Organizational Context, Interested Parties and QMS Scope

Introduction

ISO 9001 requires an organization to understand the context in which it operates before designing, implementing and improving its quality management system (QMS). This requirement is strategically important: a QMS is not a collection of procedures detached from business reality, but a management system shaped by the organization’s purpose, risks, obligations, stakeholders and operational processes.

Clauses 4.1–4.4 of ISO 9001:2015 address four connected questions:

1. What internal and external conditions affect the organization’s ability to achieve intended results?
2. Which interested parties are relevant, and what requirements do they impose?
3. What boundaries and applicability should define the QMS?
4. Which processes are required, and how do they interact?

The 2024 amendment concerning climate change adds an explicit expectation that organizations determine whether climate change is a relevant issue and recognize that interested parties may have climate-related requirements. This does not create a universal obligation to implement a climate programme; it requires a considered, evidence-based determination.

Learning Objectives

By the end of this chapter, the learner should be able to:

• analyse internal and external issues affecting a QMS;
• identify relevant interested parties and their needs and expectations;
• evaluate climate-change relevance and related obligations;
• establish a clear and defensible QMS scope;
• distinguish genuine non-applicability from unjustified exclusion;
• identify, sequence and evaluate QMS processes; and
• use documented evidence to defend QMS boundaries during audit or management review.

1. The Context-Based Logic of ISO 9001

The context clauses establish the foundation for risk-based thinking. They connect organizational strategy with customer requirements, statutory obligations, operational control and continual improvement. The logic can be represented as:

Figure: The logical relationship among context, interested parties, QMS scope and processes.

Context analysis should not become a static list prepared only for certification. It should support decisions about markets, resources, suppliers, technology, competence, compliance and improvement. The depth of analysis should be proportionate to organizational complexity and risk.

2. Internal and External Issues

2.1 External issues

External issues arise outside the organization but may affect its strategic direction or ability to provide conforming products and services. Relevant categories include:

A useful method is a PESTLE analysis, but the method itself is not mandatory. The important question is whether the organization has identified issues that can affect intended QMS results and has considered them in planning.

2.2 Internal issues

Internal issues include governance, culture, structure, resources and capabilities. Examples include:

• organizational purpose, values and strategic priorities;
• ownership and accountability for quality;
• competence, staffing and workforce turnover;
• process maturity and organizational knowledge;
• equipment, infrastructure and maintenance capability;
• information systems and data integrity;
• financial capacity and investment priorities;
• quality culture, communication and leadership behaviour; and
• performance history, recurring nonconformities and improvement capability.

Internal analysis should be evidence-based. For example, a statement such as “competence is adequate” is weak unless supported by training records, authorization criteria, performance data or capability assessments.

2.3 Monitoring and review

ISO 9001 does not prescribe a fixed review frequency or a particular document called a “context register.” Organizations may use strategic reviews, risk registers, management-review inputs, market reviews, regulatory scanning or operational meetings. The evidence should demonstrate that relevant issues are monitored and reviewed rather than merely recorded once.

A context issue is significant when it can influence the QMS’s ability to achieve intended results, such as conforming outputs, customer satisfaction, legal compliance and continual improvement. Not every political, economic or technological fact belongs in the QMS context.

3. Interested Parties and Their Requirements

An interested party is a person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity. Customers are central, but they are not the only relevant parties.

Typical interested parties include:

• customers and end users;
• employees and contractors;
• owners, investors and governing bodies;
• regulators and certification bodies;
• suppliers and outsourced process providers;
• logistics providers and distributors;
• local communities;
• insurers and lenders; and
• strategic partners.

The organization must determine which interested parties are relevant to the QMS and which requirements of those parties are relevant. Relevance should be evaluated, not assumed. A local authority may be relevant because it issues an operating permit; a social-media commentator may not impose a QMS requirement, although reputation concerns may still be considered as an external issue.

A practical interested-party matrix is shown below.

The distinction between a need and a requirement is important. A customer may need reliable delivery; a signed contract may convert that need into a measurable requirement. A statutory requirement is binding regardless of whether it appears in a customer contract. Voluntary commitments may become applicable when adopted as policy, included in a contract or otherwise treated by the organization as an obligation.

4. Climate-Change Considerations

The 2024 ISO 9001 amendment requires organizations to determine whether climate change is a relevant issue. It also clarifies that relevant interested parties can have climate-change-related requirements. The amendment should be integrated into context and interested-party analysis, not treated as an isolated environmental clause.

Climate change may affect quality through:

• extreme heat affecting equipment, materials or worker capability;
• flooding, storms or wildfire disrupting sites and suppliers;
• water scarcity affecting production or cleaning;
• changing material properties and storage conditions;
• energy reliability and infrastructure constraints;
• customer requirements for low-carbon products or supply chains; and
• legal requirements concerning emissions, reporting or climate disclosure.

