Key takeaways
- Clause 4.1 asks you to understand the external and internal issues that affect what your management system is meant to achieve, and to keep that understanding up to date.
- Clause 4.2 asks you to identify the interested parties that matter to the system, what they need from you, and which of those needs you will treat as requirements.
- Interested parties is ISO's word for stakeholders, filtered to those that affect, or are affected by, what the system delivers.
- Since 2024 the standards also ask whether climate change is a relevant issue, and note that interested parties can have climate-related requirements.
- Context and interested parties feed the scope, the risks and opportunities, the objectives and management review, so they are the start of the system rather than a one-off exercise.
Every ISO management system starts in clause 4, with two questions. What is going on in and around this business that affects what we are trying to achieve? And who has a stake in it, and what do they need from us? Clause 4.1 calls the first the context of the organisation. Clause 4.2 calls the second the needs and expectations of interested parties. Answer them well and the rest of the system has something real to build on.
Context of the organisation: clause 4.1
Clause 4.1 asks you to determine the external and internal issues that are relevant to your purpose and strategic direction, and that affect your ability to achieve the intended results of the management system. You then monitor and review them, because they change.
External issues come from outside the business:
- market conditions, competitors and customer concentration;
- economic factors, such as exchange rates and the cost of inputs;
- laws and regulations, and changes on the way;
- technology that changes how the work is done;
- social and environmental conditions, including climate-related issues where they are relevant.
Internal issues come from inside it: skills and staffing, capacity, culture, systems, knowledge held by a few key people, finances and the way decisions are made.
ISO does not prescribe a method. Many businesses use a SWOT or PESTLE analysis, which works well as long as it stays specific. “Competition is increasing” tells you little; “two of our three largest customers are re-tendering next year” tells you what to plan for.
Interested parties: clause 4.2
Interested parties is ISO's word for stakeholders: the people and organisations that affect, or are affected by, what your management system delivers. Clause 4.2 asks you to identify the ones that are relevant, what they need and expect, and which of those needs you will treat as requirements of the system.
The standards add their own emphasis. ISO 14001 asks which needs become compliance obligations. ISO 45001 gives workers a central place, alongside other interested parties, and asks which needs become legal and other requirements. ISO/IEC 27001 asks which requirements the information security system will address.
Relevance is the filter. You do not need to list everyone who has ever had contact with the business; you need the parties whose needs genuinely shape how the system works.
Example: interested parties and their needs
An illustrative register for a manufacturer in South Africa. Yours will look different, and it should.
| Interested party | Needs and expectations | How the system responds |
|---|---|---|
| Customers | Conforming products, delivered on time; certification they can show in their own audits and tenders | Contract review, production controls, delivery tracking, certified management system |
| Employees | A safe workplace, clear roles, training, fair treatment | Risk assessments, competence records, induction, consultation |
| Owners and funders | Profitable, predictable operations and controlled risk | Objectives, management review, risk and opportunity planning |
| Suppliers and subcontractors | Clear specifications and orders, timely payment | Purchasing controls, supplier evaluation and communication |
| Regulators | Compliance with health and safety, environmental and other legislation | Legal register, evaluation of compliance, inspections |
| Neighbours and the community | Control of noise, dust, traffic and waste | Environmental aspects and controls, complaints handling |
The right-hand column matters most. A register that lists parties but never shows how the system responds to them is a list, and an auditor will notice the difference.
Climate change: the 2024 amendment
In February 2024 ISO amended its management system standards, including ISO 9001, ISO 14001, ISO 45001 and ISO/IEC 27001. Clause 4.1 now asks you to determine whether climate change is a relevant issue, and clause 4.2 notes that relevant interested parties can have requirements related to it. For some businesses it is central, through customer requirements, physical risk to sites or the supply chain. For others it is minor. Either way, you should be able to show that you considered it.
How 4.1 and 4.2 feed the rest of the system
Context and interested parties are inputs, and the rest of the system draws on them:
- Scope (clause 4.3). Both are listed as things to consider when you define your scope.
- Risks and opportunities (clause 6.1). You plan actions by considering the issues in 4.1 and the requirements in 4.2.
- Objectives (clause 6.2). Good objectives respond to what the context and interested parties tell you matters.
- Management review (clause 9.3). Changes in external and internal issues, and feedback from relevant interested parties, are review inputs.
That is the Plan stage of the Plan-Do-Check-Act cycle, and it is why a thin context analysis usually shows up later as a thin risk register.
Keeping it alive
The most common weakness is a context analysis written once for certification and never touched again. Keep it short enough to review, put it on the management review agenda, and update it when something real changes: a new major customer, a new site, a new law, a new service. A register reviewed every year with a few changed lines is a sign of a system that is paying attention.
What auditors look for
Auditors rarely read the register line by line. They ask leaders what the key issues and stakeholders are, then check that the answers line up with the risk register, the objectives and the management review records. Consistency between those documents, and evidence that they are reviewed, is what shows the system understands its own business.
How we help
We work through context and interested parties with your leadership team early in the design of the system, in plain language, and keep the result short enough to use. Our guide to building an ISO 9001 system that works shows where it fits in the wider build. If you would like a hand with yours, contact us.