In short
Clauses 4.1 and 4.2 are identical in all certifiable ISO management system standards because they follow the harmonized structure.
Clause 4.2 asks for three things: relevant interested parties, their relevant requirements and which of them the system will address.
Context analysis must feed the scope, risks and opportunities, objectives and management review, or it is of little use.
Since February 2024 you must determine whether climate change is a relevant issue, and justify the conclusion if it is not.
In ISO 9001 a written document is not explicitly required, but a concise, dated map is the most practical evidence for the audit.
Who influences your company, and what do they expect from you? Context analysis is the foundation on which everything else rests. Before you write procedures, set objectives or prepare for an audit, every ISO management system standard asks you to understand where you operate, what can help or hold you back, and who has a legitimate interest in what you do. These are clauses 4.1 and 4.2, the first ones with actual requirements, and they are identical in ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001 and the other certifiable standards.
Many SMEs dispose of them with a table filled in once and then forgotten. But if the context is poorly described, risks, objectives and controls are built on the wrong foundation, and the auditor will notice. In this guide we look at exactly what the two clauses require, how to carry out the analysis in practice with a concrete example, how to identify the interested parties that genuinely matter, what changes with the climate change amendment and what the auditor checks. If you need the basics on standards and certificates first, start with our guide on what ISO certifications are.
What are context and interested parties in ISO standards?
Context is the set of external and internal factors that affect your company's ability to achieve the intended results of its management system. Interested parties are the people and organisations that can affect your decisions or be affected by them. The two clauses work as a pair: the first captures the landscape, the second gives a name and a voice to those who live in it.
All certifiable ISO management system standards follow the harmonized structure (originally called the High Level Structure), set out in Annex SL of the ISO/IEC Directives. This means the same clause numbers, the same titles and the same core text: only the word naming the discipline changes (quality, environment, information security and so on). That is why what you read here applies to whichever standard you are adopting.
Clause 4.1: understanding the organisation and its context
Clause 4.1 requires the organisation to determine the external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended results of the management system. You do not have to list everything happening in the world, only what can shift the results of the system.
For ISO 9001, the intended results are, in short, consistently providing conforming products and services and enhancing customer satisfaction. For ISO 14001 they concern environmental performance; for ISO 45001, the prevention of work-related injury and ill health. The same issue can therefore carry different weight depending on the standard: a sole supplier of a critical raw material is a quality issue, while the same supplier located in a flood-prone area also becomes a continuity issue and, potentially, an environmental one.
Clause 4.2: needs and expectations of interested parties
In the harmonized structure text, clause 4.2 asks you to determine three distinct things: the interested parties relevant to the management system, their relevant requirements, and which of those requirements will be addressed through the system. The third point is the one many companies skip, and it is the most useful: it forces you to decide explicitly what falls within the system and what does not.
By "interested party", ISO terminology means a person or organisation that can affect, be affected by, or perceive itself to be affected by a decision or activity. Customers, employees, shareholders, suppliers, banks, regulators, the local community: the list varies from company to company. Relevance matters, not the completeness of the list.
Why is context analysis the starting point of every ISO standard?
Context analysis is the starting point because it directly feeds almost every subsequent clause. In the harmonized structure, the scope (4.3) must be determined by considering the issues from 4.1 and the requirements from 4.2. Planning for risks and opportunities (6.1) explicitly starts from the same elements. Management review comes back to see how they have changed.
In other words, context is not an introductory chapter: it is the input to planning. The "Context" guidance from the ISO 9001 Auditing Practices Group, the group of ISO/TC 176 and IAF experts that publishes guidance for auditors, says so clearly: the output of the context analysis should be evident in the risks and opportunities the organisation has determined.
From context to risks, objectives and review
Picture a chain with four links. An external issue (for example, dependence on a single customer worth half of turnover) generates a risk. The risk calls for an action and often a measurable objective (reducing concentration on the top customer). The objective is monitored and, at management review, top management assesses whether the situation has changed. If one link is missing, the chain breaks and the auditor sees it.
