: Support — you are here
• Clause 8: Operation
• Clause 9: Performance Evaluation
• Clause 10: Improvement