ISO/UNDP 53001 clauses 4 to 6: frequently asked questions

ISO 53001 follows the ISO harmonized structure shared by management system standards. It has 10 clauses: the first three cover scope, normative references and terms and definitions; clauses 4 to 10 contain the certifiable requirements, from the context of the organization through to improvement.

Why a common structure

These titles come from the harmonized structure; their SDG-specific content is found in the text of the standard. The harmonized structure, formerly known as Annex SL, lets management system standards share the same architecture, the same core terms and part of the same requirements. An organisation certified to ISO 9001, ISO 14001 or ISO 45001 finds familiar clauses in ISO 53001, which makes an integrated system easier.

For the auditor, this architecture organises the audit plan: every finding is tied to a clause, and a combined audit can examine a requirement common to several standards in a single pass. The harmonized structure page and the guide to the ISO/UNDP 53001 standard develop these points.

The analysis of context, in clause 4.1, requires the organisation to determine the external and internal issues that affect its ability to achieve the intended results of its SDG management system. As in any standard built on the harmonized structure, this analysis is kept up to date and feeds the choice of priorities; the auditor checks that it reflects the activities actually carried out.

External and internal issues

External issues include the regulatory framework, economic conditions, society's expectations, the effects of climate change and the social situation in the countries where the organisation operates or sources. Internal issues relate to its strategy, culture, resources and structure. In the harmonized structure, this analysis is the starting point: it shapes the scope, the risks and opportunities and, for ISO 53001, the choice of priority SDGs.

What the auditor checks

The auditor seeks to establish that the analysis exists, is kept up to date and is actually used. No format is imposed: a table, a note from top management or a strategic study can all serve. What the auditor does check is that the issues identified reappear later in the priorities, the risks and the objectives.

An analysis written for the audit and never revisited, or one that overlooks an obvious issue of the business, leads to a finding whose severity depends on its effect on the rest of the system. Clause 4 sets out these requirements of the ISO/UNDP 53001 standard.

ISO 53001 gives no closed list. Under clause 4.2, the organisation itself determines the interested parties relevant to its SDG management system, their needs and expectations, and which of those expectations it treats as requirements. Employees, customers, suppliers, local communities, investors and public authorities are often among them.

Relevance rather than exhaustiveness

An interested party is anyone who can influence the organisation's decisions or be affected by them. For the SDGs, the notion widens: workers in the supply chain, people living near a site or populations exposed to climate change can be concerned without any contractual relationship. The auditor seeks to establish whether the analysis has considered these parties without a direct voice, and why any that were set aside were excluded.

The harmonized structure also asks the organisation to decide which of the expectations identified become requirements of the system, such as a legal obligation or a contractual commitment.

The review at audit

The auditor checks that the list is consistent with the activity and the scope, and that expectations were gathered by identifiable means: surveys, meetings, discussions with staff representatives, customer feedback. The auditor then compares these expectations with the selected SDGs and the objectives set.

A significant interested party missing from the analysis, for instance the subcontractors of a company that outsources most of its manufacturing, can give rise to a finding. The glossary defines the notion, and clause 4 explains its reach within the ISO/UNDP 53001 standard.

Yes. An organisation can limit the scope of its SDG management system to one site, one activity or one entity, provided it justifies and clearly describes that choice. Clause 4.3 requires context and interested parties to be taken into account when setting the boundaries. An artificially reduced scope will be challenged at audit.

Setting and recording the boundaries

The scope states what the system covers: which activities, which sites, which legal entities. It is maintained as documented information and appears on the certificate. For ISO 53001, the question is especially sharp: the largest impacts on the SDGs often lie outside the organisation's own premises, with suppliers or in the use of products. The auditor therefore checks that the scope is not reduced to a list of sites and that it remains consistent with the issues identified in the analysis of context.

What the auditor checks

The auditor compares the declared scope with what is observed. The auditor checks that excluded activities are left out for reasons that can be explained, and that the exclusion does not target precisely the activity with the strongest effect on the SDGs. Consistency with communication is reviewed too: an organisation presenting its certification as covering a whole group when only one subsidiary was audited misleads the public.

For a buyer, the scope statement on the certificate is the first thing to read. Clause 4 and the guide to the ISO/UNDP 53001 standard return to this requirement.

Clause 5.1 requires top management to demonstrate leadership: it is accountable for the effectiveness of the SDG management system, ensures its integration into business processes and strategy, provides resources and promotes improvement. It cannot hand this responsibility over to a sustainability department, and the auditor questions it directly.

Commitment that can be observed

In the harmonized structure, leadership is not a statement. It shows in decisions: budget trade-offs, appointments, the place of the SDGs on executive committee agendas, sustainability objectives taken into account in investment projects. For ISO 53001, this integration into governance is part of the very purpose of the standard, which aims at governance decisions that take the selected SDGs into account.

The interview with top management

The auditor meets the chief executive, or the body that directs the organisation at the highest level, and asks how the priority SDGs were decided, which results are followed and which recent decision the system influenced. The answers are cross-checked against meeting minutes and documented trade-offs.

A leadership team that discovers the content of the system on the day of the audit, or refers every question to the project lead, suggests that the system lives on the margins of the organisation; depending on the evidence gathered, the finding can be classed as major. Clause 5 details these requirements of the ISO/UNDP 53001 standard.

