The ISO management system lead: role, competences and time required

Who keeps the ISO system running in an SME? Often someone who already has another job. It is the technical office employee who "also looks after quality", the purchasing manager who has handled ISO 9001 since the company was certified, the office manager who inherited ISO 27001 because they are "good with computers". The management system lead is almost always a role added on top of another.

In this guide we look at what ISO standards really require of this role, why the old "management representative" is no longer mandatory, what the person running the system actually has to do and which competences they need. We will also talk about time, but without made-up numbers: we show you the factors that increase or reduce the workload, so you can estimate it for your own company. The common thread is simple: the lead coordinates the system, not owns it. If they become the only person who knows where the documents are and when things expire, the system stops with them.

Who is the management system lead?

The management system lead is the person, or group, to whom top management assigns two tasks: keeping the system conforming to the requirements of the standard and reporting to top management on its performance. This is set out in clause 5.3, common to all ISO management system standards.

The clause is the same in ISO 9001, ISO 14001, ISO 27001, ISO 45001 and the other management system standards because of the harmonized structure, the common text ISO requires all of them to use (in the ISO Directives it is Annex SL, Appendix 2). UNI, the Italian standards body, has published an Italian translation with guidance for use: that is the source we start from. Each standard then adds its own subject area and, where needed, specific requirements on the roles in its discipline.

What clause 5.3 says

Clause 5.3, "Roles, responsibilities and authorities", asks top management for two things. The first is general: to ensure that the responsibilities and authorities for relevant roles are assigned and communicated within the organization. This applies to every role that matters in the system, not just to the lead.

The second is more specific. Top management must assign the responsibility and authority for ensuring that the system conforms to the requirements of the standard and for reporting on the performance of the system to top management. Note two details. The standard speaks of responsibility and authority, not just tasks: whoever runs the system must be able to ask, chase and stop things, not just collect forms. And the harmonized structure guidance specifies that these tasks can be assigned to one individual, several individuals or a team.

Quality manager, QMS lead, ISO contact: the names vary

The standard does not name the role, and every company calls it something different. In quality you often hear quality manager or QMS manager, in information security information security management system manager, in an integrated system integrated system manager.

The name matters little. What matters is that the organization chart or an appointment signed by top management states who holds the two tasks of clause 5.3 and with what authority: the auditor will ask, and "a bit of everyone" is not an answer. If you need an overview of how a quality system is built, you will find it in the guide to the ISO 9001 quality management system.

Does the management representative still exist?

No, not as a requirement. Up to the 2008 edition, ISO 9001 required the appointment of a management representative; the 2015 edition removed this requirement, and the harmonized structure common to all standards does not include it.

This is confirmed by the ISO 9001 Auditing Practices Group, the group of ISO/TC 176 and IAF experts that publishes guidance for auditors. In its guidance on auditing top management it states that the management representative position was required by editions earlier than 2015. If the organization decides not to retain it, the auditor should look carefully at how the responsibilities and authorities historically associated with that role have been allocated.

What really changed

The change is not "less work", it is more responsibility for top management. With an appointed representative, it was easy for top management to hand the whole system over to that person in practice. Today clause 5.1 asks top management to demonstrate leadership and commitment personally, and clause 5.3 asks it to assign the tasks explicitly.

In practice the role is still needed: someone has to coordinate documents, audits, corrective actions and the review. The difference is that today you can organize it as you see fit. You can keep a single person, split the tasks among several people or give them to a small committee. What you cannot do is leave them without a clear owner.

You can keep the title if it helps

Nothing stops you from continuing to call someone "management representative". What matters is that the title matches real responsibilities and authorities, written down and communicated.

The risk is a legacy title held by someone who has changed role or no longer has the time. The auditor does not challenge the name, they challenge the gap between paper and reality.

What stays with top management and what can be delegated?

Top management keeps ultimate accountability for the effectiveness of the system; execution and coordination are delegated to the lead. The harmonized structure says so explicitly in its guidance on clause 5.1.

Clause 5.1 lists what top management must ensure: policy and objectives compatible with the strategy, integration of requirements into business processes, available resources, communicating the importance of the system, achieving intended results, supporting people, continual improvement. The harmonized structure guidance specifies that "ensuring" means top management does not have to do everything itself: it can delegate the authority to do so, but it remains accountable for the actions being carried out.

Where the line falls in practice

In concrete terms, the system lead can draft the policy, but top management establishes it. They can propose objectives, but top management sets them and provides the resources to achieve them. They can gather all the data for the review, but top management conducts the review, and the decisions that come out of it are its own.

The management review is exactly where the two roles meet: the lead brings the data, top management decides. To find out more about how to prepare it and what it must contain, read the guide to the ISO management review.

What does the management system lead actually do?

The management system lead sets the pace of the system: they make sure documents, checks, audits, actions and reviews happen when they should and leave evidence. They do not have to do everything, they have to know where everything stands.