The organization should ask two separate questions:

1. Is climate change relevant to the organization’s ability to achieve intended QMS results?
2. Do relevant interested parties have climate-related requirements?

A “not relevant” conclusion can be defensible only when supported by reasoning and evidence. For example, a small office-based consultancy in a stable leased facility may determine that climate change creates no immediate product-conformity risk, while still identifying client reporting requirements as relevant. Conversely, a food manufacturer exposed to heat and water disruption should consider climate-related risks in infrastructure, suppliers, storage and continuity planning.

Climate considerations should not be exaggerated. ISO 9001 does not automatically require carbon accounting, net-zero targets or environmental certification. Such measures may arise from law, customer contracts, strategy or other standards, but they should not be claimed as universal ISO 9001 requirements.

5. Determining the QMS Scope

The QMS scope defines the organizational units, locations, products, services and processes covered by the system. It is a boundary statement, not a marketing slogan. ISO 9001 requires the organization to consider:

• the external and internal issues identified in context analysis;
• the requirements of relevant interested parties; and
• the products and services provided by the organization.

The scope must be available as documented information. A defensible scope normally identifies the entity or sites covered, the principal products or services, and any justified non-applicability.

5.1 Scope boundaries

Boundaries may be defined by:

• legal entity or business unit;
• geographical location;
• product family or service line;
• operational process;
• customer segment; or
• temporary project or facility.

The boundary must not mislead interested parties. For example, an organization should not claim certification for “engineering and manufacturing” if the QMS covers only engineering design and manufacturing is performed by an uncontrolled external provider outside the defined system.

5.2 Applicability and non-applicability

ISO 9001:2015 no longer uses the former concept of permitted “exclusions” in the same way as earlier editions. Requirements are applicable when they can affect the organization’s ability or responsibility to ensure conformity of products and services and customer satisfaction. A requirement may be considered non-applicable only when its exclusion does not impair that ability or responsibility.

A defensible non-applicability statement should answer:

1. What requirement is considered non-applicable?
2. What activity or product characteristic makes it non-applicable?
3. Why would excluding it not affect conformity or customer satisfaction?
4. What objective evidence supports the conclusion?

For example, a distributor that neither designs nor modifies products may determine that design and development requirements are non-applicable. However, if it customizes products, specifies technical changes or develops customer-specific solutions, design controls may become applicable.

Outsourcing does not automatically make a requirement non-applicable. If an organization outsources manufacturing, it remains responsible for controlling the outsourced process and ensuring that purchased outputs conform to requirements.

5.3 Weak and strong scope statements

Weak statement: “The QMS covers quality activities.”

This is unclear because it does not identify products, services, locations or boundaries.

Stronger statement: “Provision of calibration, repair and field-maintenance services for industrial measurement equipment from the Central Service Centre, including contract review, service planning, purchasing, technical execution, inspection, release and customer support. Design and development is non-applicable because the organization performs no design activity and provides services strictly to customer-approved technical specifications.”

The stronger statement is still subject to verification. If the organization develops repair methods that alter equipment performance or designs modified instruments, the non-applicability decision must be reconsidered.

6. Processes and Their Interaction

The organization must determine the processes needed for the QMS and their application throughout the organization. For each process, it should determine, as appropriate:

• inputs and expected outputs;
• sequence and interaction;
• criteria and methods, including monitoring and measurement;
• resources and responsibilities;
• risks and opportunities;
• evaluation methods; and
• improvement opportunities.

A process is a set of interrelated activities that transforms inputs into outputs. A process approach differs from a department-based description. “Sales,” “purchasing” and “production” are organizational functions; the QMS should also describe how customer requirements flow through contract review, planning, procurement, realization, verification, release and feedback.

A process map may include:

• leadership and strategic processes;
• customer and contract processes;
• design and development, where applicable;
• purchasing and supplier control;
• production or service provision;
• inspection, testing and release;
• customer feedback and complaint handling;
• support processes such as competence, maintenance and information control; and
• evaluation and improvement processes.

Process ownership should be explicit. A process owner is accountable for process performance, interfaces and improvement; this does not mean the owner personally performs every activity.

Useful performance indicators may include on-time delivery, first-pass yield, complaint rate, supplier conformity, response time and corrective-action effectiveness. Indicators should be linked to process objectives and interpreted with context. A lower complaint rate may reflect improved quality—or declining sales.

