ISO Clause 5.1 Leadership and Commitment: No Document Required, Plenty Expected

Most clauses in an ISO management system standard end in a record. Clause 5.1 does not. It asks top management to demonstrate leadership and commitment, lists a whole set of things they are expected to do, and then never once asks for documented information.

That catches people out from both directions. Some organisations write nothing and assume the clause takes care of itself. Others produce a laminated commitment statement, have the managing director sign it, and treat the clause as closed. Neither tends to survive a conversation with an auditor, because what 5.1 really asks for is evidence that the people at the top are steering the system, not just signing it.

Short answer

Clause 5.1 requires top management to demonstrate leadership and commitment to the management system: setting direction, making sure the system is built into how the business actually runs, providing resources, communicating why it matters, and backing improvement. It requires no specific document. You can evidence it three ways, and they stack: a signed leadership commitment, a map of where each requirement shows up in your system, and top management speaking to it themselves at audit.

What clause 5.1 actually asks for

Every ISO management system standard built on the common Annex SL structure, now called the harmonized structure (ISO 9001, 14001, 45001, 27001 and 42001 among them), has a clause 5.1. The core is the same in each. In plain terms, top management is expected to:

1. Make sure the policy and objectives exist and fit the organisation’s strategic direction.
2. Make sure the system’s requirements are built into the business’s own processes, not run alongside them.
3. Make sure the resources the system needs are available.
4. Communicate why effective management, and conforming to the system, matters.
5. Make sure the system achieves what it is meant to achieve.
6. Direct and support people so they can contribute to its effectiveness.
7. Promote continual improvement.
8. Support other managers to show leadership in their own areas.

Each standard then adds its own, and the differences matter if you run more than one. The table sets them side by side.

Editions compared: ISO 9001:2015 (with the 2026 addition marked), ISO 14001:2015, ISO 45001:2018, ISO/IEC 27001:2022 and ISO/IEC 42001:2023. ISO 14001 has also been revised in 2026, so check your edition; Global ACI’s ISO 14001:2026 transition requirements set the timetable. We cover the ISO 9001 change in ISO 9001:2026: what is changing.

Two things stand out. ISO 27001 and ISO 42001 stick to the shared core, so an information security or AI system has the shortest 5.1 list. ISO 42001 adds no requirements, but a note points to building a culture of responsible AI as a way of showing commitment. ISO 45001 has the longest, and its additions are not soft: protection from reprisals and worker consultation are requirements an auditor will test by talking to workers, not just to top management.

Who counts as top management

The standards define top management as the person or group who directs and controls the organisation at the highest level. Two practical points follow. First, it is set by your scope: if your certificate covers one site of a larger group, top management is the leadership of that site, not the group board. Second, top management can delegate tasks but not the clause. In a 15-person business that is usually the owner. In a larger one it is the executive team, and the auditor will expect to speak to at least one of them.

What it does not ask for

Clause 5.1 does not require documented information. The policy is different: under 5.2 it must be available as documented information. Under 5.3, roles, responsibilities and authorities must be assigned and communicated, and ISO 45001 also requires them to be kept as documented information. But 5.1 is about behaviour, and behaviour is evidenced by what the system shows and what the people say, not by a dedicated form.

Three ways to evidence it

There is no single right answer, and the three approaches below are not alternatives. Most organisations start with the first, mature organisations add the second, and the third happens at every audit whether you plan for it or not.

1. A leadership commitment, signed and endorsed

The simplest approach is a short statement from top management that commits them to the system: what they will provide, how they will stay involved, and how they will know it is working. It is often folded into the policy itself, or sits as a one-page leadership commitment endorsed by the managing director or the executive team.

It is a reasonable starting point, and it does two useful things. It forces top management to read and agree to what the standard expects of them, and it gives staff a visible signal that the system is not just the quality manager’s project.

Its limit is that a signature is a promise, not a demonstration. An auditor who sees a signed commitment will usually ask the obvious next question: show me where that happened. On its own, a signed statement is evidence for clause 5.2, not proof of 5.1.

2. Level up: map each requirement to the system

The stronger approach is to take each lettered requirement in your standard’s clause 5.1 and write down where your system already shows top management doing it. Almost all of the evidence already exists. It is just scattered.

For example, in an ISO 9001 system:

Done well, this map becomes the most useful document in the system for an audit, even though the standard never asks for it. It shows the auditor where to look, it shows top management where they are thin, and it turns 5.1 from a conversation the business hopes goes well into one it has prepared for. Our free matrix below is set up for exactly this.

Two cautions. Map what actually happens, not what you would like to happen, because the map itself becomes something an internal audit can test. And keep it short: a line per requirement pointing to real records is enough.

