ISO 9001 / AS9100 Clause 5, Leadership: The Clause You Can't Delegate

Last time we walked the PDCA loop and worked through Clause 4, where the standard makes you define the problem before it lets you solve it. Now we move to ISO 9001 & AS9100 Clause 5, and to the part of the standard that most reliably separates companies with a real quality management system from companies with a certificate.

Clause 5 is short. It's also the clause where implementations most often fail, because it's the one requirement top management can't hand to the quality manager and walk away from. This was very intentional.

A Note on Timing

ISO 9001:2026 is scheduled for publication on September 16th, and Clause 5 is where the most talked-about change shows up: top management will be explicitly required to promote a quality culture and ethical behavior, with new guidance in Annex A on how that promotion can be demonstrated. A matching awareness requirement appears in Clause 7.3.

I'm currently co-authoring a white paper that goes deep on quality culture and ethics, releasing in early September, but given the timing of this article relative to release of the revision, thought it at least worth briefly discussing. What's worth flagging in this post is context that often gets lost in the "what's new in 2026" coverage:

AS9100D got there a decade earlier. Since the 2016 revision, AS9100 has carried ethical behavior as a stated requirement in the awareness clause (7.3), where personnel must be aware of the importance of ethical behavior, and in the requirements flowed down to external providers (8.4.3). The 2026 ISO revision is, in part, the rest of the world catching up to a precedent aerospace set in 2016.

More importantly: none of this is actually new. Quality culture and ethical behavior are being codified now, but they've been load-bearing assumptions of these standards since the beginning. Every clause in the standard quietly assumes that people will report what they actually find, that records will reflect what actually happened, and that leadership will act on bad news rather than shoot the messenger. Strip those assumptions out and the whole structure is decorative.

Culture and ethics have always been observable through their symptoms.  Nonconformities written against Clause 5 are often indicative of systemic weaknesses that span multiple functions.

• Weak leadership shows up as management reviews that are a formality, corrective action programs that close findings without changing anything, and quality objectives that get missed year after year with no consequence.

• Poor ethics shows up as documentation that doesn't match reality:  the inspection record signed before the inspection, the training matrix showing competencies nobody has, the procedure describing a process the floor abandoned two years ago.

The 2026 revision gives auditors a more direct way to name what they were already seeing, and it also challenges certificate holders to put it in plain view.  With that framing, let's take Clause 5 in order.

5.1.1 Leadership and Commitment

What's expected: Top management must demonstrate leadership and commitment with respect to the QMS. The standard lists specific obligations: taking accountability for the effectiveness of the QMS, ensuring the quality policy and objectives are established and compatible with the strategic direction of the business, ensuring the QMS requirements are integrated into business processes, promoting the process approach and risk-based thinking, ensuring resources are available, communicating the importance of effective quality management, engaging and supporting people, and supporting other managers in demonstrating leadership in their areas.

Note the key word in the first item: accountability. Everywhere else, the standard says "ensure," which permits delegation. For the effectiveness of the QMS, it says top management shall take accountability. You can delegate the work; you cannot delegate the ownership.

What conformance actually looks like: This is a requirement demonstrated through evidence of behavior, not through a document. An auditor establishes conformance by talking to people and looking at records that show where leadership actually spends its attention: management review minutes with real decisions and resource commitments in them; quality objectives that appear in the same conversations as revenue and delivery objectives; evidence that the president knows the company's scrap rate and on-time delivery numbers without having to look them up. Where it fails is equally recognizable:  the shop where the quality manager is the only person who can speak to the QMS, and everyone above them refers you back down.

A useful way to think about it: leadership commitment is like a load-bearing wall. You can't tell it's doing anything by looking at it, but remove it and you find out immediately which parts of the building were depending on it. Every other clause in the standard is resting on this one.

Why it matters to the customer: Your customer never sees your management review minutes, but they feel the results of them constantly. When a customer complaint reaches the top of your organization, gets resources assigned, and produces a change, that customer experiences a supplier who fixed something. When the same complaint dies in a corrective action queue because nobody senior ever asked about it, they experience a supplier with a recurring problem. Repeat customers are, in large part, a leadership metric.

Where the operational payoff is: Leadership engagement is what makes the QMS worth what you spend on it. A quality system without leadership behind it becomes a parallel bureaucracy:  real work happens one way, the documented system describes another, and you pay for both. When leadership actually integrates QMS requirements into how the business runs, you stop maintaining two systems and start running one. 

5.1.2 Customer Focus

What's expected: Top management must demonstrate leadership with respect to customer focus specifically: ensuring customer and applicable statutory/regulatory requirements are determined, understood, and consistently met; that risks and opportunities affecting conformity and the ability to enhance customer satisfaction are addressed; and that the focus on enhancing customer satisfaction is maintained. AS9100D adds an explicit expectation that product and service conformity and on-time delivery performance are measured and that appropriate action is taken when planned results aren't achieved.

What conformance actually looks like: Two hard numbers, tracked, trended, and acted on: quality performance and on-time delivery. In aerospace your customers are almost certainly scoring you on both already, whether or not you're scoring yourself. Conformance means you know your numbers before your customer tells you them, and you can show what you did the last time a trend went the wrong direction.

"Customer focus" as an auditable requirement is the opposite of a slogan. A banner in the lobby that says the customer comes first is evidence of nothing. A trend chart showing OTD dropped to 88% in Q1, a documented root cause pointing at a planning bottleneck, and a corrective action that brought it back to 96%; that's customer focus, and it takes an auditor about four minutes to verify.