That is why it makes sense to read this guide together with the one on risks and opportunities in ISO standards, which picks up exactly where context analysis ends. And when you prepare the review, changes in external and internal issues and in the expectations of interested parties are among the first points to bring to the table: we cover this in the guide to management review.
One analysis for several standards
Because clauses 4.1 and 4.2 are common to all standards, a company certified to several systems can carry out a single context analysis, then read it through the lens of each discipline. The IAF communication on climate says so explicitly: if you run more than one system, a relevant issue must be considered within the scope of each.
This is one of the main advantages of an integrated management system: you avoid three nearly identical documents to keep aligned, and you give the auditor a consistent view of the company.
How do you carry out a context analysis in practice?
You carry out a context analysis by starting from the intended results of the system and asking what, inside and outside the company, can support or hinder them. The standard does not prescribe a method: you can use a SWOT analysis, a PESTLE matrix, a mind map or a simple table. What matters is that the reasoning is understandable, up to date and connected to the rest of the system.
External issues to consider
External issues are those you do not control directly but must be able to read. Typical areas are the market and competition, the legal and contractual framework, technology, the economic and financial situation, the supply chain, the local area and environmental conditions. For an SME, the useful questions are very concrete: how many customers do I depend on? Do I have sole suppliers for critical components? Which legal obligations will change in my sector?
A good external issue is described specifically. "Growing competition" says nothing. "Two foreign competitors offer shorter lead times on our main product" immediately points to an action, a risk and perhaps an objective on lead times.
Internal issues to consider
Internal issues concern what the company is and what it can do: organisation, competence, culture, processes, infrastructure, information systems, financial position. Here honesty pays more than image. A declared weak point that is being managed is not a nonconformity: an ignored weak point that then surfaces during the audit is.
Typical examples in SMEs: know-how concentrated in one or two people with no backup, ageing machinery with frequent breakdowns, a management system software that does not trace batches, an upcoming generational handover. Each of these issues, if relevant, should then appear in the risks, in training or in planned investments.
Useful tools and sources of information
The ISO 9001 Auditing Practices Group "Context" guidance lists as useful sources the business plan, strategy plans, competitor analysis, sector economic reports, SWOT analysis, meeting minutes and mind maps. The message is clear: you do not need to invent a new document if the information already exists, you just need to connect it to the management system.
A simple method that works for many SMEs is a two-hour meeting with top management and function heads, once a year and whenever something important happens. You start from the previous year's map, ask what has changed, update the entries and note the consequences for risks and objectives. The minutes of that meeting are already excellent evidence.
How do you identify relevant interested parties and their requirements?
You identify relevant interested parties by starting from a broad list and filtering it with a stated criterion: how much they can affect the intended results of the system, or how much they are affected by it. For each relevant party, you record the requirements, meaning needs and expectations, and decide which ones you address in the system. The APG "Context" guidance names precisely these three aspects as what the auditor evaluates: the range of parties considered, the selection criteria and the criteria for choosing requirements.
From the long list to the useful list
Start with every possible category: customers, end users, employees and their representatives, shareholders, banks and insurers, suppliers and subcontractors, public authorities and regulators, the local community, trade associations. Then apply the filter. A practical rule is to ask yourself whether, by ignoring that party, you would risk failing to achieve the system's results or breaching an obligation.
Be careful not to confuse relevance with power. A neighbour complaining about noise may be irrelevant for ISO 9001 but highly relevant for ISO 14001. That is why the "reference system" column in the map is so useful when you manage several standards.
Mandatory requirements and chosen requirements
Some interested party requirements are mandatory: applicable laws, the clauses of signed contracts, the conditions of permits. Others become binding only if you decide to adopt them: a customer request not written into the contract, an industry code of conduct, a voluntary sustainability commitment. The third point of 4.2 exists precisely to make this choice explicit.
Here is what an extract of the map might look like for a typical company.
