Before a company describes its processes or sets its objectives, it must know the environment in which it operates and who expects something from it. That is exactly what the context of the organisation means: the first substantive block of ISO 9001 (clauses 4.1 to 4.3). For an SME it is less paperwork than thinking work for the management. This guide explains in substance what the standard wants here, how to record issues, interested parties and scope, and what auditors look for. The text of the standard is not reproduced.
On the state of the standard: on 16 September 2026 ISO 9001:2026 (6th edition) was published. ISO and the standards committee ISO/TC 176 cite clearer wording, more weight on leadership and quality culture, and a separate treatment of risks and opportunities. The clause numbers in this text follow the 2015 edition (check the numbering in your edition). The clause framework in QMS | base is provisional until the licensed standard text has been professionally reviewed, and contains only numbers and our own short titles. Check numbers and requirements against the text of the standard before certification.
What the standard wants here in substance
The three clauses build on one another:
- 4.1 Understanding the environment: the executive management clarifies which developments inside and outside the company matter for its direction and can influence quality.
- 4.2 Needs of interested parties: the company determines which parties are relevant to the system and which of their requirements apply to it.
- 4.3 Scope: the company defines the boundaries and applicability of the system. The scope names the products and services that the system covers.
The paper of the ISO 9001 Auditing Practices Group (APG, an informal group of experts from ISO/TC 176 and the International Accreditation Forum IAF) on context, for the 2015 edition, describes the purpose like this: anyone who does not know their environment cannot plan sensibly. The company should know its starting position, its aim and its strategy. Auditors check this in conversation with top management. It is convincing when it becomes visible that the results of the deliberations feed into the planning of risks and opportunities. The APG paper also states that clause 4.1 of the 2015 edition does not require documented information, but that it is generally useful to record the deliberations. Whether this still applies unchanged to the 2026 edition, check in your copy of the standard. Note that the APG paper is expressly not endorsed by ISO or IAF and serves as orientation.
Recording internal and external issues
Issues are developments and conditions that can influence your quality. External ones are, for example, the market situation, customer requirements, regulations, technology or climate; internal ones are, for instance, personnel and skilled labour, knowledge, culture, organisation or infrastructure. As aids that you already have, the APG mentions: business plan, strategy review, competitor analysis, industry reports, SWOT analysis, meeting minutes and task lists.
Practice, not normative: for an SME, five to ten issues that really occupy you are usually enough. For each issue, record
- whether it is internal or external,
- whether it means an opportunity, a risk or both for the company,
- how important it is (for example low, medium, high),
- when you will next look at it.
The review date is a practical recommendation. We cannot substantiate a rhythm for reviewing from the sources we have read.
Interested parties and their expectations
Interested parties are everyone who expects something from the company or is affected by its decisions: customers, employees, suppliers, authorities, owners, banks, neighbours. Not every party is equally important for the quality system. The APG names three questions that auditors also use as a guide: which parties have you considered? By what criteria do you select the relevant ones? Which of their requirements are relevant to the system? The answers should be recognisable as inputs to risk and opportunity planning and be reviewed, for example, in the management review.
A simple table is enough:
| Party | Expectation | How we monitor it | Relevance |
|---|---|---|---|
| Customers | Punctuality, error-free execution | Complaints, feedback | High |
| Employees | Safe workplaces, clear tasks | Employee appraisal meetings | High |
| Suppliers | Reliable orders, prompt payment | Supplier evaluation | Medium |
| Authorities | Compliance with regulations | Inspections, notifications | Medium |
Defining the scope
The APG distinguishes three terms that are often mixed up. The scope of the quality system (clause 4.3) describes where the system applies. The certification scope is derived from it: it is what the company has certified, and it can be smaller. It appears on the certificate and must be worded clearly and not in a misleading way. The audit scope, finally, is what an individual audit covers, and it does not have to cover the whole system.
According to the APG, defining the scope becomes difficult in the case of outsourced activities, several sites, services at the customer’s premises or jointly provided services. If you exclude a requirement as not applicable, record a justification; the APG requires auditors to examine such exclusions closely. The scope therefore belongs together with the issues from clause 4.1: anyone who excludes sites or activities should be able to explain why.
Quality culture and the attitude of management
For the 2026 edition, ISO places greater emphasis on leadership and quality culture. Check in your copy of the 2026 edition how this is reflected in the text of the standard. Regardless of that, a short, concrete text is worthwhile: how does the executive management set an example of quality and ethical behaviour? What happens when someone reports an error? Avoid general buzzwords; a paragraph with two or three verifiable habits says more than a long declaration of values.