7. Worked Application: NorthStar Medical Devices

Background

NorthStar Medical Devices is an illustrative case. It assembles non-invasive patient-monitoring accessories at one site, purchases electronic components from external suppliers and sells through hospitals and distributors. It has recently expanded into a second product family involving customer-specific cable configurations.

Problem

NorthStar’s initial proposed scope was: “Manufacture of patient-monitoring devices.” An internal review found that the company does not manufacture complete devices; it assembles accessories, performs configuration, purchases critical components and provides technical support. The proposed scope also excluded design and development, although engineers create customer-specific configurations.

Analysis

External issues included medical-device regulations, supply shortages, cybersecurity expectations for connected products and extreme-heat events affecting the site. Internal issues included rapid growth, inexperienced production staff, dependence on one electronic-component supplier and weak configuration control.

Relevant interested parties were hospitals, distributors, regulators, patients as end users, component suppliers, employees and the certification body. Requirements included product specifications, traceability, regulatory controls, delivery reliability, competence and climate-related continuity expectations from a major hospital group.

The design exclusion was not defensible. Although NorthStar did not design the complete medical device, it designed customer-specific cable configurations and therefore controlled design inputs, outputs, verification, validation and changes for that activity.

Approach and solution

NorthStar revised its scope to:

“Design and assembly of cable and sensor accessories for patient-monitoring applications, including configuration, purchasing, inspection, release and technical support at the Central Facility.”

It established process ownership and mapped customer requirements through design, purchasing, assembly, inspection, release and feedback. It added controls for supplier continuity, component traceability, configuration changes and heat-related facility disruption. The context review recorded climate change as relevant because heat could affect storage conditions and continuity, while a hospital customer had explicit supply-chain resilience expectations.

Outcome

The revised scope accurately reflected actual activities. The organization avoided a misleading exclusion, improved supplier controls and connected climate considerations to concrete operational risks. During an external audit, NorthStar was able to show the reasoning behind its scope, applicability decisions and process interactions.

Learning points

1. Scope statements must describe actual value-creating activities, not desired market identity.
2. Outsourcing transfers execution, not ultimate QMS responsibility.
3. A design activity can exist within a limited product configuration process.
4. Climate relevance should be assessed through operational and stakeholder evidence.
5. A defensible conclusion is supported by records, not merely confident wording.

8. Governance, Evidence and Common Failure Modes

Common weaknesses include copying a generic scope from another organization, listing every possible interested party without evaluating relevance, treating a context analysis as a one-time SWOT exercise, and excluding activities simply because another organization performs them.

Governance controls should ensure that:

• scope changes are approved by accountable leadership;
• legal and contractual obligations are identified and reviewed;
• process owners understand interfaces and responsibilities;
• records supporting applicability decisions are retained;
• climate-related assumptions are periodically revisited; and
• internal audits test whether actual practice matches the stated scope.

Ethically, scope definition must not be used to conceal poor performance or evade regulatory responsibility. A narrow scope may be legitimate when it reflects a genuine business boundary, but it becomes misleading when critical activities affecting conformity are omitted. Certification marks and public statements should correspond precisely to the certified scope.

Technology can support this work through integrated risk registers, supplier platforms, process-mining tools, contract analytics and AI-assisted document review. However, automated tools cannot determine relevance reliably without organizational judgment. AI-generated stakeholder lists may omit informal power relationships, misunderstand legal obligations or reproduce unsupported assumptions. Human review, traceability and controlled information sources remain necessary.

Chapter Summary

Organizational context provides the strategic and operational foundation for an effective QMS. Organizations should identify relevant internal and external issues, evaluate interested parties and determine the requirements that affect conformity, customer satisfaction and intended QMS results. Climate change must be considered explicitly as a possible relevant issue, and climate-related requirements of interested parties must be recognized where applicable.

The QMS scope should identify meaningful boundaries, products, services, sites and activities. Non-applicability must be justified through evidence and must not impair the organization’s ability or responsibility to provide conforming outputs. Outsourced work remains subject to organizational control. Finally, the process approach converts the scope into an operating system by defining inputs, outputs, interactions, criteria, resources, ownership, risks and performance evaluation.

Key Terms

Context of the organization: Internal and external conditions that affect organizational purpose and QMS results.

External issue: A condition outside the organization that may influence its performance or direction.

Internal issue: A condition within the organization that may influence its performance or direction.

Interested party: A person or organization that can affect, be affected by, or perceive itself affected by a decision or activity.

Relevant interested party: An interested party whose needs or requirements affect the QMS.

Requirement: A need or expectation that is stated, generally implied, mandatory or adopted by the organization.

Climate-change relevance: The determination of whether climate change can affect intended QMS results or stakeholder requirements.

QMS scope: The documented boundaries and applicability of the quality management system.

