Understanding Internal and External Issues: Context of the Organization | My ISO Consultants
Updated: Sep 18
Understanding the context of the organization is a core part of building and maintaining an effective Quality Management System (QMS). For ISO 9001 and AS9100, organizations need to understand the internal and external issues that can affect the QMS and its ability to achieve intended results. That understanding should then inform decisions about interested parties, QMS scope, risks and opportunities, processes, and management priorities.
The goal is not to create a complicated strategic-planning exercise. It is to make sure the QMS reflects the real environment in which the organization operates and can respond when important conditions change.
2026 Standards Note
This topic remains current in 2026. ISO 9001:2015 still requires organizations to understand their internal and external context, and ISO 9001:2015/Amd 1:2024 added an explicit requirement to determine whether climate change is a relevant issue. ISO 9001:2026 is under publication and continues to retain context of the organization as a core QMS concept. AS9100 Rev D / 9100:2016 also continues to use the same context framework while adding aerospace-specific requirements.
What Does 'Context of the Organization' Mean?
Context of the organization means understanding the conditions that can influence how the business operates and how effectively its QMS can deliver conforming products and services. These conditions can come from outside the organization or from within it.
Examples of External Issues
Customer and market expectations.
Competitor activity and market pressure.
Economic conditions, inflation, tariffs, or supply-chain instability.
New technology and changing industry practices.
Statutory, regulatory, contractual, or customer requirements.
Supplier capability and availability.
Political, social, legal, and environmental conditions.
Climate-related issues when they are relevant to the QMS.
Examples of Internal Issues
Organizational structure and leadership changes.
Company culture, values, and decision-making practices.
Workforce competence, staffing, and turnover.
Process performance and recurring quality issues.
Capacity, equipment, technology, and information systems.
Internal communication and cross-functional coordination.
Financial or resource limitations.
Knowledge, lessons learned, and organizational maturity.
Not every issue needs to become a formal risk or action item. The organization should focus on the issues that are relevant to the QMS and can affect its ability to achieve intended results.
How to Identify Relevant Internal and External Issues
Organizations can use whatever method makes sense for their size and complexity. ISO 9001 and AS9100 do not require a specific strategic-analysis tool.
Management and strategic planning reviews.
SWOT analysis.
PESTLE or similar external-environment analysis.
Customer feedback and contract reviews.
Supplier-performance and supply-chain reviews.
Regulatory and industry updates.
Internal audit findings and corrective-action trends.
Management review discussions.
Business continuity, risk, and operational planning.
The method matters less than the result: management should be able to explain which issues are relevant, why they matter, and how they affect the QMS.
Understanding Relevant Interested Parties
Once the organization understands its context, it should also identify the interested parties that are relevant to the QMS and determine which of their requirements matter to the management system.
Customers and end users.
Employees and owners.
Regulators and governmental authorities.
Suppliers and external providers.
Certification bodies and contractual partners.
Industry or customer-specific authorities where applicable.
Other parties whose requirements can materially affect the QMS.
The organization does not need to list every possible stakeholder. The focus should remain on interested parties that are genuinely relevant to the QMS and on the requirements that need to be addressed through the management system.
Do We Need to Document the Context of the Organization?
ISO 9001 does not prescribe a specific form, SWOT document, PESTLE worksheet, or separate 'context of the organization' procedure. However, the organization should be able to demonstrate that relevant issues and interested-party requirements have been considered and are being monitored.
Many organizations keep practical evidence such as management-review minutes, strategic plans, risk registers, interested-party matrices, SWOT or PESTLE analyses, action lists, or other records. The best approach is the one that supports real management decisions instead of creating documentation only for an auditor.
How Context Affects the QMS Scope
Context and interested-party requirements are important inputs when determining the boundaries and applicability of the QMS. The scope should reflect the organization's actual products, services, locations, processes, and responsibilities rather than being written as a generic certification statement.
