ISO 9001 Clause 8 in Plain English: From Enquiry to Handover

Everything up to clause 8 is planning. Context, leadership, risk, objectives, people and resources. Clause 8 is where the business actually does what it does. It is called “Operation”, and it runs end to end, from the first conversation with a customer to the job being signed off.

Read it in order and it could describe almost any business. Work out what the customer wants. Design it, if you design. Buy what you need. Do the job. Check it before you hand it over. Deal with it properly if something is not right.

The standard calls these 8.2 to 8.7. Your people do not need to know those numbers. They need a sales process, a purchasing process and a delivery process that already include what the clauses ask for.

Clause 8 in one line per clause

• 8.1 Operational planning: plan the work before you start it, using everything the earlier clauses set up.
• 8.2 Customer requirements: work out what the customer wants and confirm you can deliver it, before you commit.
• 8.3 Design and development: if you design the product or service, control how.
• 8.4 External providers: control the suppliers and subcontractors who affect what you deliver.
• 8.5 Production and service provision: do the job under controlled conditions.
• 8.6 Release: check it is right before it leaves your hands.
• 8.7 Nonconforming outputs: deal with anything that is not right, so it does not reach the customer by accident.

The numbering is slightly back to front. Post-delivery activities, such as warranty and the defects liability period, sit inside 8.5, which comes before release at 8.6. In real life you check and hand over first, and look after the customer afterwards. Map your processes in the order the work flows, not the order the clauses appear.

The 2026 revision of ISO 9001 kept the clause numbering almost unchanged, so this applies to both editions.

8.2: Working out what the customer wants

This is your enquiry, quoting, tendering and contract process. The clause asks you to:

• Communicate with customers about what you offer, their enquiries and contracts, their feedback and complaints, and how you will handle their property.
• Determine the requirements. These include what the customer said, and also what they did not say but you know the job needs, such as the legal and regulatory requirements that apply.
• Review before you commit. Before you send the quote or sign the contract, check you understand what is wanted and that you can deliver it. Where the customer gives you nothing in writing, confirm their requirements before you accept.
• Handle changes. If the customer changes their mind, update the quote or contract, and make sure the people doing the work know.

In practice, most of this is already in a good sales process. The enquiry lands in your CRM. Someone checks the scope, the drawings and the specification. Someone with the authority approves the price. The client signs. The gap is usually the last step: a variation agreed on the phone that never reaches the quote, the job pack or the invoice. A short variation form, sent from the same CRM and signed by the client, closes it.

8.3: Design, if you design

If you create the specification yourself, clause 8.3 applies. If the customer, a manufacturer or an engineer hands you the specification and you build to it, it usually does not, and you can justify it as not applicable in your scope. Our clause 8.3 guide explains how to tell, and what to do if it applies.

8.4: Suppliers and subcontractors

Clause 8.4 covers the external providers who affect what you deliver: suppliers whose products go into your work, subcontractors who do part of the job, and anyone delivering straight to your customer on your behalf. Your accountant and your stationery supplier generally sit outside it.

For those inside it, the clause asks you to set criteria for choosing them, monitor how they perform, and tell them clearly what you need. That covers the product or service, any approvals, the competence of their people, and any checks you or your customer will do.

Most businesses already have the pieces: an approved supplier list, a prequalification questionnaire for subbies, purchase orders and an annual review of who let you down. Set the level of control by risk. A supplier of a critical material deserves more scrutiny than the business that supplies your gloves.

In an integrated system, this one process also covers ISO 45001 clause 8.1.4, so subcontractor safety requirements sit alongside the quality ones.

We go through clause 8.4 in detail, side by side with ISO 45001 clause 8.1.4, in ISO 9001 8.4 and ISO 45001 8.1.4: one number apart, one purchasing process, including which suppliers are in scope and what good selection criteria look like.

