ISO 21001 Requirements for an EOMS
Domain 2: ISO 21001 Requirements for an EOMS
This domain tests clause-by-clause knowledge of the auditable requirements in ISO 21001:2018 clauses 4 to 10 and how each applies to education. Questions often ask which clause covers a scenario, or what evidence an auditor would expect.
Clauses 4-6: context, leadership, planning
Clause 4 requires the organization to determine external and internal issues, interested parties and their relevant requirements, the EOMS scope, and the processes needed. Clause 5 requires top management to demonstrate leadership, establish an educational policy, and assign roles. Clause 6 requires actions to address risks and opportunities, measurable objectives, and control of planned changes.
Clauses 7-8: support and operation
Clause 7 covers resources, competence, awareness, communication and documented information. Clause 8 covers operational planning and control, requirements for educational products and services, design and development, control of external providers, delivery, release, and nonconforming outputs. Education-specific examples include programme design review, control of outsourced e-learning platforms or assessment providers, verification before issuing certificates, and control of learner records.
Clauses 9-10: evaluation and improvement
Clause 9 requires monitoring, measurement, analysis and evaluation, internal audit, and management review. Clause 10 requires treatment of nonconformities, corrective action, and continual improvement.
Worked example
An institution outsources online platform hosting and exam marking. Clause 8.4 applies: it must define criteria for selecting, evaluating, monitoring and re-evaluating the external provider, and retain documented information of these activities. A signed contract alone does not demonstrate control. The institution should also verify released results (8.6) and address marking errors as nonconforming outputs (8.7).
Traps
'Documented information' includes records, not only procedures. Internal auditors must not audit their own work. Management review is required, not optional. Nonconforming outputs include incorrect certificates and failed assessments, not only student misconduct. Outsourced processes remain the organization's responsibility under 8.4.