In short
ISO management system standards share the same clauses on measurement: 6.2 for objectives and 9.1 for monitoring, measurement, analysis and evaluation.
Each objective needs a plan: what will be done, resources, who is responsible, when it will be completed and how results will be evaluated.
Measurable does not mean quantified: a yes/no outcome supported by evidence can be enough.
One to three indicators per core process, each with a clear sheet, are often enough for an SME.
Data must be analysed at set intervals and lead to decisions in the management review.
Measuring everything is pointless: a few KPIs linked to your objectives, read regularly, are enough. That is the difference between a management system that guides decisions and a folder of charts nobody opens until the week before the audit. Many SMEs reach certification with dozens of indicators inherited from generic templates, with no owner, no threshold and nobody ever discussing the results.
ISO management system standards ask for something simpler and more useful: set objectives and indicators consistent with your policy, decide what to measure, with which method and how often, and use the results to assess whether the system works. In this guide we look at what clauses 6.2 and 9.1 of the structure shared by ISO standards require, how to tell an objective from an indicator and a target, how many KPIs an SME really needs and how to build an indicator sheet. You will find a complete example of a typical company, the mistakes auditors spot most often and a checklist to bring order to your numbers.
What does the standard actually require on objectives and indicators?
The standard requires planned objectives and a measurement system that you decide. It does not impose a list of KPIs: it asks you to choose them, justify them and use them.
The main ISO management system standards, such as ISO 9001, ISO 14001, ISO/IEC 27001 and ISO 45001, share the same backbone: the harmonized structure defined by ISO in Annex SL of its directives. Same clauses, same titles, many identical sentences. Two of these clauses deal directly with measurement: 6.2, on objectives and planning to achieve them, and 9.1, on monitoring, measurement, analysis and evaluation. UNI, the Italian standards body, has published an Italian translation with guidance for use, useful for anyone implementing or auditing a system. If you want to brush up on what an ISO standard is and how certification works, start with our guide to what ISO certifications are.
Clause 6.2: objectives with a plan
According to the harmonized structure, the organisation must establish objectives at relevant functions and levels. The objectives must be consistent with the policy, measurable if practicable, take applicable requirements into account, be monitored, communicated, updated as appropriate and available as documented information.
The second half of the clause is the one many companies overlook. For each objective you must determine what will be done, what resources will be required, who will be responsible, when it will be completed and how the results will be evaluated. In practice, an objective without a plan does not meet the requirement: "reduce complaints" written in the review, with no actions or owner, is an intention, not a system objective. Each standard then adds requirements specific to its own discipline, for example linked to risk assessment in information security, but the skeleton stays the same.
Clause 9.1: deciding what to measure, how and when
Clause 9.1 requires you to determine what to monitor and measure, the methods for monitoring, measurement, analysis and evaluation that ensure valid results, when monitoring and measuring must be performed and when the results must be analysed and evaluated. Documented information must be available as evidence of the results, and the organisation must evaluate the performance and effectiveness of the system.
Note what is missing: no minimum number of indicators, no mandatory list, no fixed frequency. The choice is yours, but it must be reasoned and consistent. ISO's guidance for standards writers says it clearly: the purpose of 9.1 is to determine to what extent planned activities are carried out and planned results achieved, and the information gathered is meant to support decisions and drive continual improvement. An indicator that feeds no decision does not serve that purpose.
Objective, indicator, target: what is the difference?
The objective is the result to be achieved; the indicator is the way you check it. Confusing the two is the root of most unusable measurement systems.
The harmonized structure defines an objective as a "result to be achieved", which can be strategic, tactical or operational and can apply to the whole organisation, a project, a product or a process. Performance is defined as a "measurable result", whether quantitative or qualitative. The indicator (or KPI, when it is genuinely key) is the quantity you use to track that performance. The target, or goal, is the value you want to reach by a given date.
An example makes this clear straight away. Objective: deliver to customers on time. Indicator: percentage of orders delivered by the confirmed date. Target: reach a defined value by the end of the year. Alert threshold: the level below which you open an analysis. Four distinct elements, which in documents often merge into a single confused line.