8.5: Doing the job

This is the biggest part of clause 8, and for most businesses it is simply the delivery process. Under “controlled conditions” it asks for:

• The information people need: the job pack, drawings, specification and the results expected.
• Monitoring and measurement at the right stages. For many trades this is an inspection and test plan, with hold points and witness points where the client wants to sign off before you move on.
• Competent people, suitable equipment and the right environment for the work.
• Identification and traceability where they matter, such as batch numbers on the materials you used, recorded so you can trace a failure back to the source.
• Customer property. If the client supplies the stone benchtop, the fittings or their own data, look after it and tell them if anything happens to it.
• Preservation: protecting the work and the materials until handover.
• Post-delivery activities: warranty, defect rectification and support, set by the risk and the contract.
• Control of changes during the job, with a record of who authorised them.

None of this needs a separate ISO procedure. If your quality checklist records ambient temperature, mix ratios, batch numbers and photos, it is already doing most of 8.5.

8.6: Checking before you let it go

Before the work is released to the customer, check it meets the requirements, and keep a record of who released it. On a construction job that is your final inspection, practical completion and the client’s sign-off. In a service business it might be a review of the report before it is sent.

An end-of-job report that pulls together the inspection results, photos and the client’s acceptance gives an auditor everything they need in one place, and it makes a good handover document for the client too.

8.7: When something is not right

Clause 8.7 deals with outputs that do not meet requirements: the job painted blue when the client ordered pink. The clause asks you to identify and control it so it does not reach the customer by accident, and then do one of these:

• Correct it: rework or repaint.
• Segregate, contain, return or suspend the product or service.
• Tell the customer.
• Get authorisation to accept it as it is, by concession. A discount the client agrees to is a common example.

Then record what went wrong, what you did about it, and who decided. If it could happen again, it also goes into your corrective action process so the cause gets fixed, not just the job.

Build it into the processes, not the training

The quickest way to fail clause 8 is to treat it as something separate from the work. A procedure called “Clause 8.4 Control of externally provided processes” that nobody in purchasing has read will not survive an interview with the purchasing officer.

The approach that works is the one set out in our clause 4.4 guide. Map your sales, purchasing and delivery processes, then check each one against the clause. Where a requirement is missing, add it as a step in the process: a contract review checkbox, a supplier prequalification step, a hold point in the inspection and test plan. The team follows the process, and the process meets the standard.

The handover from sales to operations deserves the most attention. It is where 8.2 meets 8.5, and in most businesses it is the riskiest point in the whole system. Sales promised something, the job pack does not say it, and the site team finds out from the client. A defined list of what must be in the job pack before operations accepts the job fixes more problems than any procedure.

A warning about clause 8 numbering across standards

Clause 8 is “Operation” in every management system standard, but the content underneath is not shared. Clause 8.2 in ISO 9001 is customer requirements. In ISO 45001 and ISO 14001, 8.2 is emergency preparedness and response. Do not assume a clause number means the same thing across standards. Our clause guides hub splits common and standard-specific clauses for this reason.

ISO 9001 clause 8: FAQs

Do we need a written procedure for each clause 8 requirement?

No. ISO 9001 asks for documented information in specific places, such as the results of contract review, supplier evaluations, release records and nonconforming outputs. It does not ask for a procedure per clause. Build the requirements into the processes you already run, and keep the records they produce.

What is contract review in ISO 9001?

It is the clause 8.2.3 requirement to review what the customer wants, and confirm you can deliver it, before you commit to supplying it. In most businesses it is a step in the quoting or tender approval process, with a record of who checked and approved it.

Does clause 8.4 cover all of our suppliers?

No. It covers the external providers whose products or services affect what you deliver to your customers. Office supplies, accounting and most general services sit outside it.

What is the difference between 8.6 and 8.7?

Clause 8.6 is the check that the work is right before you release it. Clause 8.7 is what you do when it is not: correct it, contain it, tell the customer, or accept it by concession, and record what was decided.

Is clause 8 the same in ISO 45001 and ISO 14001?

The heading is the same, but the content is not. ISO 45001 and ISO 14001 use clause 8 for operational planning and control, management of change, procurement and emergency preparedness.

How Streamline can help

Streamline designs, implements, audits and mentors practical ISO management systems for Australian businesses. We map your sales, purchasing and delivery processes and build the clause 8 requirements into them, so your team follows the process and the process meets the standard. For a smaller business, see the shortcuts the standard allows, or browse our other ISO clause guides.

Speak with an experienced ISO auditor

For help with clause 8 or any part of your management system, contact us or email hello@streamline.business.