Applicability: The determination of whether an ISO 9001 requirement applies to the organization’s activities.

Non-applicability: A justified conclusion that a requirement does not apply without impairing conformity or customer satisfaction.

Process: Interrelated activities that transform inputs into outputs.

Process owner: A person accountable for process performance, interfaces and improvement.

Process interaction: The way outputs from one process become inputs or requirements for another.

Outsourced process: A process performed by an external provider on behalf of the organization.

Documented information: Information required to be controlled and maintained by the QMS.

Objective evidence: Verifiable information supporting a conclusion or decision.

Contract review: Evaluation of requirements before committing to provide products or services.

Traceability: Ability to follow the history, application or location of an output.

Risk-based thinking: Consideration of uncertainty and its effects when planning and controlling work.

Review Questions

Short Answer Questions

1. What is the purpose of analysing organizational context before establishing a QMS?
2. Identify four categories of external issues that may affect a QMS.
3. How does an interested party differ from a relevant interested party?
4. What two climate-related questions should an organization ask under the amended context requirements?
5. Why does outsourcing not automatically make an ISO 9001 requirement non-applicable?

Long Answer Questions

1. Explain how internal and external issues should be identified, evaluated and reviewed in a mature QMS.
2. Discuss the criteria for developing a defensible QMS scope, using examples of misleading and accurate scope statements.
3. Explain the relationship among interested-party requirements, statutory obligations and customer requirements.
4. Describe how the process approach supports control of interactions, performance and improvement.
5. Critically evaluate the use of non-applicability decisions under ISO 9001:2015.

Analytical / Application Questions

1. A software company claims that design and development is non-applicable because it delivers cloud services. Analyse whether this conclusion is defensible if it develops customer-specific functionality.
2. A food manufacturer experiences heat-related refrigeration failures and a major customer requires climate-resilient supply. Identify relevant issues, interested parties, QMS processes and evidence that should be considered.
3. Construct a QMS scope for a university laboratory that performs testing, outsources calibration and provides expert reports. Identify one requirement that might be non-applicable and justify your conclusion.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the purpose of organizational context analysis?

A. To replace internal auditing

B. To identify conditions that may affect intended QMS results

C. To list every political event in the country

D. To define employee salaries

Correct Answer: B. To identify conditions that may affect intended QMS results

Question 2

Which party is most clearly an interested party relevant to a regulated manufacturing QMS?

A. A regulator issuing an operating licence

B. An unrelated tourist

C. A competitor with no contractual relationship

D. A historical organization with no current connection

Correct Answer: A. A regulator issuing an operating licence

Question 3

Under the climate-related amendment, an organization must first determine whether climate change is:

A. A mandatory cause of carbon neutrality

B. Relevant to its QMS context

C. Proof that ISO 14001 is required

D. A reason to exclude production controls

Correct Answer: B. Relevant to its QMS context

Question 4

Which is the strongest QMS scope statement?

A. All quality activities

B. Everything the company does

C. Design and assembly of specified accessories at the identified facility

D. Customer satisfaction management

Correct Answer: C. Design and assembly of specified accessories at the identified facility

Question 5

When may a requirement be considered non-applicable?

A. Whenever it is inconvenient to implement

B. Whenever another organization performs the activity

C. When exclusion does not impair conformity or customer satisfaction

D. Whenever an auditor has not asked about it

Correct Answer: C. When exclusion does not impair conformity or customer satisfaction

Question 6

A process is best defined as:

A. A department’s organization chart

B. Interrelated activities transforming inputs into outputs

C. A list of employee qualifications

D. A certification certificate

Correct Answer: B. Interrelated activities transforming inputs into outputs

Question 7

Which statement about outsourced processes is correct?

A. They are outside all QMS responsibility

B. They need no supplier controls

C. The organization remains responsible for their control and conformity

D. They automatically make design non-applicable

Correct Answer: C. The organization remains responsible for their control and conformity

Question 8

Which evidence best supports a decision that design and development is non-applicable?

A. A verbal assurance from a salesperson

B. Evidence that the organization performs no design or modification activity

C. A low complaint rate alone

D. A generic industry checklist

Correct Answer: B. Evidence that the organization performs no design or modification activity

Question 9

Which issue is an internal issue?

A. A new national regulation

B. A competitor’s product launch

C. High workforce turnover and weak competence controls

D. A regional flood outside the organization

Correct Answer: C. High workforce turnover and weak competence controls

Question 10

Why should a QMS scope be periodically reviewed?

A. Because scope never reflects actual operations permanently

B. Because ISO 9001 requires a new certificate every month

C. To eliminate all interested parties

D. To avoid monitoring processes

Correct Answer: A. Because scope never reflects actual operations permanently