Monitoring and measuring are not the same thing
The harmonized structure distinguishes two concepts. Measurement means determining a value, with an instrument, a system or a survey. Monitoring means determining the status of a system, a process or an activity, by checking, supervising or critically observing.
The difference has practical consequences. Not everything that matters lends itself to a number: the progress of a server migration project, the outcome of site safety inspections or suppliers' compliance with contractual requirements can be monitored through a periodic check with a documented outcome. Other things, such as support response times or production scrap, are measured. A good system combines both approaches, choosing the one best suited to each process instead of forcing everything into a chart.
Measurable does not necessarily mean numerical
The "if practicable" qualifier in clause 6.2 is not an escape hatch to avoid measuring. The guidance for using the harmonized structure states that measurable does not mean quantified: an objective can have a qualitative outcome, even a simple yes/no, provided it is supported by appropriate evidence.
"Qualify all welders on the new procedure by June" is a measurable objective even without percentages: by June it is either done or not, and the certificates prove it. By contrast, "improve the quality culture" is not measurable until you translate it into something verifiable. "If practicable" covers cases where measuring achievement genuinely is not feasible, but an auditor will expect you to be able to explain why.
How do you set useful objectives for an SME?
A useful objective comes from a real problem, not from a downloaded template. For an SME, three to five system objectives a year are often enough.
The starting point is the policy: objectives must be its operational translation. If your policy says you focus on punctuality and on protecting customer data, the objectives must deal with deliveries and security, not with topics nobody chose. Then look at the risks and opportunities identified during planning, at the requirements of customers and interested parties, and at last year's results.
Starting from the policy and the risks
A good question for selecting objectives is: what would cost us most if it went wrong next year? A customer lost through delays, a data security incident, an injury, an environmental penalty. The objectives that answer that question are the ones management will genuinely commit to.
Objectives can work at different levels. Some are improvement objectives (reduce, increase, introduce), others are about maintenance (stay above a threshold already reached), others still are project-based (complete an activity by a date). Mixing them is normal. What matters is that each is assigned to the right function: the standard asks for objectives "at relevant functions and levels", so not just general company objectives, but departmental objectives too where needed.
The plan: what, resources, who, when, how it is evaluated
For each objective, clause 6.2 asks for five answers. Writing them in a simple table is the quickest way to make them verifiable and to avoid orphan objectives.
Take the objective "reduce returns caused by packaging defects". What will be done: review of the packaging specification, training for shipping operators, spot checks on outgoing parcels. Resources: two days of training, a new filler material. Who: the logistics manager. When: by the third quarter. How it is evaluated: monthly trend of packaging-related returns compared with the previous half-year. Five lines, and the objective becomes manageable and auditable.
How many KPIs do you need and how do you choose them?
You need a few indicators per process, chosen because someone uses them to decide. Our guide to the ISO 9001 quality management system suggests one to three indicators per core process: a good starting point for other standards too.
The selection criterion is not "what can we measure", but "what tells us whether the process is producing the expected result". A sales process can be tracked with the quote conversion rate and issuing times; production with scrap and yield; support with take-up and resolution times; information security with the timeliness of critical patches and the outcome of restore tests. An indicator that nobody ever discusses in meetings or in the review can be dropped without regret.
The indicator sheet: six fields that remove ambiguity
Every KPI should have a short indicator sheet. Six fields are enough, and they settle most disputes about the data.
Field | What to write | Example |
|---|---|---|
Definition | What it measures, in one sentence | Orders delivered by the confirmed date |
Formula | How it is calculated, numerator and denominator | On-time orders / orders delivered in the month |
Data source | Where it comes from | ERP, shipping reports |
Frequency | How often it is collected and analysed | Monthly collection, quarterly analysis |
Target and threshold | Expected value and alert level | Annual target; below threshold an analysis is opened |
Owner | Who collects it and who comments on it | Logistics manager |
The formula is the most underrated field. "On-time deliveries" calculated on the date requested by the customer or on the confirmed date give very different numbers. If you change the formula mid-year, the trend becomes unreadable. Write it once and keep it stable.
