ISO/UNDP 53001 clauses 7 to 10: frequently asked questions
The ten most common questions on this topic, each with a direct answer and a fuller explanation. The answers explain the standard and what the auditor checks; they do not replace the text of the standard, sold by ISO and national standards bodies. Topic 5 of 10.
Updated: · edition covered: ISO/UNDP 53001:2026
What this topic covers
The questions here concern how the system runs and is evaluated: resources, competence, communication, documented information, operational control, monitoring and measurement, internal audit, management review, continual improvement and the handling of internal nonconformities. The pages from clause 7 to clause 10 give the detail.
Further reading
- ISO/UNDP 53001: the reference guideISO/UNDP 53001 is the international requirements standard for management systems addressing the United Nations Sustainable Development Goals (SDGs).
- ISO/UNDP 53001 clauses 4 to 6: frequently asked questionsThe ten most common questions on this topic, each with a direct answer and a fuller explanation.
- ISO/UNDP 53001 certification and audit cycle: frequently asked questionsThe ten most common questions on this topic, each with a direct answer and a fuller explanation.
Frequently asked questions
What resources does ISO 53001 require for the system?
Clause 7.1 requires the organisation to determine and provide the resources needed to establish, implement, maintain and improve its SDG management system. That means people, time, budget, data collection tools and, where needed, outside expertise. The standard sets no amount.
Resources in line with objectives
The requirement is proportionate by nature: a small charity and an industrial group do not have the same needs. The benchmark is the set of objectives the organisation has given itself. Cutting the emissions of a vehicle fleet calls for capital spending; following working conditions at distant suppliers calls for assessment time or third-party help. Resources also include data: without an information system able to produce the indicators, steering stays theoretical.
What the auditor checks
The auditor sets objectives against means. Who works on the system, and for what share of their time? What budget was allocated, and how were needs assessed? The auditor also checks in the management review minutes that the question of resources was actually raised.
Ambitious objectives with no identified means, or a single person collecting every data point on top of other duties, reveal a mismatch that can ground a finding. Clause 7 and the guide to the ISO/UNDP 53001 standard cover all the support requirements.
What competence does ISO 53001 expect of the people involved?
Clauses 7.2 and 7.3 require the organisation to determine the competence needed by people whose work affects the SDG management system, to ensure they have it through training or experience, and to retain evidence of it. Everyone must also be aware of the policy and of their own contribution to the system.
Competence and awareness
The harmonized structure separates two requirements. Competence concerns people with a specific role: the system manager, internal auditors, staff who calculate indicators, buyers who assess suppliers. For them, the organisation determines what they need to be able to do, measures any shortfall and closes it. Awareness concerns a wider group: everyone working under the organisation's control knows the policy, the objectives that concern them and the consequences of not meeting the requirements.
What the auditor checks
The auditor reviews documented information on competence: role profiles, training records, evaluations. The auditor does not stop at these documents and also talks to people. Can a buyer expected to apply social criteria explain them? Does an employee met at random know that the organisation has made commitments on the SDGs?
Recorded training whose content was not understood, or no evaluation at all of internal auditors' competence, are possible findings. Clause 7 and the guide to the ISO/UNDP 53001 standard spell out these requirements.
What does ISO 53001 require for communication on the SDGs?
As in any standard built on the harmonized structure, clause 7.4 requires the organisation to determine its internal and external communications on the SDG management system: what to communicate, when, with whom, how and by whom. The auditor pays all the more attention to it because public SDG commitments put the organisation's credibility at stake.
Planned communication
The harmonized structure prescribes no medium. It asks for organised communication, consistent with the system and suited to interested parties. Internally, that means making objectives, results and roles known. Externally, it means reporting on the contribution to the SDGs, answering requests and, where relevant, engaging with affected communities. Credible SDG communication rests on the same data as steering does.
What the auditor checks
The auditor compares what the organisation says with what the system can establish, reading the sustainability report, the website and answers to customer questionnaires, and checking that published figures match the indicators tracked. A public claim resting on no data, or a result presented as achieved when it is still a target, reveals weak control of communication.
