What Is the Difference Between a Quality Policy and Quality Objectives in ISO 9001?

ISO 9001 requires organisations to have both a quality policy and quality objectives, and these two requirements appear in different clauses for a reason. They are related but serve different purposes, and confusing them, or treating them as the same document, is one of the more common gaps auditors find during ISO 9001 certification and recertification audits. This article explains what each one is, how they work together, what makes each one effective, and what typically goes wrong in practice.

What Is a Quality Policy in ISO 9001?

A quality policy is a high-level statement of intent, approved by top management, that defines the organisation’s overall direction and commitments in relation to quality. It is covered by Clause 5.2 of ISO 9001:2026. The quality policy must be appropriate to the purpose and context of the organisation, provide a framework for setting quality objectives, include a commitment to satisfy applicable requirements, and include a commitment to continual improvement of the quality management system.

The quality policy is not a procedural document. It does not say how things will be done. It says what the organisation is committed to and what matters in relation to quality. For example, a food manufacturer might commit to delivering products that consistently meet customer specifications and food safety requirements, and to improving its processes through systematic review and employee involvement. A professional services firm might commit to understanding each client’s requirements before starting work and to resolving any quality concerns before final delivery.

Under ISO 9001:2026, the quality policy must also support the promotion of quality culture and ethical behaviour. This was added as an explicit leadership commitment in Clause 5.1.1 of the 2026 edition and flows into the policy requirement. Auditors increasingly look for evidence that the quality policy reflects these commitments in substance, not just as a sentence inserted for compliance.

The quality policy must be documented, communicated within the organisation, and available to relevant interested parties. It must be reviewed to remain suitable as the organisation’s context and direction change. A quality policy from 2010 that has never been updated, signed only by a management representative rather than top management, and never communicated beyond the quality team, is likely to attract a nonconformity.

For a clause-by-clause breakdown of what ISO 9001 requires across all seven mandatory clauses, see our guide to ISO 9001 requirements explained.

What Are Quality Objectives in ISO 9001?

Quality objectives translate the commitments in the quality policy into specific, measurable targets. They are covered by Clause 6.2 of ISO 9001:2026. The standard requires quality objectives to be consistent with the quality policy, measurable (where practicable), relevant to the conformity of products and services and to the enhancement of customer satisfaction, monitored, communicated, and updated as appropriate. Crucially, objectives must be planned and documented, with the standard also requiring the organisation to document what will be done, what resources are needed, who is responsible, when it will be completed, and how the results will be evaluated.

The relationship between the policy and the objectives is hierarchical. The policy provides the commitment; the objective turns it into a target with a number, a timeframe, and an owner. If the quality policy commits to continual improvement of customer satisfaction, a corresponding quality objective might be to achieve a customer satisfaction score of at least 4.0 out of 5.0 on quarterly surveys by the end of the financial year, with responsibility held by the operations manager. If the policy commits to reducing defects, an objective might be to reduce the first-pass defect rate on production line A from 3.2 percent to 2.0 percent by the end of Q2, measured monthly by the quality control team.

Quality objectives do not have to cover every dimension of the QMS simultaneously. They should be set where improvement or maintained performance is most relevant to the organisation’s strategic direction, its current performance gaps, and its customers’ most significant requirements.

Differences Between Quality Policy and Quality Objectives

The clearest way to understand the difference is by timeframe and measurability. A quality policy is a standing commitment with no expiry date; it reflects what the organisation fundamentally values and commits to in relation to quality. Quality objectives are time-bound targets that change as the organisation improves and as priorities shift.

A quality policy statement cannot be assessed as met or unmet in numerical terms. You cannot measure whether you have “committed to customer satisfaction” in the same way you measure whether you reached a 92 percent on-time delivery rate. Quality objectives, by contrast, must be measurable. If an objective cannot be evaluated against a defined target with a defined method of measurement, it is not a quality objective in the sense that ISO 9001 requires. “We aim to improve quality” is a policy-level statement at best; it is not a measurable objective.

Another practical difference is visibility. The quality policy is typically communicated broadly, displayed in the workplace, included in staff induction materials, and made available on request to customers. Quality objectives are typically communicated to the specific teams and individuals responsible for achieving them, tracked in management review, and updated as targets are met or circumstances change.

For an explanation of how the ISO 9001:2026 revision affects the quality policy requirement, including the quality culture additions to Clause 5.1.1, see our article on ISO 9001:2026 key changes for Malaysian businesses.

What Are the Most Common Audit Findings on Quality Policy and Objectives?

In our work with Malaysian organisations preparing for ISO 9001 certification and recertification audits, four types of nonconformity appear most frequently in relation to the quality policy and quality objectives.