Outcome indicators and process indicators
Some indicators describe the final outcome, such as complaints, returns, incidents or injuries. They arrive late: by the time you see them, the problem has already happened. Others measure the activities that prevent that outcome, such as the percentage of incoming inspections carried out, training completed or successful backup checks.
A balanced system uses both. If you only track complaints, you find out about problems from your customers. If you only track activities, you risk measuring effort rather than effect. For each important objective, try to pair two indicators, one outcome and one process: the first tells you whether you are getting there, the second tells you why.
A concrete example: objectives and KPIs of a typical company
Let us take an IT services company with 35 people, certified to ISO 9001 and ISO/IEC 27001 with an integrated system. In its first year it had 28 indicators, gathered in a spreadsheet updated just before the audit.
During the review, management asked itself a simple question: which of these numbers changed a decision in the last year? The answer was just four. That led to a leaner system, built on four annual objectives and eight indicators in total.
Objective | Indicator | Frequency | Owner |
|---|---|---|---|
Improve project punctuality | Projects closed by the agreed date | Monthly | Delivery manager |
Reduce support response times | Tickets taken up within the SLA | Weekly | Help desk manager |
Strengthen service continuity | Successful restore tests from backup | Quarterly | IT manager |
Reduce human-factor errors | People trained on phishing and simulation results | Every six months | Security manager |
Alongside these, the company kept some process indicators read by individual managers, such as customer satisfaction after ticket closure and the evaluation of critical suppliers. The result was not "measuring less" but measuring with a purpose: every number has an owner who comments on it and a forum where it is discussed. At the next surveillance audit, the auditor sampled two objectives and found plan, data and decisions linked, with nothing to reconstruct.
How to read the data: analysis, evaluation and review
Data collected but not read does not meet clause 9.1. The standard also asks you to establish when to analyse and evaluate results, not just when to collect them.
A typical cadence for an SME is monthly collection, a quarterly reading with process owners and an annual summary in the management review. The harmonized structure lists performance information among the management review inputs, including trends in nonconformities and corrective actions, monitoring and measurement results and audit results.
Trends, not snapshots
A single value says little. The trend over time says much more: a complaint rate that is stable but above target tells a different story from one that is steadily improving, even if this month's value is the same.
That is why it pays to present each indicator with at least twelve months of history, the target highlighted and a two-line comment from the owner: what happened, why, what is being done. That comment is the part an auditor reads most carefully, because it shows the data has been analysed, not just copied. Avoid changing formulas, sources or scope without noting it: a sudden jump in the chart with no explanation raises questions.
From data to decision
Analysis exists to support decisions. When an indicator drops below threshold there are three paths: a corrective action if the problem is systemic, an adjustment to the plan if the objective is still valid but the actions are not enough, or a revision of the target if it was unrealistic or the context has changed.
All three are legitimate, provided they are reasoned and recorded. The cycle is that of PDCA and continual improvement: you plan the objective, carry out the actions, check with the indicators and decide how to proceed. If an indicator stays green for years without effort, ask yourself whether it still makes sense as an objective or whether it has become a simple maintenance check.
What does the auditor look at on objectives and indicators?
The auditor looks for the thread linking policy, objectives, plan, data and decisions. The number of charts does not matter; the consistency between these elements does.
During the certification audit and surveillance audits, whoever assesses the system usually samples a few objectives and follows their path. They ask who the owner is and interview them. They check that the planned actions have been carried out and that there is evidence. They verify that results were analysed at the set intervals and that the review took the resulting decisions. You should run the same check yourself beforehand, through the internal audit.
The most common audit questions
Some questions come up almost every time: how were these indicators chosen? Who collects the data and from which source? What was done when the indicator was below threshold? Why does last year's objective no longer appear? Do the staff involved know the objectives of their department?
The last question is linked to the communication requirement. Not every operator needs to recite the policy, but people working on a process should know which objective concerns them and how they contribute. An objective known only to the quality manager is a weak signal for the auditor, and often for results too.
The evidence to keep ready
The evidence required is limited and precise: the document with the objectives and their plans, monitoring and measurement data with their source, periodic analyses, review minutes and any open corrective actions. Keeping them in a single place saves hours in the run-up to the audit.