Use of the certificate and certification mark is also governed by the certification body's rules, described on the certificate and logo use page. Clause 7 and the guide to the ISO/UNDP 53001 standard complete this point.
What is documented information in ISO 53001?
Documented information, in clause 7.5, is the information the organisation maintains and retains to run its SDG management system and demonstrate its results. The standard requires some of it; the organisation determines the rest. Any medium is acceptable: document, database, collaborative tool, audio or video recording.
Maintained and retained information
The harmonized structure replaced the older notions of written procedure and record with this single term. It covers both what describes the system, such as the policy, the scope or the objectives, and what proves that it works, such as measurement results, review minutes or internal audit reports. No volume is imposed: it depends on the size of the organisation, the complexity of its activities and the competence of its people.
What the auditor checks
The auditor checks that the information required by the standard exists and that the information the system needs is controlled: identified, dated, approved, available to the right people, protected against unintended change, retained for the planned period. The quality of a system is not measured by its thickness.
Bulky but outdated documentation that no longer matches practice causes more difficulty than a lean set kept current. The initial audit begins with a review of system design, partly based on documents. Clause 7 and the guide to the ISO/UNDP 53001 standard detail this requirement.
What does operational control cover in ISO 53001?
Operational control, in clause 8.1, requires the organisation to plan, implement and control the processes needed to meet the requirements of its SDG management system and carry out the planned actions. It sets criteria for those processes, controls changes and keeps outsourced processes under control.
Where the SDGs enter day-to-day activity
Clause 8 is where commitments become practice. The processes concerned depend on the selected SDGs: responsible purchasing, product design, human resources management, energy management, relations with local communities. For each, the organisation defines criteria, such as a social clause in contracts or a consumption threshold, and makes sure they are applied. As in any standard built on the harmonized structure, clause 8 also covers the control of planned changes and of relevant externally provided processes.
What the auditor checks
Clause 8 is audited largely in the field. The auditor follows a real process, such as a tender, a recruitment or a product launch, and checks that SDG-related criteria were applied. Examples are chosen by sampling, across several departments or sites. Processes entrusted to contractors receive particular attention: outsourcing them does not take them out of the system.
A criterion defined on paper but ignored in the files reviewed is a finding, whose severity depends on how often it occurs and on its effect. Clause 8 and the guide to the ISO/UNDP 53001 standard expand on this requirement.
How does ISO 53001 deal with monitoring and measurement?
Clause 9.1 requires the organisation to determine what it monitors and measures, with which methods, how often, and when results are analysed and evaluated. For ISO 53001, this means tracking the contribution to the selected SDGs and the effectiveness of the system, with indicators whose reliability can be checked.
Reliable, useful indicators
An indicator is only worth something if its definition is stable, its source known and its calculation reproducible. A workplace accident rate, the share of purchases from assessed suppliers or energy use per unit of output are examples. The organisation chooses its indicators according to its objectives; some concern the system itself, such as the completion rate of action plans. The harmonized structure also requires results to be analysed: collecting figures without interpreting them does not meet the requirement.
What the auditor checks
The auditor picks a few indicators and traces them back to the source: raw data, spreadsheets, extracts from information systems. The auditor checks that a published result can be rebuilt, examines any change of method and makes sure it is disclosed, since otherwise a favourable trend may be nothing more than a calculation effect. Finally, the auditor checks that the analysis of results feeds the management review.
Indicators that cannot be reproduced, or missing data on a priority SDG, can lead to a nonconformity. Clause 9 and the guide to the ISO/UNDP 53001 standard present performance evaluation.
Is internal audit mandatory under ISO 53001?
Yes. Clause 9.2 requires the organisation to conduct internal audits at planned intervals, to check that its SDG management system conforms to its own requirements and to those of the standard, and that it is effectively implemented. An audit programme, criteria, objective auditors and reporting to top management are expected.