Interested party | Relevant requirement | Addressed in the system? | Where you find it |
|---|---|---|---|
Main customer (household appliances sector) | On-time deliveries, ISO 9001 certificate, recycled content data | Yes | Lead time objectives, product data sheet, supplier management |
Moulding department employees | Safe working environment, training on the new presses | Yes | Training plan, risk assessment |
Bank | Regular financial statements, business continuity | Partly | Financial risks in the risk register |
Municipality and neighbours | Compliance with night-time noise limits | Yes (environmental system) | Noise monitoring, permit conditions |
Trade association | Adherence to a voluntary code of ethics | Not for now | Reasoned decision in the review minutes |
Note the last row: deciding not to address a requirement is legitimate, provided the decision is deliberate and justified. That is exactly what the clause asks of you.
Climate change: what does the 2024 amendment require?
Since 23 February 2024, the main ISO management system standards contain an extra sentence in 4.1 and a note in 4.2. According to the ISO-IAF joint communiqué of 22 February 2024, the organisation must determine whether climate change is a relevant issue, and the note reminds you that relevant interested parties can have requirements related to climate change. The list includes, among others, ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001, ISO 22301, ISO 37001 and ISO 50001.
What really changes for your company
ISO and IAF make clear that the intent of clauses 4.1 and 4.2 remains unchanged: you already had to consider all issues affecting the system. The amendment is treated as a clarification, not a new requirement, so IAF decided that no transition is needed and that certificates do not need to be reissued. The same text is being included in new editions of the standards as they are revised.
What does this mean in practice? Your context analysis must include an explicit assessment of climate, with a conclusion. The APG guidance on climate states that the amendment does not require you to launch climate initiatives if the topic is not relevant to the intended results of the system.
Examples of relevant climate issues
The same APG guidance lists useful examples for ISO 9001: extreme weather events that can cause supply shortages or delivery difficulties, new obligations on materials and product circularity, customers asking for lower-impact products, environmental claims on products that must then be substantiated.
Back to the moulding company in the table: the plastic pellet supplier's plant is in an area hit by floods several times, the main customer asks for recycled content data and the press department often exceeds critical temperatures in summer. Climate is therefore relevant, and must be carried into the risks, supplier management and the occupational health and safety risk assessment.
If you conclude that climate is not relevant
You can conclude that climate change is not a relevant issue for your system, but you must be able to justify it. IAF states that, in that case, the certification body checks the effectiveness of the process by which you reached that conclusion. A line saying "not applicable" with no reasoning is unlikely to be enough.
A solid justification refers to the intended results of the system and explains why climate does not affect them. A small professional firm with no physical supply chain, for example, may reach this conclusion for ISO 9001, recording the checks it carried out.
What does the auditor check on context and interested parties?
The auditor checks that the analysis exists, that it makes sense given the reality of the company and, above all, that it has effects on the rest of the system. The APG guidance suggests approaching the topic by interviewing top management and following the identified issues throughout the audit, checking that they reappear in risks and opportunities, communication and other areas of the system.
The questions you will hear in the audit
During the certification audit you will be asked to describe your company: who the customers are, what has changed over the past year, which suppliers are critical, which legal obligations apply to you. The auditor will then link your answers to the documents: if you say one customer accounts for half of turnover and that risk appears nowhere, you have a problem.
On climate, IAF instructs certification bodies to raise a finding if the organisation cannot show that it has considered all relevant issues, climate change included. It is therefore one of the checks you will also meet in surveillance audits.
Do you need a written document?
In ISO 9001, clauses 4.1 and 4.2 do not explicitly require documented information, as the APG guidance points out. The same guidance notes, however, that most organisations find it useful to retain it, and that without documents the auditor will look for objective evidence that the analysis is reflected in the system. The scope (4.3), on the other hand, must always be available as documented information.
The practical advice is to keep a concise, up-to-date, dated map, plus the minutes of the meetings in which you review it. It costs little and saves a lot of time in the audit. If you want to go deeper into how ISO 9001 structures the system, you will find everything in the guide to the ISO 9001 quality management system.
How we work on this phase with Complaion
With Complaion, context analysis is one of the first steps of the journey. Your dedicated Lead Auditor sets it up with top management, starting from the company's real data, and the platform stores the map, minutes and linked evidence, manages document versions and keeps the review schedule. So when the audit comes, the thread running from context to risks and objectives is already visible.
What are the most common mistakes in context analysis?
