Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    Quality Policy

    Also known as: Quality policy statement

    Definition

    A statement of intention and direction about quality, issued by top management, that frames quality objectives and is communicated, understood and reviewed.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/quality-policy

    Scope: A policy is not a quality plan or a procedure. The wording here is from WHO and FDA texts for medicines and from ISO/TC 176 audit guidance, and ISO 9001 text is not reproduced.

    Example for your evaluation: Link the policy revision to its objectives, the briefing that reached staff and the management review that last confirmed or changed it.

    Sources checked: . Examples are editorial illustrations.

    What WHO, FDA, ISO/TC 176 and EPA say about a quality policy and quality plans

    On this page a quality policy is the statement of overall intention and direction about quality that top management formally expresses and authorises. WHO's main principles of good manufacturing practice (Technical Report Series 986, Annex 2, 2014) use those words and say quality management is the aspect of the management function that determines and implements the quality policy. WHO adds that senior management has the ultimate responsibility for an effective pharmaceutical quality system, that the system should be defined and documented in a quality manual or equivalent. FDA's 2006 glossary describes a quality policy as a statement of intentions and direction issued by the highest level of the organisation related to satisfying customer needs, similar to a strategic direction. This is general information, not legal or certification advice.

    FDA's guidance is nonbinding and written for drug manufacturers. It says senior management should develop a quality policy that aligns with the organisation's mission, commit to meeting requirements and improving the quality system, and propose objectives to fulfil the policy. To make the policy relevant it must be communicated to and understood by personnel and contractors, where applicable, and revised as needed. Objectives come from a formal quality planning process, and FDA's glossary calls a quality plan the documented result of quality planning that is disseminated to all relevant levels of the organisation.

    ISO/TC 176 and the International Accreditation Forum issued auditing guidance on policy, objectives and management review, dated 13 January 2016. ISO's own record describes ISO 9001:2026 as the sixth and current edition, published on 16 September 2026, so check the paper against the edition you work to. It says a quality policy and its deployment can be judged only from the overall audit results. It points auditors to interviews with top management, management review records, whether the policy has been translated into understandable words at all levels with matching objectives, and evidence of dissemination. Auditors should check that people understand how the policy relates to their own activity, whatever words they use, and should not ask them to recite it. The committee site says a third party manages its content, and the paper says it was not endorsed by ISO, ISO/TC 176 or IAF. This page does not restate the wording of ISO 9001, which is a paid standard.

    A quality plan means something different from a policy. ISO 10005:2018, which ISO's catalogue lists as confirmed in 2023, gives guidelines for establishing, reviewing, accepting, applying and revising quality plans for any process, product, service, project or contract, whether or not the organisation has an ISO 9001 system. It is guidance, not requirements, and is not a guide to planning a quality management system's development. EPA uses two documents. A quality management plan describes a quality programme's structure, responsibilities, lines of authority and interfaces, and EPA organisations must write one. A quality assurance project plan sets out the QA and QC requirements for a single project, and information is collected under the approved project plan.

    Sources opened :

    What a quality policy record holds in software

    • The text of the policy, its revision, the date it took effect and the member of top management who approved it.
    • The quality objectives it supports, each with an owner, a measure and a target date, linked to the policy revision.
    • How and when it was communicated: the groups reached, the date, the method and, for contractors, the evidence that they received it.
    • Records of understanding, such as briefing attendance or interview notes, kept as evidence of awareness and not as recitation.
    • Each management review that considered the policy, with the decision to keep, change or withdraw it.
    • The quality manual, quality plans or project plans that put the policy into practice, linked to it.

    Quality policy, quality objectives, quality manual and quality plan

    The sources keep these apart. The policy is the statement of intention and direction. FDA's glossary defines quality objectives as specific measurable activities or processes that meet the intentions and direction in the policy, and the ISO/TC 176 paper says objectives must be measurable and verifiable though not necessarily quantified, with no specified way of documenting them. A quality manual or equivalent, in WHO's text, describes the quality management system including management responsibilities. A quality plan is planning for a specific case: FDA calls it the documented result of quality planning, and ISO 10005 applies it to a process, product, service, project or contract. A policy is not a procedure, and a policy statement alone is not evidence that people work to it.