Changes in the organization or its environment can also affect whether the existing scope still makes sense. New locations, acquisitions, outsourced activities, major customer changes, new product lines, regulatory changes, or organizational restructuring may all require the scope and related processes to be reviewed.
How Context Connects to Risks and Opportunities
The organization’s context should help identify which risks and opportunities deserve management attention. For example, supplier instability may create delivery or conformity risk, a new regulation may require process changes, or new technology may create both operational risk and an opportunity to improve performance.
Context is therefore not a one-time Clause 4 exercise. It should feed into planning, objectives, process controls, resource decisions, management review, and other QMS activities when relevant.
Climate Change and Context of the Organization
Since the 2024 climate action amendment, organizations using ISO 9001 must explicitly determine whether climate change is a relevant issue for the QMS. Relevant interested parties can also have climate-related requirements.
That does not mean climate change must be treated as relevant for every organization or that every company needs a separate climate program. The organization should make a reasonable determination based on its products, services, location, customers, suppliers, regulations, operational risks, and the intended results of the QMS.
AS9100 Context Considerations
For aerospace organizations, the same basic context principles apply, but the analysis should also reflect the operating environment of aviation, space, and defense. Customer-specific requirements, regulatory oversight, product safety, supplier capability, technology changes, cybersecurity, counterfeit-part risk, and aerospace market conditions may all influence the QMS.
Aerospace organizations that need help translating these issues into a practical management system can use AS9100 consulting services to review context, interested parties, QMS scope, risk, and certification readiness.
Common Context-of-the-Organization Mistakes
Completing a SWOT or PESTLE exercise once and never reviewing it again.
Listing generic issues that have no real connection to the QMS.
Identifying interested parties without determining which requirements actually matter.
Treating context as a documentation exercise instead of an input to management decisions.
Failing to update the analysis after major customer, supplier, regulatory, market, or organizational changes.
Ignoring climate change entirely instead of determining whether it is relevant.
Allowing context, scope, risks, and management review to become disconnected from each other.
Organizations that want help evaluating whether their QMS accurately reflects their current business environment can use My ISO Consultants' ISO 9001 consulting services to review context, interested parties, scope, risk, and other certification-readiness requirements.
Frequently Asked Questions
What should be included in an ISO 9001 context-of-the-organization review?
The review should identify the internal and external issues that can affect the QMS and its intended results, along with relevant interested parties and requirements. The organization should focus on issues that can materially affect products, services, customers, compliance, resources, processes, or business conditions rather than creating an exhaustive list of every possible factor.
Do we need a formal SWOT or PESTLE analysis for ISO 9001 or AS9100?
No specific tool is required. SWOT, PESTLE, management review, strategic planning, risk reviews, and other methods can all be used. The important point is that the organization can demonstrate that relevant internal and external issues have been identified, understood, and monitored.
How often should we review internal and external issues for ISO 9001 or AS9100?
There is no universal fixed interval that applies to every organization. Context should be monitored and reviewed often enough to remain current, especially when significant changes occur. Many organizations include context and interested-party review within management review or strategic-planning activities and revisit it when major customer, supplier, regulatory, market, technology, or organizational changes occur.
What will an ISO 9001 or AS9100 auditor expect to see for context of the organization?
An auditor will generally expect the organization to explain the relevant internal and external issues, identify relevant interested parties and requirements, and show how that understanding connects to the QMS. The evidence does not have to be one specific document, but the organization should be able to demonstrate that the analysis is current and influences appropriate QMS decisions.
Conclusion
Understanding the context of the organization helps keep a QMS connected to the real conditions in which the business operates. When internal and external issues, interested-party requirements, scope, risks, and management priorities are reviewed together, the management system becomes more useful for both certification and business performance.
If your organization needs help reviewing its QMS context, interested parties, scope, or certification readiness, My ISO Consultants provides ISO 9001 consulting services to help build a management system that reflects your actual operations and current requirements.