Why it matters to the customer: Customers rarely leave over a single defect. They leave over the sense that a supplier isn't paying attention. Measuring conformity and OTD, and visibly responding when they slip, is how a supplier demonstrates attention in a way the customer can actually observe. It's also how you stay off a corrective action request or a probation list, because you caught it first.

Where the operational payoff is: Every organization I've worked with that started genuinely tracking OTD found the same thing: the delivery problem wasn't in production. It was in quoting, or planning, or purchasing lead times, or a bottleneck at final inspection. The metric that looks like a customer-satisfaction measure turns out to be the fastest diagnostic you have for where your operation is actually constrained.

5.2 Quality Policy

What's expected: Top management must establish, implement, and maintain a quality policy that's appropriate to the purpose and context of the organization, supports its strategic direction, provides a framework for setting quality objectives, and includes commitments to satisfy applicable requirements and to continual improvement. It has to be documented, communicated and understood within the organization, and available to interested parties as appropriate.

What conformance actually looks like: The documentation and communication half of this requirement is generally pretty easy to hit. The understood half is where challenges may lie. The standard doesn't ask whether the policy exists; it asks whether it's understood by the people doing the work. Auditors test this by asking operators about it, and the answer that satisfies an auditor isn't recitation. An operator who says "we're not supposed to pass anything we're not sure about, and I know who to go to if I'm not sure" has demonstrated understanding better than one who quotes the policy verbatim from a laminated card.

This points at what a quality policy is actually for. Think of it like a company's rules of engagement: not a description of every situation, but a clear statement of what to do when the situation isn't covered. Its job is to tell someone what the right call is at 4:45 on a Friday when the person who normally decides has gone home. A policy that's too generic to answer that question isn't doing any work.

Why it matters to the customer: The customer inherits the consequences of every judgment call made on your floor. A policy that genuinely guides those calls is what keeps the answer consistent whether the part runs on first shift or third, in a slow month or during a crunch. Consistency is what customers are actually buying from a supplier.

Where the operational payoff is: A real policy reduces escalations. When frontline people know where the line is, fewer decisions have to climb the org chart, and the ones that do climb are the ones that genuinely need to. That's management time recovered, and faster decisions on the floor.

5.3 Organizational Roles, Responsibilities, and Authorities

What's expected: Top management must assign and communicate responsibilities and authorities for relevant roles.  This includes responsibility for ensuring the QMS conforms to the standard, that processes deliver their intended outputs, that QMS performance and improvement opportunities are reported to top management, that customer focus is promoted throughout the organization, and that QMS integrity is maintained when changes are made and implemented.

AS9100D adds a requirement that ISO 9001 removed in 2015: a member of management must be appointed with responsibility and authority for the QMS who, irrespective of other responsibilities, has organizational freedom and unrestricted access to top management to resolve quality issues.

What conformance actually looks like: This is where the independence principle from the previous post gets written into the standard as a hard requirement. "Organizational freedom" and "unrestricted access to top management" mean the person responsible for quality can raise a problem without routing it through the person whose numbers the problem would hurt. In practice, an auditor will look at your org chart, then ask your quality lead a simple question: what happens when you and the production manager disagree about whether a part ships? If the answer involves the production manager having the final say, you have a finding, regardless of what the org chart shows.

Conformance also means the assignments are actually communicated. A responsibility matrix nobody has seen isn't an assignment, it's a document. The test is whether the people holding the responsibilities know they hold them.

Why it matters to the customer: The only thing more disheartening than an escape caused by a missed nonconformance is an escape that your team chose to pass on to a customer.  It can be a material review board with undue influence, a decision to make an exception “just this one time,” or a decision to “keep the parts moving and deal with the paperwork later.” 

As a side note, Clause 8.7.1.d gives the option to deal with nonconforming outputs by obtaining authorization for acceptance under concession, and AS9100 adds to this with requirements that this concession is made by a relevant authority, and, when applicable, by the customer.  The difference is knowing that "asking for forgiveness instead of permission" is never an acceptable solution, especially when it comes to safety-critical aerospace components.

Where the operational payoff is: Ambiguous authority is expensive in a way that never shows up as a line item. It shows up as decisions that sit, as work that waits for someone to confirm they're allowed to proceed, as two people doing the same review because neither was sure it was theirs, and as the meeting called to decide who decides. Clear, communicated authority is one of the cheapest speed improvements available to most shops, and one of the few requirements in the standard that pays back before you're even certified.

ISO 9001 / AS9100 Clause 5: Pulling It Together

Clause 5 asks a question that no amount of documentation can answer on its own: does leadership actually own this?

The 2026 revision makes part of that question explicit by naming quality culture and ethical behavior as leadership obligations. But the standard has always been able to detect the answer, because culture and ethics leave fingerprints. Management reviews that decide nothing. Corrective actions that correct nothing. Objectives missed without consequence. Records that describe a company that doesn't exist. Those aren't culture problems hiding behind conformance problems; they are the conformance problems, and they always were.

The good news is that the reverse is equally observable. A management review where leadership pushes back on a weak root cause. A corrective action that changed a process rather than retraining an operator. A record that matches the floor exactly, on an ordinary Tuesday, on third shift, with nobody watching. That's a company where the certificate describes something real, and it's the same company that can take on harder work with confidence.

What's Next

Next up: Clause 6, Planning — risk and opportunity, quality objectives, and planning changes. It's also a clause the 2026 revision restructures, so we'll cover what's changing along with what's expected today.