The most common mistakes stem from one misunderstanding: treating context analysis as a formality rather than a management tool. Here are the ones an auditor meets most often in SMEs, and how to avoid them.
Generic, copied analyses
The first mistake is the generic analysis, often taken from a template: "economic crisis", "competition", "changing regulations". These statements are true for any company and therefore useless for yours. An experienced auditor immediately recognises a text that could sit in any other company's file.
The fix is to write issues that contain a specific fact: a customer or sector name, an internal percentage, a supplier, a machine, a regulatory deadline. If an issue leads to no consequence in the system, ask yourself whether it is really relevant.
An analysis frozen in time
The second mistake is the analysis that never changes. Companies change: new customers arrive, an important one is lost, a new site opens, a legal obligation changes. If the map is identical to the one from three years ago, the auditor will wonder whether management is really using it.
Set at least one annual update, ideally before management review, and plan an extraordinary update whenever something significant happens. A shared schedule of deadlines stops the review from slipping from month to month.
Interested parties without requirements
The third mistake is listing interested parties without writing down what they want, or without deciding which requirements to address. A list of names does not satisfy 4.2: the clause asks for requirements and choices.
Context disconnected from risks and objectives
The fourth mistake, and the most serious, is a well-written context that leads nowhere. If the map mentions dependence on a sole supplier but the risk register does not, or if a customer asks for environmental data and nobody knows who prepares it, the system does not work as a chain. Before the audit, run the thread test: pick three issues at random and check where you find them in the system.
How Complaion helps you build a context that holds up in the audit
A well-made context analysis turns risks, objectives and review into natural consequences, not separately written documents. Complaion supports you with a dedicated Lead Auditor who knows the standards from the inside and proposes the path best suited to your company's needs, and with a platform that collects evidence, manages documents, keeps the schedule of deadlines and prepares the audit.
We already do this for more than 1,000 clients, on one or more standards, including ISO 9001, ISO 14001, ISO 45001 and ISO/IEC 27001. If you want to understand where to start, or how to put right an analysis that does not convince you, contact us for a free consultation: we start from your reality and propose a tailored quote.
Frequently asked questions on context and interested parties
Which ISO clauses cover context and interested parties?
They are clauses 4.1 (understanding the organisation and its context) and 4.2 (understanding the needs and expectations of interested parties). They belong to the harmonized structure and have the same number and the same core text in all certifiable management system standards, such as ISO 9001, ISO 14001, ISO 45001 and ISO/IEC 27001. Together they feed the scope (4.3) and the planning of risks and opportunities (6.1).
Does the context analysis have to be a written document?
In ISO 9001, clauses 4.1 and 4.2 do not set an explicit requirement for documented information. However, the ISO 9001 Auditing Practices Group guidance notes that most organisations find it useful to retain it. Without a document, the auditor will look for other objective evidence that the analysis has been carried out and used. A concise, dated map remains the most practical choice.
How often should the context analysis be updated?
The standard does not set a frequency, but the analysis must stay up to date. In practice it is worth reviewing at least once a year, before management review, and whenever something significant happens, such as losing an important customer, a new site or a new legal obligation. Minutes of the review are the simplest evidence to show the auditor.
Do I really have to consider climate change?
Yes, you must assess it, but you are not obliged to conclude that it is relevant. Since February 2024, clause 4.1 requires you to determine whether climate change is a relevant issue. If it is, it is handled like other issues, through risks, objectives and processes. If it is not, you must be able to justify the conclusion, because the certification body checks how sound it is.
Does the climate amendment require a new certificate?
No. According to the IAF decision, the amendment is a clarification, not a new requirement: no transition is needed and the certificate does not need to be reissued, because the standard's year of publication does not change. Certification bodies do, however, check the new text in audits after publication, and may raise a finding if the topic has not been considered.
Can I carry out a single context analysis for several ISO standards?
Yes, and it is often the most efficient choice. Because clauses 4.1 and 4.2 are common to all standards, you can keep a single map of issues and interested parties, indicating for each entry which system it relates to. A relevant issue must then be considered within the scope of each system where it carries weight.