The SDG policy is the statement in which top management sets out the organisation's intentions and direction regarding the Sustainable Development Goals. As in any standard built on the harmonized structure, it falls under clause 5.2, Policy; it provides a framework for objectives, contains commitments, is communicated internally and is made available to interested parties.

What a policy contains

The harmonized structure expects a policy to suit the purpose of the organisation, provide a framework for setting objectives and contain commitments, at the very least to meet applicable requirements and to improve the system. The auditor checks that the policy is consistent with the priority SDGs selected and that it genuinely provides a framework for objectives. Its form is free: a few paragraphs can be enough if the commitments are clear.

What the auditor checks

The auditor checks that the policy exists, has been approved by top management, is dated and is kept current. The auditor makes sure it is known: when asked, a department head should be able to convey its general intent without reciting it. Its commitments are then compared with the objectives actually set.

A generic policy that could apply to any company, or objectives unrelated to it, lead to a finding. Clause 5 and the guide to the ISO/UNDP 53001 standard develop this point.

Clause 5.3 requires top management to assign, communicate and ensure understanding of the responsibilities and authorities needed for the SDG management system, notably to ensure conformity and report on performance. The standard imposes no job title; it requires each role to be clear and top management to remain accountable.

Roles shared out, accountability retained

Many organisations entrust the running of the system to one person or team: a sustainability manager, a sustainability department, a dedicated committee. That is one possible arrangement, not an obligation. Roles can also be spread across business functions, each carrying the objectives that concern it: human resources for SDG 5, purchasing for the supply chain. In every case, assigning a role does not release top management from its accountability for the system's effectiveness.

What the auditor checks

The auditor seeks to establish that responsibilities are defined, known to those concerned and actually exercised. Job descriptions, delegations or appointment decisions are reviewed, then interviews confirm that people know what is expected of them and have the authority to act.

A designated manager with neither time nor resources, or objectives assigned to nobody, are classic findings in management systems. The clause 5 page and the guide to the ISO/UNDP 53001 standard present this requirement.

As in any standard built on the harmonized structure, under clause 6.1 the organisation determines the risks and opportunities it must address so that its SDG management system achieves its results, prevents undesired effects and improves. It plans actions and evaluates their effectiveness. The auditor checks that these risks and opportunities stem from the analysis of context and interested parties.

Two readings of risk

In a conventional approach, risk means the effect of uncertainty on the organisation's objectives: a failing supplier, new regulation. The SDGs add another perspective, that of the organisation's effects on society and the environment. The two often meet: a risk of forced labour at a supplier is both harm to SDG 8 and a legal and reputational risk. Opportunities are favourable situations: a new market, a partnership, an innovation that serves an SDG.

What the auditor checks

The harmonized structure does not impose a formal risk management method. The auditor checks that risks and opportunities have been determined from context and interested parties, that actions have been decided for the most significant ones and that their effectiveness is evaluated. The auditor may follow a single risk from end to end: identification, action, result.

A static risk map with no associated action and no update reflects a paper exercise rather than a steering tool. Clause 6 and the guide to the ISO/UNDP 53001 standard go deeper into this requirement.

As in any standard built on the harmonized structure, clause 6.2 requires SDG objectives at relevant functions and levels, consistent with the policy, measurable where practicable, monitored, communicated and updated. The organisation also plans how to achieve them: what will be done, with what resources, by whom, by when and how results will be evaluated.

From a UN goal to an internal objective

An SDG is not a company objective; it has to be translated. For a priority goal, the organisation sets one or more objectives on its own scale, with indicators and deadlines, drawing where useful on the 169 targets of the 2030 Agenda to sharpen its intent. An objective such as acting for the climate is too vague to track; a quantified cut in a site's energy use, against a base year, can be verified.

What the auditor checks

The auditor takes a few objectives and examines how they are built: link with the policy and the selected SDGs, defined indicator, starting value, owner, deadline. The action plan and its progress are then reviewed. The auditor does not judge how ambitious the targets are, which is the organisation's choice, but checks that they are consistent with the analysis of context and the resources allocated.

Objectives with no action plan, or plans whose progress nobody follows, lead to a finding. Clause 6 and the guide to the ISO/UNDP 53001 standard complete this picture.

Clause 6.3 requires changes to the SDG management system to be carried out in a planned way. Before a change, whether a reorganisation, an acquisition, a new activity or dropping a priority SDG, the organisation considers its purpose, its possible consequences, the availability of resources and the allocation of responsibilities.

Which changes are concerned

The requirement targets changes to the system itself: widening or narrowing the scope, overhauling objectives, redistributing roles, switching the tool used to track indicators. By extension, it also concerns developments in the organisation that alter its impacts on the SDGs, such as opening a site abroad or launching a product range. The aim is to stop a decision taken elsewhere from disrupting the system without anyone having anticipated it.

What the auditor checks

The auditor identifies the changes made since the previous audit, through interviews with top management and by reading meeting records. For each one, the auditor seeks to establish that it was examined before being implemented: effects on objectives assessed, responsibilities adjusted, the people concerned informed.

A significant change that went unnoticed by the system, for example a priority SDG abandoned without a top management decision, results in a finding. Clause 6 and the guide to the ISO/UNDP 53001 standard clarify this requirement.