The ISO 9001 Standard Structure

The Annex SL Architecture

ISO 9001:2015 was redesigned to align with the High Level Structure (HLS) — a common architectural template that ISO applied across all management system standards. Annex SL defines identical clause titles, structures, and core text for ISO 9001, ISO 27001 (Information Security Management), ISO 22301 (Business Continuity Management), ISO 20000 (IT Service Management), ISO 14001 (Environmental Management), and ISO 45001 (Occupational Health & Safety). This alignment is not merely cosmetic; it is a deliberate strategic choice by ISO to enable organizations to integrate multiple management systems into a single, unified Integrated Management System (IMS).

For Indonesian organizations seeking multiple certifications — common in manufacturing (ISO 9001 + ISO 14001), technology (ISO 9001 + ISO 27001), and large enterprises — the HLS architecture creates a significant efficiency opportunity. Rather than managing three separate quality systems with separate documentation, risk frameworks, audits, and reviews, organizations can build one system that satisfies all standards simultaneously.

 

The Ten Clauses of ISO 9001:2015

The ISO 9001 standard is organized into ten clauses. Clauses 1–3 describe the standard itself and do not contain QMS requirements. Clauses 4–10 contain the actual requirements that the Quality Management System must fulfill. Understanding the structure is essential to avoiding the common mistake of treating Clauses 1–3 as audit requirements.

Clause	Title	Type	Core Question It Answers
1	Scope	Context	What does the standard cover?
2	Normative References	Context	What other standards apply?
3	Terms and Definitions	Context	What do key terms mean?
4	Context of the Organization	Plan	Who are we, what do we do, QMS scope?
5	Leadership	Plan	How does top management lead quality?
6	Planning	Plan	How do we address risks, set objectives, plan changes?
7	Support	Plan	What resources, competence, infrastructure do we need?
8	Operation	Do	How do we control processes, products, services?
9	Performance Evaluation	Check	How do we monitor, measure, review QMS?
10	Improvement	Act	How do we address nonconformities and improve?

KEY IDEA

Clauses 1–3 are contextual — they describe the standard, not requirements. The actual QMS requirements begin at Clause 4. Many organizations waste effort trying to document conformance to Clause 1–3; there is nothing to certify against there.

 

QMS Requirements vs. Quality Management Principles

ISO 9001:2015 rests on two pillars: the normative requirements (Clauses 4–10) and the philosophical Quality Management Principles (QMPs). The requirements specify what the QMS must do. The principles specify the mindset and values that should guide how the requirements are implemented. A QMS that meets all requirements but violates the principles is technically compliant but philosophically hollow.

Understanding the principles is necessary to implement the requirements correctly. For example, Clause 8.2.3 requires confirmation of customer requirements, but the principle of Customer Focus (Principle 1) explains why: the purpose is to ensure that the organization truly understands what the customer needs, not to create a checkbox for documentation.

 

Clause 4–7: The Planning and Enabling Clauses

Clauses 4–7 form the planning phase of the PDCA (Plan-Do-Check-Act) cycle. They address the foundational conditions required before the organization begins actual quality operations.

Clause 4 (Context of the Organization) requires the organization to define what it does, what its customers need, and what scope of operations the QMS will cover. Clause 5 (Leadership) requires top management commitment and the establishment of a quality policy that aligns with organizational direction. Clause 6 (Planning) requires the organization to identify quality risks, set quality objectives, and plan how changes will be managed. Clause 7 (Support) requires the organization to ensure it has the resources, competent people, and infrastructure to deliver quality.

Until these four clauses are established, the organization cannot operate a QMS — it is still in the preparation phase. Audit findings in Clauses 4–7 typically indicate that the planning foundation is incomplete or inadequate.

 

Clause 8: The Operational Heart of the QMS

Clause 8 (Operation) is the largest and most operationally intensive clause. It encompasses everything the organization must control to ensure its products and services consistently meet customer and applicable requirements. This includes understanding customer requirements, designing and developing products, controlling production, managing suppliers, controlling nonconforming outputs, and ensuring product traceability where required.

Sub-Clause	Focus	Key Activities
8.1	Operational planning and control	Determine what must be controlled; establish controls; maintain documented information
8.2	Customer focus	Determine customer needs; communicate requirements; confirm requirements; manage changes
8.3	Design and development	Plan, control, and verify design output; ensure design meets input requirements
8.4	Control of externally provided processes, products, services	Evaluate and select suppliers; define supplier requirements; monitor supplier performance
8.5	Production and service provision	Control processes; prevent nonconforming outputs; identify products and services; preserve product integrity
8.6	Release of products and services	Verify that products meet requirements before delivery to customer
8.7	Control of nonconforming outputs	Manage defects; determine disposition; control rework; manage refunds

 

Clauses 9–10: Evaluation and Improvement

Clauses 9–10 form the Check-Act phase of the PDCA cycle. They address how the organization verifies that the QMS is functioning correctly and how it improves when it is not.

Clause 9 (Performance Evaluation) requires monitoring and measurement of QMS performance through KPIs, internal audits, and management reviews. Clause 10 (Improvement) requires the organization to address nonconformities (deviations from requirements), conduct corrective action investigations to eliminate root causes, and pursue continual improvement of the QMS itself.

IMPORTANT

The High Level Structure is not just a formatting convenience. It is a deliberate architectural decision by ISO that makes it possible to build a single Integrated Management System satisfying ISO 9001, ISO 27001, ISO 22301, and ISO 20000 with one context analysis, one risk framework, one internal audit program, and one management review. This is the single biggest efficiency opportunity for Indonesian organizations pursuing multiple certifications.

 

Integration with Other Annex SL Standards

Because ISO 9001, ISO 27001, ISO 22301, ISO 20000, ISO 14001, and ISO 45001 share the Annex SL High Level Structure, they align on clause structure and many foundational concepts. This alignment creates an integration opportunity that is highly relevant to Indonesian organizations in various sectors.

HLS Clause	ISO 9001 Focus	ISO 27001 Focus	ISO 22301 Focus	ISO 20000 Focus
4	QMS context and scope	ISMS context and scope	BCMS context and scope	SMS context and scope
5	Quality policy and leadership	Information security policy	BC policy	Service management policy
6	Quality risks and objectives	InfoSec risks and objectives	BC risks and objectives	Service risks and objectives
7	QMS resources and competence	ISMS resources and competence	BCMS resources and competence	SMS resources and competence
8	Production and service provision	Security controls operation	BC plans and exercises	Service delivery and control
9	QMS monitoring and audit	ISMS monitoring and audit	BCMS monitoring and audit	SMS monitoring and audit
10	Quality improvement	Security improvement	BC improvement	Service improvement

BITLION INSIGHT

Understanding the clause structure before implementation begins prevents the common mistake of treating ISO 9001 as a documentation exercise. Clause 8 requires operational control — not just documented procedures — and auditors will test this. The plan (Clauses 4–7) only has value if it is implemented in practice (Clause 8) and verified through performance evaluation (Clause 9).