Why you need to define roles and assign responsibility and authority for your ISO Management System (MS)

Clause 5.3 Organizational roles, responsibilities, and authorities of the ISO 9001:2015 Quality Management standard requires you to ensure that the responsibilities and authorities for relevant roles are assigned, communicated, and understood. 

The ISO standard requires that top management assigns responsibility and authority for:

1. Ensuring that the MS conforms to the requirements of ISO 
2. Ensuring that the processes are delivering their intended outputs
3. Reporting on the performance of the MS and on opportunities for

Improvement 

1. Ensuring the promotion of customer focus throughout the organisation
2. Ensuring that the integrity of the MS is maintained when changes are planned and implemented.
   

Title 

The Title column includes a list of the most common organisational roles an auditor would expect to see in your MS including; 

• Managing Director/CEO
• Quality, Environmental, H&S or Information Security Manager
• HR Manager
• Leadership Team
• Office Manager
• All staff
• IT Manager
• Information Security Manager
• Head of Facilities and OHS

‍

Responsibility and Authority 

This column describes the responsibilities related to the role and, when applicable, the authorities. 

For example, the Quality Manager role could include:

• ​​Ensuring that the MS fulfils the requirements of ISO.
• Monitoring the performance of the MS and reporting to top management.
• ​​Promoting a customer focus​ 
  

‍

Competence Requirements

This column describes the competence requirements for the role in terms of education, experience and training.

For example, the Quality, Environmental, H&S or Information Security Manager role could include:

• Appropriate education 
• Appropriate training and qualifications
• Experience – 1 Year 

‍

Internal Communications

List the internal interested parties that the role has the authority to communicate to. 

For example, the Quality, Environmental, H&S or Information Security Manager's internal responsibility could include:

• Staff understand the Quality, Environmental, H&S or Information Security Policy  
• Staff are aware of relevant objectives 
• Top management is aware of the status of the management system
  

‍

External Communications 

List the external interested parties that the role has the authority to communicate to ensure the quality expectations are met, including:

• Suppliers understand the Standards expectations of their products and services
• Customer feedback, both positive and negative
• Certification bodies compliance with the standard

Having determined roles, responsibilities, and authorities for your ISO MS, you can now move to the next step:

Step Implementation Guides:

1: Roles & Responsibilities

2: Aims and objectives

3: Controls

4: SWOT Analysis

5: Interested Parties

6: Legal Register

7: Processes & Procedures

8: Key Performance Indicators

9: Risks & Opportunities

10: Audit Programme