The first is a quality policy that is not signed or endorsed by top management. Clause 5.2 places this as a leadership responsibility; a policy signed only by a quality manager is not aligned with the requirement that top management establishes and communicates it.

The second is quality objectives that are not measurable. Objectives that say “improve customer satisfaction” or “reduce complaints” without specifying a target value, a measurement method, and a timeframe do not satisfy Clause 6.2. Auditors will request evidence that objectives have been monitored against defined targets; if no target exists, there is nothing to evaluate.

The third is a disconnect between the quality policy and the quality objectives. If the policy commits to on-time delivery as a priority but no quality objective tracks delivery performance, auditors will note that the objectives do not serve as a framework for the policy’s commitments.

The fourth is quality objectives that are never reviewed or updated. ISO 9001 requires objectives to be monitored and updated as appropriate. A set of objectives that has remained unchanged for three years, with no record of whether targets were met or revised, suggests a QMS that is documented but not actively managed. Management review records should show that objective performance is reviewed and that decisions are made about targets for the next period.

How Do the Quality Policy and Objectives Work Together in Practice?

The quality policy and quality objectives work together as part of a planning cycle. Leadership sets the policy to define the organisation’s quality direction. The objectives operationalise that direction by specifying what the organisation will measure and improve. Performance against objectives is tracked through monitoring and measurement (Clause 9.1) and reported in management review (Clause 9.3). Findings from the review feed back into updated objectives for the next period, and if the organisation’s context or strategy changes significantly, the policy itself may need to be reviewed.

For example, a Malaysian logistics company certified to ISO 9001 might have a quality policy that commits to on-time delivery, accurate documentation, and continual improvement of customer service. Its quality objectives for the year might be to achieve a 95 percent on-time delivery rate measured weekly by operations, to reduce documentation errors on consignment notes to fewer than 1 per 500 by Q4, and to achieve a minimum customer satisfaction score of 4.2 on quarterly surveys. These objectives can be tracked, reported in management review, and updated next year based on results. The policy does not change unless the company’s strategic direction changes.

Organisations currently certified to ISO 9001:2015 that need to update their quality policy to reflect the quality culture and ethical behaviour requirements of ISO 9001:2026 should review our guide to transitioning to ISO 9001:2026 in Malaysia for what needs to be updated before September 2029.

A quality policy and quality objectives serve different purposes and should be treated as separate documents with different levels of specificity. The policy states what the organisation is committed to; the objectives define what the organisation will measure and achieve. Both are mandatory under ISO 9001, and auditors will assess whether the objectives genuinely serve as a measurable framework for the policy’s commitments, not just whether documents exist with those titles.

If you are preparing for ISO 9001 certification for the first time or reviewing your QMS ahead of a recertification audit, contact Connext to discuss how to build a quality policy and objectives that satisfy the ISO 9001:2026 requirements and hold up under audit.

Frequently Asked Questions

Does the quality policy have to be a separate document from the quality manual?

The quality policy must be available as documented information, but how it is documented and where it sits is the organisation’s choice. It can be a standalone one-page document, a section within a broader quality manual, or published on the company intranet or website. What matters is that it is controlled, communicated, and available to relevant parties.

How many quality objectives should an organisation have?

ISO 9001 does not specify a number. Objectives should be set at relevant functions, levels, and processes, which typically means at least some objectives at the organisational level and some at departmental or process level. In practice, five to ten active objectives across the key QMS areas is common for a small to medium organisation. Too few may suggest the QMS is not actively managed; too many can dilute focus and make monitoring unmanageable.

Can the quality objectives and KPIs be the same thing?

They can overlap significantly. Key performance indicators (KPIs) used to manage operations often correspond directly to quality objectives if they relate to conformity of products and services or customer satisfaction. Where a KPI is already tracked regularly, it can form the measurement method for a quality objective, provided the objective states the target value and timeframe the organisation is working toward.

What happens if we do not meet a quality objective?

Missing a quality objective is not automatically a nonconformity under ISO 9001. The standard requires that objectives be monitored and updated, and that results be considered in management review. An organisation that monitors performance, identifies why a target was missed, takes corrective action, and sets a revised target is demonstrating exactly the continual improvement process ISO 9001 requires. An organisation that never reviews objectives or ignores missed targets is at risk of a nonconformity.

Does the quality policy need to be updated when we upgrade to ISO 9001:2026?

In most cases, yes. ISO 9001:2026 adds explicit requirements for quality culture and ethical behaviour in Clause 5.1.1. If your current policy does not reference these commitments, it will not provide the framework required by the updated standard. The policy should also be reviewed to confirm it remains appropriate to the organisation’s current context and strategic direction.