ISO Clause 9: Performance Evaluation Explained

ISO Clause 9: Performance Evaluation Explained — this guide is part of our series on the ISO harmonized structure, the shared clause framework behind most ISO management system standards.

Most ISO management system standards share the same skeleton. It is set out in Annex SL, Appendix 2 of the ISO/IEC Directives Part 1 — the harmonized structure — and it gives every adopting standard the same ten clauses, the same core text and the same defined terms. Learn clause 9 once and you have learned it for ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22301, ISO 42001 and the rest.

What ISO clause 9 actually asks for

Clause 9 is the feedback loop: measure it, audit it, review it. It is the clause certification
bodies examine hardest, because it is the evidence that the system is being run rather than merely
documented.

9.1 Monitoring, measurement, analysis and evaluation

Determine what needs to be monitored and measured, the methods to ensure valid results, when it will
be performed, and when results will be analysed and evaluated. Retain appropriate documented
information as evidence, and evaluate the performance and effectiveness of the system.

ISO 9001 adds 9.1.2 customer satisfaction and 9.1.3 analysis and evaluation. ISO 14001 and ISO 45001
add evaluation of compliance with legal and other requirements, which is a distinct obligation and
needs its own evidence.

9.2 Internal audit

Conduct internal audits at planned intervals to determine whether the system conforms to your own
requirements and to the standard, and is effectively implemented and maintained. You must plan,
establish, implement and maintain an audit programme including frequency, methods, responsibilities,
planning requirements and reporting, and the programme must take into consideration the
importance of the processes concerned and the results of previous audits.

That last phrase is the one that gets missed. A programme that audits every process once a year on a
fixed rota is not risk-based, and an auditor will say so. Weight the programme toward what matters and
toward what went wrong last time. Auditors must also be objective and impartial — not auditing
their own work.

9.3 Management review

Top management must review the system at planned intervals. The standard lists mandatory inputs:
status of actions from previous reviews; changes in external and internal issues relevant to the
system; information on performance and effectiveness including nonconformities and corrective actions,
monitoring and measurement results, audit results and interested party satisfaction where applicable;
adequacy of resources; effectiveness of actions taken to address risks and opportunities; and
opportunities for improvement.

Outputs must include decisions related to continual improvement opportunities and any need for
changes to the system. Documented information must be retained as evidence.

Because the inputs are an explicit list, the fastest way to fail 9.3 is to hold a genuinely good
review meeting and minute it loosely. Structure the agenda to the list and the evidence writes itself.

Documented information ISO clause 9 expects

• Monitoring and measurement results — KPI reporting, dashboards
• Evaluation of compliance records, where the standard requires it
• A documented internal audit programme and individual audit plans and reports
• Management review minutes covering every mandatory input and recording decisions

Common audit findings against ISO clause 9

• Audit programme not risk-based. Fixed annual rota with no reference to process
  importance or previous results.
• Management review missing mandatory inputs. Most often resource adequacy,
  effectiveness of risk actions, or changes in issues.
• Auditors auditing their own work, breaching the impartiality requirement.
• Measurement without evaluation. Data collected and reported but never analysed
  against objectives.
• Review held but decisions not recorded, so outputs cannot be evidenced.

Which standards ISO clause 9 applies to

The harmonized structure covers the great majority of ISO management system standards, including ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22301, ISO 20000-1, ISO 22000, ISO 42001, ISO 37301, ISO 50001, ISO 55001, ISO 41001, ISO 21001, ISO 28000 and ISO 39001. Adopting standards may add sub-clauses of their own, but they do not renumber the ten top-level clauses.

Two exceptions worth knowing. ISO 13485:2016 deliberately did not adopt the harmonized structure — its technical committee kept the older clause 4 to 8 layout to stay closer to medical device regulation, so the clause numbers on this page do not map to it. ISO/IEC 17025 and ISO 15189 are conformity assessment standards for laboratories rather than management system standards in the Annex SL sense, and they use their own structure.

Toolkits that implement ISO clause 9

Each of these standards uses the harmonized structure, so clause 9 applies to all of them. The toolkit for each ships the documented information the clause requires.

ISO 9001 · ISO 14001 · ISO 45001 · ISO 27001 · ISO 22301 · ISO 42001 · ISO 20000 · ISO 22000 · ISO 27701 · ISO 37301 · ISO 50001 · ISO 55001 · ISO 41001 · ISO 21001 · ISO 28000 · ISO 39001

ISO clause 9: frequently asked questions

How often must internal audits be done?

At planned intervals. The standard sets no fixed frequency, but the programme must reflect the importance of the processes and the results of previous audits, so higher-risk areas should be audited more often than annually.

Can our internal auditor audit their own department?

No. The audit process must be objective and impartial, which rules out auditing your own work.

References for ISO clause 9

• ISO/IEC Directives and Policies — where Annex SL and the harmonized structure are published.
• ISO management system standards — the full list of standards that adopt this structure.

Beyond ISO clause 9: the rest of the series

Clauses 4 to 10 are the harmonized structure shared by most ISO management system standards. Each guide in this series covers one clause across every standard that uses it.

• Clause 4: Context of the Organization
• Clause 5: Leadership
• Clause 6: Planning
• Clause 7: Support
• Clause 8: Operation
• Clause 9: Performance Evaluation — you are here
• Clause 10: Improvement