3. Put top management in front of the auditor

The most convincing evidence for 5.1 is the one that needs no document at all: top management sitting in the audit and speaking to it themselves.

Certification auditors will normally want to interview top management, usually early in the audit, because so much of the system flows from that conversation. It is a short interview, and it is not a test of whether they can recite clause numbers. The questions tend to be practical:

• What is the system for, and how does it support where the business is heading?
• How do you know it is working? What did the last management review tell you?
• What resources did you approve this year because of it?
• What would you do if an objective was being missed?
• How do your managers know what is expected of them?

A managing director who can answer those in their own words, with a couple of real examples, has evidenced most of 5.1 in fifteen minutes. One who defers every question to the quality manager has told the auditor something too.

If you have built the evidence map, it doubles as the briefing note. Fifteen minutes with it before the audit is usually all the preparation a busy executive needs. And the same interview belongs in your own internal audit under clause 9.2, so top management have practised it before the certification body arrives.

Where clause 5.1 connects to everything else

Clause 5.1 is short, but it touches most of the system. The strongest evidence for it usually sits in management review (clause 9.3), because that is where top management formally looks at the system’s performance and makes decisions about it. The policy (5.2) and roles (5.3) are the documented companions. Objectives (6.2) are where direction becomes measurable. And context (4.1) is what “compatible with the strategic direction” is measured against.

If those clauses are working, 5.1 is mostly a matter of pointing to them. If they are not, no commitment statement will cover the gap.

Where clause 5.1 goes wrong

• The system belongs to the quality manager. Top management sign what they are given and attend the audit closing meeting. Everything else is delegated, and it shows.
• Management review is a formality. Minutes record attendance and “noted” against every item, with no decisions. That is the clause most auditors lean on for 5.1, and it has nothing in it.
• The policy does not match the business. A generic policy that could belong to any company is hard to defend as compatible with your strategic direction.
• Objectives with no owner at the top. If nobody in top management can say how the objectives are tracking, the auditor will draw the conclusion.
• Top management is the wrong people. For a site-level certificate, flying in a group executive who has never seen the site’s system rarely helps.

Free download: Leadership Evidence Matrix

Download the Leadership Evidence Matrix (Excel). It lists each ISO 9001 clause 5.1 requirement in plain English, with columns for what it looks like in practice, where your system shows it, which member of top management owns it, and the talking point for the audit interview. A second tab compares the clause 5.1 requirements across ISO 9001, 14001, 45001, 27001 and 42001, so an integrated system can use one matrix and see at a glance which requirements apply to which standard.

Clause 5.1: FAQs

Does clause 5.1 require documented information?

No. Clause 5.1 requires top management to demonstrate leadership and commitment but does not require any specific record. The policy under 5.2 must be documented, and other clauses produce records that serve as evidence, management review minutes above all.

Is a signed leadership statement enough?

It is a reasonable start, but on its own it shows intent rather than action. An auditor will usually look for evidence that top management actually did the things the clause lists, and will often test that by interviewing them.

Who is top management for clause 5.1?

The person or group who directs and controls the organisation at the highest level, within the scope of the certificate. For a small business that is usually the owner. For a site-level certificate within a group, it is the site’s leadership.

Can top management delegate clause 5.1?

They can delegate tasks, such as running the system day to day, but not the leadership itself. ISO 9001 and ISO 14001 make this explicit by requiring top management to take accountability for the system’s effectiveness, and ISO 45001 goes further with overall responsibility and accountability for preventing injury and ill health.

What will the auditor ask top management?

Usually practical questions: what the system is for, how they know it is working, what resources they have approved, what happens when objectives are missed, and how managers know what is expected of them. Clause numbers rarely come into it.

Is clause 5.1 the same in ISO 9001, 14001, 45001 and 27001?

No. The core eight requirements are shared through the harmonized structure. ISO 27001 adds nothing to them, and ISO 42001 adds only a note encouraging a culture of responsible AI. ISO 9001 adds accountability, the process approach and risk-based thinking, engagement and customer focus, plus quality culture and ethical behaviour in the 2026 edition. ISO 14001 adds accountability for effectiveness. ISO 45001 adds the most, including worker consultation and participation, protection from reprisals, culture and health and safety committees. The comparison table above sets them side by side.

How Streamline can help

Streamline builds and audits ISO management systems for Australian organisations, and you deal directly with a practising ISO Lead Auditor. If top management’s part in your system is a signature and a closing meeting, an internal audit will show where the evidence is thin and give your executives a practice run at the interview. A gap analysis is the usual starting point for a new system, and ISO mentoring suits organisations that want their own people to build it. If you would like a hand, get in touch.

This article is general information from an auditing and management system perspective. Clause wording is paraphrased; refer to your licensed copy of the standard for the exact requirements.