Practical example: Muster Küchenbau AG
Muster Küchenbau AG is a fictitious company with 22 employees. It makes kitchens and interior fittings in a workshop in Musterhausen and runs a showroom in Beispielstadt. The executive management is preparing for the first certification and records six issues in half a day:
| Issue | Origin | Effect | Relevance | Review on |
|---|---|---|---|---|
| Recruitment and training of young people in the company | internal | Risk | High | 30.06.2027 |
| Price pressure from imported kitchens | external | Risk | Medium | 31.12.2026 |
| Demand for sustainable materials | external | Opportunity | High | 30.06.2027 |
| Digital planning and measuring | external | Opportunity and risk | Medium | 31.12.2026 |
| Building and fire safety regulations | external | Risk | Medium | 30.06.2027 |
| Experience held by a few key people | internal | Risk | Low | 31.12.2026 |
Two issues are weighted high, three medium and one low; that makes six in total. Among the parties it includes customers, employees, suppliers and the cantonal building insurance, each with expectation and way of monitoring. The scope reads: planning, manufacture and installation of kitchens and interior fittings at the sites Musterhausen and Beispielstadt. Installation at the customer’s premises is expressly included because it triggers most complaints.
Concrete consequences come out of the exercise: the highly weighted recruitment issue leads to a risk and a quality objective on training, and the customers’ expectation of punctuality to an objective for delivery dates. This shows what the APG means: the deliberations on the environment are reflected in planning.
Checklist
- External and internal issues are recorded, with effect (opportunity, risk or both) and weighting.
- Each issue has a date for the next review.
- The relevant interested parties are determined, with the criteria for selection.
- Their expectations are recorded, as is how you monitor them.
- The scope names products, services and sites.
- Excluded requirements are justified.
- Outsourced activities and assignments at the customer’s premises have been considered.
- The quality culture is described in a concrete paragraph.
- The results feed into risks, opportunities and objectives.
- The executive management can explain everything in conversation.
How KMU | base helps
In QMS | base you find everything in one place: in the sidebar under Management system, the item Context and stakeholders. The Management system group is initially collapsed and appears for people with edit rights. Everyone with QMS access may read; only people with the right for the management pages may edit.
Scope and quality culture. You describe the scope, products and services, sites and companies as well as quality culture and ethical conduct in one place. You exclude inapplicable standard clauses in the standard mapping; a justification is mandatory there (Applicability with justification).
Internal and external issues. With Add issue you record each issue with origin (internal or external), category (for example climate change, digital technologies, law and regulations, personnel), effect as opportunity, risk or both, relevance (low, medium, high) and the date Review on. An overdue date is marked red.
Interested parties. With Add party you record the party, its origin, its expectations, the monitoring and the relevance.
Starter pack and linking. The starter pack creates sample issues and parties that you adapt. Each issue can be linked to standard clauses, by default to clause 4.1 (Assign evidence to clauses). In the standard mapping you then see for each clause what covers it.
Limits you should know about:
- Interested parties appear as a table. There is no matrix view.
- Issues are not automatically transferred to the risk register. You make the connection yourself.
- The management review takes over from the context the number of issues and parties, not their content.
- There is no reminder for the review date; overdue issues are only marked.
- The software does not check whether your issues are complete and appropriate. That remains a task for management.
The guide to QMS | base explains how to use it. Take a look at the demo or open a trial account. If you have questions, the contact page will help. You will find the terms under Pricing.
Sources
- ISO: ISO 9001:2026, Quality management systems – Requirements (Edition 6, published on 16.09.2026; extracts on the 2026 edition and on the question of certification), accessed 27.10.2026.
- ISO/TC 176: ISO 9001:2026 has been released!, news of 23.09.2026, accessed 27.10.2026. The page notes that it is maintained by third parties.
- ISO 9001 Auditing Practices Group: Guidance on Context (13.01.2016, for the 2015 edition; not endorsed by ISO and IAF), accessed 27.10.2026.
- ISO 9001 Auditing Practices Group: Guidance on Scope and applicability (Edition 3, 01.12.2023), accessed 27.10.2026.
The tables, examples and recommendations marked “practice” are editorial aids, not text of the standard. This guide does not replace legal or tax advice. Information as at 27 October 2026.