Their recurring activities fall into five areas. The first is document control: keeping procedures, instructions and records up to date, with the right versions in the right places. The second is the schedule: audits, reviews, calibrations, qualification renewals, supplier evaluations, legal obligations. The third is coordinating nonconformities and corrective actions, checking that they are closed and that they work. The fourth is reporting to top management on performance. The fifth is the relationship with the certification body: planning external audits, preparing the company, handling findings.

A typical year, month by month

Take a 60-person company that makes plastic components and is certified to ISO 9001. The system lead is Giulia, who is also the purchasing manager. Her year is marked by a few fixed milestones: the internal audit programme at the start of the year, the internal audits in the following months, the management review before the external audit, the surveillance audit, closing the findings.

Between milestones there is the ongoing work: a procedure to update, a complaint that opens a nonconformity, a supplier to qualify, a licence about to expire. Without a schedule, Giulia discovers everything at once in the month before the audit, and that is when the role becomes unsustainable.

What they should not do

The lead should not write all the procedures alone: the people working in the processes know how they work, the lead makes them consistent. They should not fill in, on behalf of departments, the records that belong to them. And they should not check their own work.

The last point concerns internal audit. Clause 9.2 requires auditors to be selected and audits conducted so as to ensure objectivity and impartiality. The lead can coordinate the audit programme, but the activities they manage directly, such as document control or corrective action management, are better checked by someone else. We cover this in detail in the guide to ISO internal audit.

What competences does the management system lead need?

The lead needs three groups of competences: knowledge of the standard, knowledge of the company's processes and the ability to get people moving. The third is the one most often missing, and the one that makes the difference.

The lead also falls under clause 7.2: the organization must determine the competence needed by people doing work that affects the performance of the system, ensure they are competent on the basis of education, training or experience, and retain evidence. The lead's role affects system performance more than any other, so their competences must be defined and demonstrated like those of the other key roles.

Technical competences

On the technical side you need knowledge of the requirements of the standard or standards applied, the ability to read a process and find its control points, document management and knowledge of auditing principles. For information security, the environment or health and safety you also need subject-matter knowledge: you cannot run an ISO 27001 system without understanding cyber risks, nor an ISO 45001 system without knowing safety legislation. You do not need to be an expert in everything: you need to know whom to call, for example the IT manager or the health and safety officer.

Organizational competences and authority

On the organizational side you need planning, the ability to prioritise and to talk to top management in terms of risks and results, not requirements. A lead who walks into a meeting with a list of forms to fill in loses attention within two minutes; one who brings three figures and a decision to be made gets listened to.

Authority is also needed, and it is a delicate point. If the lead is a junior employee who has to chase department heads, every request becomes a negotiation. That is why clause 5.3 speaks of authority as well as responsibility: top management must make it visible, for example with an internal announcement or by presenting the role at meetings with function heads.

How to demonstrate the lead's competence

The evidence is the same you use for other roles: written role requirements, training on the standard, documented experience, any internal auditor qualifications. The results are good evidence too: a system with actions closed on time and complete reviews shows competence better than a certificate. For a practical method to set this up, see the guide on competence, training and awareness.

How much time does running the system take?

There is no number of hours that applies to everyone, and the standards give none. Clause 7.1 requires the organization to determine and provide the resources needed for the system, and the harmonized structure guidance explicitly lists time among the resources to consider.

Time depends on a few factors you can assess for your company. It is better to estimate it from these than from a figure heard somewhere.

Peaks matter more than the average

The workload is not evenly spread. There are peak weeks before external audits, during internal audits and around the review, and quieter months. The problem for SMEs is rarely the annual total: it is that the peaks fall on someone who also has another job with its own deadlines.

The useful question for top management is not "how many hours does it take?", but "what do we hand to others in the peak weeks?".

More standards does not mean multiplying the work

If you have, or plan to add, a second standard, remember that the harmonized structure clauses are shared. Review, internal audit, corrective actions, competence and document control can be a single process for all. Running three separate systems triples the meetings; integrating them does not. We cover this in the guide to the integrated management system.

Internal, external or shared: how should you organize the role?

In an SME three solutions work: one internal person part-time, a small internal team with split tasks, or an internal person supported by an experienced external expert. The choice depends on size, number of standards and competences already in house.

One internal person part-time is the simplest solution in small companies. It works if the time spent on the system is recognised and protected, and if someone stands in when they are away. An internal team works well in integrated systems: for example, one person coordinates and handles quality, the IT manager handles information security, the health and safety officer handles occupational health and safety.

External support does not replace the internal role

Supporting the lead with an external expert is useful above all for activities that require auditor competence or independence, such as internal audit and preparation for certification audits. But clause 5.3 asks top management to assign responsibilities and authorities within the organization: you still need an internal person who knows the company, makes operational decisions and answers to top management.