An internal view that stays objective
Internal audit is carried out by the organisation itself or by a provider it appoints. The harmonized structure requires auditors to be chosen so as to ensure the objectivity and impartiality of the process: nobody audits their own work. The frequency and order of audits reflect the importance of the processes and the results of earlier audits. Internal audit is not the certification audit, and the certification body cannot perform it on the organisation's behalf, for reasons of impartiality.
What the certification auditor checks
The certification auditor reviews the internal audit programme, the reports, the competence and independence of internal auditors, and the follow-up given to their findings. The auditor checks that the whole scope and every requirement were covered over the planned period.
An internal audit reduced to a ticked checklist with no findings, or internal findings left without action, weaken confidence in the system. Having carried out no internal audit at all before the certification audit is an unaddressed requirement. Clause 9 and the guide to the ISO/UNDP 53001 standard describe this requirement in detail.
What is management review in ISO 53001?
Management review, in clause 9.3, is top management's periodic review of the SDG management system. It confirms that the system remains suitable, adequate and effective, based on defined inputs: indicator results, audits, expectations of interested parties, changes in context. It ends in decisions on improvement and on resources.
Inputs and expected outputs
The harmonized structure lists the topics the review covers: actions from previous reviews, changes in issues, feedback from interested parties, achievement of objectives, nonconformities and corrective actions, monitoring and audit results, adequacy of resources, opportunities for improvement. Its conclusions address possible improvements and any need to change the system. Since the priority SDGs sit within those issues and objectives, the auditor looks at whether the review drew conclusions about them, such as keeping or changing a priority.
What the auditor checks
The auditor asks for the dated minutes of the latest review and checks that every input was dealt with. Outputs matter most: which decisions were taken, who is responsible for them, and did they lead anywhere? These elements are cross-checked with the top management interview.
A review limited to presenting figures, with no decision, or held without the leadership team, does not fulfil its function and gives rise to a finding. Clause 9 and the guide to the ISO/UNDP 53001 standard present this requirement.
What does continual improvement mean in ISO 53001?
Continual improvement, in clause 10.1, is the commitment to keep improving the suitability, adequacy and effectiveness of the SDG management system. For ISO 53001, it aims to strengthen the organisation's contribution to the selected SDGs. It does not require progress every year on every indicator, but a momentum that can be demonstrated.
Where improvements come from
Improvement draws on the other requirements: analysis of measurement results, internal audits, management review, handling of nonconformities, feedback from interested parties. It can take the form of a more demanding objective, a wider scope, a new priority SDG, a more reliable indicator or a better controlled process. The certification cycle, with surveillance audits at least once every calendar year, makes it possible to observe this momentum over time.
What the auditor checks
The auditor looks for concrete, dated improvements and checks that they stem from analysis. From one audit to the next, results and decisions are compared. A system that stays unchanged for several years, with no new objective or adjustment while indicators stagnate, raises questions.
The auditor may also record opportunities for improvement; these are not nonconformities, and the organisation is free to act on them or not. Clause 10 and the guide to the ISO/UNDP 53001 standard develop this requirement.
How does ISO 53001 handle internal nonconformities?
Clause 10.2 requires the organisation to react to any nonconformity in its SDG management system: control and correct it, deal with its consequences, look for its causes, implement corrective action, check that the action is effective and keep a record of it all. These are the nonconformities the organisation detects itself.
Correction and corrective action
The harmonized structure separates two steps. Correction deals with the nonconformity found: a miscalculated indicator is recalculated, an unassessed supplier is assessed. Corrective action tackles the cause, so that the problem does not recur or appear elsewhere: a clarified method, training, a modified process. Nonconformities can come from internal audits, monitoring, a complaint, or a social or environmental incident at a supplier.
What the auditor checks
The auditor examines the tool in which nonconformities are tracked, selects a few and checks the cause analysis, the relevance of the action and the verification of its effectiveness. A system that never records any internal nonconformity inspires little confidence; actions limited to corrections, with no search for causes, let the same problems come back.
These internal nonconformities are distinct from the certification auditor's minor or major findings, which follow clearance rules specific to certification. Clause 10 and the guide to the ISO/UNDP 53001 standard present this requirement.