Management system standards put top management at the centre: the system is theirs, not the quality manager's. That makes leadership the hardest area to audit, because commitment is a behaviour, and the usual evidence is a signed policy. This post shows how to test commitment with questions and records that do not depend on the signature.
Last reviewed: 17 October 2026. Facts checked. We relied on the harmonised structure used across recent management system standards, as described in earlier guides we published and in the secondary sources opened for them. We did not open any ISO standard text for this post, so we do not quote clause wording or numbers. The scenario is invented. Edition note: ISO 9001:2026 was published on 16 September 2026 according to our earlier research, and ISO 14001:2026 in April 2026; we could not verify new clause numbering, so confirm references against the edition you audit.
What leadership usually has to demonstrate
Across the common standards, the expectations of top management fall into recognisable groups. In plain words:
- Ownership of the system. Leaders are accountable for its effectiveness, not only for approving it.
- Policy and objectives. A policy exists, fits the organisation's direction and has measurable objectives behind it.
- Integration. The system's requirements are part of business processes, not a parallel paper exercise.
- Resources. People, equipment, time and money are provided.
- Communication. The importance of the system and of meeting requirements is communicated.
- Direction and support. Leaders support people and other managers in their roles, and promote improvement.
- Roles and responsibilities. Authorities are assigned and communicated.
Check the exact words and their grouping in the edition you use; the standards differ in emphasis, for example on customer focus in a quality system or worker participation in a safety system.
Why the policy is not the evidence
A signed policy proves someone signed. To test commitment, look for decisions and behaviour:
| Claim | Weak evidence | Better evidence |
|---|---|---|
| Resources are provided | "We have budget" | A request that was approved, with date and amount, tied to an audit finding or risk |
| Objectives matter | Objectives on the wall | Monthly results with discussion and a decision when one is off track |
| Leaders communicate | Policy in reception | Staff who can say, unprompted, what the policy means for their job |
| System is integrated | Separate quality meetings | Quality and safety data in the ordinary business review |
| Improvement is promoted | Suggestion box | Improvements adopted from staff ideas, with names and dates |
Who to interview and how
Interview the person with ultimate authority, such as the managing director or site head, not only their representative. The standards generally expect a management representative to be possible but not a substitute for top management's own involvement. If the top person is "unavailable" for the whole audit, that is itself a data point.
Questions that open conversation without leading:
- What are the three things this system must achieve for the business this year?
- Which objective is furthest from target, and what have you decided about it?
- When did you last change something because of an internal audit or customer complaint?
- What did you decide at the last management review that you would not have decided otherwise?
- What resources have you been asked for in relation to the system, and what did you do?
- Which risks do you worry about most, and where are they recorded?
Listen for specifics. A leader who owns the system can name numbers, dates and decisions. One who is delegating everything tends to answer in generalities and refer you to someone else.
Triangulate with the floor
Never conclude from the leader's interview alone. Compare:
- Staff interviews. Ask a few people what the policy means for them and who they would raise a problem with. Do they feel it is safe to raise one?
- Records. Management review minutes, objective trend reports, approved resource requests, action logs.
- Observations. Do managers attend system meetings in person? Are safety rules followed by senior visitors?
A gap between what leaders say and what staff experience is the core finding in this area, and it is evidence-based because both sides are recorded.
Management review as the main record
Management review is the clearest place leadership shows up in records. Look at:
- Whether the standard's required inputs were discussed: audit results, performance, customer feedback, risks, resource needs and so on.
- Whether outputs are decisions with owners and dates, not "noted".
- Whether the same actions repeat meeting after meeting without closure.
- Attendance, and whether the top person actually attended.
If minutes look identical year after year or were evidently written in advance, the review is a formality. Say so in factual terms: "Minutes for three consecutive reviews list identical actions without status."
Writing a finding about leadership
Findings on leadership need care; they can feel personal. Keep them about records and requirements:
- State the requirement as you understand it from the standard you hold.
- State the evidence: what was asked, what was said, what records exist.
- State the gap.
For example: "The objective for on-time delivery is documented, but monthly results for five months show no review or decision when results were below the objective." That is factual and can be fixed. Avoid "management lacks commitment". For wording, see writing audit observations: condition, criteria, cause, effect.
An invented example
During a certification audit at a mid-sized plant, the managing director describes a strong safety culture. The auditor asks for the last three management reviews. Minutes show attendance by the quality head and plant manager only, no director. A shop-floor operator says reported near-misses "go to the supervisor and stop there". The auditor raises a finding on management review inputs and on communication of responsibilities, citing the records and interviews. The director, to his credit, joins the next review and the near-miss log gets a monthly owner.
Tips for internal auditors
- Be respectful but direct. Senior people usually appreciate precise questions.
- Request the top person's time early in the schedule; reschedules are hard.
- Prepare. Bring the policy, objectives and last review minutes to the interview.
- Do not accept delegation silently. Note it and ask why.
For the wider process of an internal audit, see how to run an ISO internal audit step by step.
The takeaway
Test leadership the way you test any control: through decisions, records and what staff experience. A signed policy is the starting point of the conversation, not the evidence.
Last reviewed: 17 October 2026. Facts checked. Opened: nothing new for this post beyond earlier research on the harmonised structure and the 2026 edition dates (secondary). Could not open: any ISO standard, so the list of leadership expectations is general and no clause wording or numbers are quoted; check them against the edition you audit.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error