Management system standards and normative requirements
The standards landscape
Management system standards share a harmonised high-level structure: clause 4 context, 5 leadership, 6 planning, 7 support, 8 operation, 9 performance evaluation, 10 improvement. ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001 and ISO 22000 all sit on this skeleton, so clause numbers often align across them. Learn which document does what: ISO 9000 vocabulary, ISO 19011 auditing guidance, ISO/IEC 17021-1 for certification bodies, ISO/IEC 17065 for product certification.
Requirements language
The word shall marks a requirement, should is a recommendation, may is permission. 'Documented information' replaced both 'documented procedure' and 'record' in the 2015-era revisions and must be controlled across its lifecycle: creation, approval, distribution, access, retention, protection and disposal.
Trap: questions invent requirements. ISO 9001 does not demand a quality manual, a formal risk register, a documented internal audit procedure, or a management representative. If you cannot point to a specific shall, it is not a nonconformity.
Trap: the standards differ. ISO 9001 asks for risk-based thinking without prescribing a method; ISO 14001 requires environmental aspects and compliance obligations; ISO 45001 requires hazard identification and assessment of OH&S risks and opportunities. Do not transplant one standard's explicit requirement into another.
Worked example
An auditee has no documented procedure for handling customer complaints. Neither clause 9.1.2 (customer perception) nor clause 10.2 (nonconformity and corrective action) mandates a documented procedure. Raise a finding only if the process is absent, ineffective, or the organisation's own criteria or regulations require documentation. Anchor every finding to a requirement contained in the stated audit criteria.