    A hypothetical example: a policy that staff could not connect to their work

    Everything in this case is invented and describes no real company. A testing laboratory with 30 staff has a two-sentence quality policy approved by its managing director. At an internal audit the auditor does not ask anyone to recite it. Instead the auditor asks eight staff what in their day relates to it. Five describe something concrete, such as repeating a result that looked doubtful, and three cannot, so 3 of 8, or 37.5%, could not link it to their work.

    The audit report passes the finding to the January management review. The review keeps the wording of the policy and adds one objective: report 90% of results within 5 working days. The managers brief the three teams at shift start and record who attended. In the third quarter the laboratory issued 180 reports, and 171 were on time, which is 95%. A new client contract of 400 samples also gets its own quality plan, listing who does each step and what resources it needs. The plan sits under the policy and does not replace it. The next review minutes record that the policy was considered again and confirmed.

    Common misunderstandings about a quality policy

    • A quality policy is not a slogan on a wall. FDA says it must be communicated to and understood by personnel and contractors, and the ISO/TC 176 paper asks auditors for evidence that people understand how it relates to their work.
    • Staff are not expected to recite it. The ISO/TC 176 paper says not to ask people to recite it and to accept their own words.
    • It is not written once and filed. FDA says it is revised as needed, and the committee paper lists changes to the quality policy among management review outputs.
    • A policy is not a quality plan. FDA and ISO 10005 treat a plan as documented planning for a specific case, and a policy as direction from the top of the organisation.
    • The policy does not belong to the quality department. WHO and FDA place its issue with top or senior management.
    • This page does not say what ISO 9001 requires a policy to contain, because the paid standard was not read.

    How a quality policy relates to other glossary terms

    A policy is the top of a chain that runs through the system to individual checks. These terms sit along it.

    • QMS: the system of processes and records through which the policy is put into practice.
    • ISO 9001: the quality management system standard whose audits look at how a policy is deployed.
    • Management review: where top management considers whether the policy and objectives are still appropriate.
    • Quality control: the checks that show whether requirements behind the policy are met in practice.
    • SOP: the written procedure that turns a policy commitment into a task.

    Records and evidence that usually exist for a quality policy

    • The approved policy text with revision, effective date and approver.
    • Quality objectives linked to the policy, with owners, measures and results.
    • Communication records: briefings, notices and contractor acknowledgements, with dates.
    • Audit notes showing interviews about understanding, kept without any recitation test.
    • Management review minutes recording that the policy was considered and the decision taken.
    • The quality manual or equivalent, and the quality plans issued for specific cases.

    What a software tool needs to capture for a quality policy

    • Versioned policy text with approver and effective date, and superseded versions that stay readable.
    • Objectives held as linked records with an owner, a measure and a result, tied to the policy revision in force.
    • Distribution records showing who was reached and when, including contractors, where they apply.
    • A way to record understanding that is not a recitation test, such as briefing attendance or interview notes.
    • A link from each management review to the policy decision it took.
    • Quality plans held as records that reference the policy and the case they cover.
    • A history of changes that cannot be silently edited.

    Catalog profiles documenting policy management records

    Listed profiles meet the policy management rule used by the policy management software guide. That rule does not show that a product links a policy to objectives, management reviews or quality plans, which should be tested with your own records.

    Same rule for every product: tagged “Policy Management”, with a sourced policy management capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Ordered by how closely our sources document this process, not by quality. Sponsored placements are labelled. How lists are ordered

    All 3 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    Who approves a quality policy?

    WHO describes it as formally expressed and authorised by top management, and FDA describes it as issued by the highest level of the organisation. Neither makes the quality department its owner.

    Is a quality plan the same as a quality policy?

    No. FDA defines a quality plan as the documented result of quality planning, and ISO 10005 gives guidelines for plans for a process, product, service, project or contract. A policy states intention and direction for the whole organisation.

    How do auditors check a quality policy?

    ISO/TC 176's 2016 audit paper points to interviews with top management, management review records, evidence of communication and interviews showing staff understand how it relates to their work. It says not to ask people to recite it, and it predates ISO 9001:2026.

    More quality terms

    Related guides