External support that does everything, with no internal contact, produces a system the company does not feel is its own, and the auditor notices when interviewing people.

How do you stop the lead becoming a bottleneck?

The lead becomes a bottleneck when everything has to go through them to exist. The solution is to distribute ownership of processes and keep only coordination at the centre.

Back to Giulia. Every complaint, every nonconformity, every procedure change went across her desk; when she went on holiday two weeks before the surveillance audit, nobody knew where the calibration register was. The problem was not Giulia: it was a system built around a single person.

Five practical moves

A few moves are enough to avoid it, and they work in almost every SME.

• Appoint a process owner for each process, responsible for their own records and corrective actions.

• Write a simple matrix of who does, who decides and who is informed for the main system activities.

• Keep a shared schedule, visible to top management and process owners, not a file on the lead's computer.

• Collect evidence where the work happens, in the same place for everyone, instead of emailing it to the lead.

• Name a deputy who knows the status of the system and can handle routine matters in the lead's absence.

The warning sign

There is a simple sign that the role is becoming a bottleneck: ask three people in different departments where they find the current procedure for their process and who closes their nonconformities. If they all answer "I ask the quality manager", the system depends on one person. It is the same test the auditor will run, interviewing people on site.

What are the most common mistakes about the system lead?

The most frequent mistakes come from an appointment made out of necessity, without defining the time, authority and boundaries of the role. They are also mistakes the auditor spots easily.

The first is the appointment on paper only: a name on the organization chart, no internal communication, no recognised authority. The second is the do-everything lead, who writes the procedures, fills in the records and audits the processes they manage themselves, with an impartiality problem. The third is absent top management: the review is prepared and "signed" without a real discussion, and no decisions are made.

Then there are quieter mistakes: no deputy, the lead's competences never defined, time for the system never discussed and always behind the "real" work. Almost all are solved with a written and communicated appointment, a shared schedule and a review in which top management really decides.

How Complaion lightens the load on the management system lead

With Complaion the system lead is no longer on their own. A dedicated Lead Auditor works with your company: they assess the context, propose the path best suited to your needs on one or more standards and conduct the internal audit. If you take the Complaion path, you do the internal audit with us, and the Lead Auditor does not check their own operational work: the impartiality required by clause 9.2 is respected without taking time away from your people.

The platform gathers evidence and documents in one place, keeps the schedule of audits, reviews and renewals, and prepares the audit with everything already in order. Deadlines are visible to everyone, evidence comes from the people working in the processes and the lead coordinates instead of chasing. The Complaion path avoids nonconformities and takes you to the external audit with a 100% success rate. More than 1,000 clients have already chosen this model. If you want to understand how to organize the role in your company, contact us for an initial assessment and a tailored quote.

Frequently asked questions about the ISO management system lead

Is a management representative mandatory in ISO 9001?

No. It was required by editions of ISO 9001 earlier than 2015, but the 2015 edition no longer includes it. Today clause 5.3 asks top management to assign responsibility and authority for keeping the system conforming and reporting on its performance, without imposing a title. You can keep the role if it is useful, as long as it has real, communicated responsibilities.

Can the business owner be the management system lead?

Yes, the standard does not prohibit it, and it often happens in very small companies. In that case, however, you need to organize internal audit carefully, because the owner should not check the activities they manage directly. Time also needs extra attention: if the system depends on someone who already carries the whole company, it risks always being the last priority.

Can the role be given to an external person?

External support can help a great deal, especially for internal audits and preparation for certification audits. However, clause 5.3 requires responsibility and authority to be assigned within the organization, so you still need an internal contact person who knows the company and answers to top management. In an SME an effective combination is an internal person supported by an expert.

How many hours a week does running an ISO system take?

The standards give no number of hours, and no figure applies to everyone. The workload depends on the number of standards, size and sites, system maturity, stage of the certification cycle, process owner involvement and the tools used. More than totals, what matters are the peaks before audits: that is when you need to plan who takes other work off the lead.

What competences should a quality manager have?

Knowledge of the requirements of the standard, knowledge of the company's processes, document management and auditing principles. For standards such as ISO 27001 or ISO 45001 subject-matter knowledge is also needed. Organizational competences count a lot: planning, prioritising, talking to top management in terms of risks and results. As for every key role, competences must be defined and documented under clause 7.2.

Can the system lead conduct the internal audit?

They can coordinate the audit programme, but clause 9.2 requires auditors to be selected so as to ensure objectivity and impartiality. For this reason they should not check the activities they manage directly, such as document control or corrective actions. A common solution is to entrust it to a qualified auditor independent of the processes audited, who also brings the perspective of someone who knows certification audits.

With several standards, do you need a lead for each one?

No, not necessarily. ISO management system standards share the same harmonized structure, so review, internal audit, corrective actions and document control can be managed as a single process. An integrated system manager who coordinates often works well, supported by contacts with the specific competences, for example the IT manager for information security.