This is where working with Complaion changes the routine. Your dedicated Lead Auditor helps you choose objectives and indicators suited to your company and to the standards within your scope, while the platform collects the evidence, manages the documents, keeps the schedule of data collection and analyses, and prepares the material for the audit. When the surveillance audit comes round, plan, data and decisions are already linked.
What are the most common mistakes in measuring a management system?
The recurring mistakes are few and almost always the same. Recognising them in advance prevents nonconformities and, above all, hours spent producing useless numbers.
Too many indicators: dozens of KPIs copied from a template, none of them discussed in the review.
Objectives without a plan: a target on paper, but no action, resource, owner or deadline.
Ambiguous formulas, or formulas changed along the way, making the trend unreadable.
Data gathered only before the audit, reconstructed after the fact and therefore not very credible.
Targets always met without effort, or on the contrary unrealistic and ignored by everyone.
No reaction to deviations: indicators below threshold for months with no analysis or action.
The common thread is one: the measurement system is treated as a formality for the auditor rather than as a tool for whoever runs the company. When management genuinely uses those numbers to decide, most of these mistakes disappear on their own. If you manage several standards, think in integrated terms too: many indicators, such as training, suppliers and complaints, serve several systems at once.
How Complaion helps you measure your management system
A few clear objectives, indicators with a precise sheet and a reading cadence that is respected: that is what makes a management system useful for the company and solid at audit. Complaion supports you with a dedicated Lead Auditor who follows your company, proposes the route best suited to your needs and helps you set objectives and KPIs consistent with your policy and with the standards you want to certify or maintain, from ISO 9001 to ISO/IEC 27001. The platform collects the evidence, manages the documents, keeps the schedule of data collection, analyses and reviews, and prepares the audit.
We already work with more than 1,000 clients. You can see all the standards we cover on our certifications and regulations page. If you want to work out how to set up the measurement system for your company, get in touch for a consultation and a tailored quote.
Frequently asked questions on ISO objectives and indicators
How many KPIs should an ISO management system have?
No ISO management system standard sets a minimum or maximum number of indicators. The harmonized structure asks you to determine what to monitor and measure, with which methods and how often. For an SME, one to three indicators per core process are often enough. What matters is that each indicator is used to decide, not how many there are.
Do ISO objectives always have to be numerical?
No. Clause 6.2 requires objectives to be measurable "if practicable", and ISO's guidance on the harmonized structure clarifies that measurable does not necessarily mean quantified. An objective can have a qualitative outcome, even yes/no, provided it is supported by appropriate evidence. An auditor will still expect to understand how you verify achievement.
What is the difference between an objective and an indicator?
The objective is the result you want to achieve, for example delivering to customers on time. The indicator is the quantity you use to check it, such as the percentage of orders delivered by the confirmed date. The target is the value to be reached by a given date. Keeping these three elements separate makes the system clearer for the people doing the work and for auditors.
How often should indicators be analysed?
The standard does not set a frequency: it asks you to establish when monitoring is performed and when results are analysed and evaluated. Many SMEs collect data monthly, analyse it quarterly with process owners and summarise it in the management review. What matters is to respect the cadence you have set and keep a record of it.
What happens if an objective is not achieved?
Missing an objective is not in itself a nonconformity. It becomes a problem if you have not analysed the deviation and taken decisions: corrective actions, a revised plan or a revised target. The auditor looks above all at how you reacted to the result. An objective that was missed but properly analysed shows a system that works.
Do objectives need to be documented?
Yes. The harmonized structure requires objectives to be available as documented information and requires documented information as evidence of monitoring and measurement results. No particular format is needed: a document or register showing objectives, plans and results is enough, kept up to date and accessible to those who need it.
Do several ISO standards need separate indicators?
Not necessarily. Standards that follow the harmonized structure share the same clauses on objectives and measurement, so in an integrated system many indicators can serve several standards at once. Each discipline still has its own specific objectives, for example on the environment, information security or occupational health and safety. A single integrated dashboard avoids duplication.
