ISO/UNDP 53001 clause 8: what the auditor checks
ISO 53001 clause 8 covers operation. The auditor checks on site that the processes carrying the priority SDGs have defined criteria, that those criteria are applied in daily work, that changes and outsourced activities are controlled, and that records are sufficient to show the planned actions actually took place.
Updated: · edition covered: ISO/UNDP 53001:2026
ISO 53001 clause 8: from the plan to real activity
With ISO 53001, clause 8 marks the point where the system leaves the boardroom. The common logic runs as follows. The organisation plans, implements and controls the processes needed to meet requirements and to carry out the actions decided during planning. It sets criteria for those processes, applies them, keeps enough documented information to be confident they have run as planned, controls planned changes and reviews the consequences of unintended ones. Processes entrusted to external providers remain under its control.
The SDG dimension of operations
In a quality standard, operations mean producing the product or delivering the service. In a standard about contributing to the SDGs, they also include purchasing practices, the management of natural resources, working conditions on site and relations with neighbouring communities. Choosing a supplier, for instance, can have a direct effect on decent work (SDG 8) along the supply chain, or on responsible consumption and production (SDG 12).
The auditor wants to see whether the actions planned for the priority SDGs have become working practices with criteria attached, rather than projects running alongside the business. The same common core extends control to externally provided processes relevant to the system, which brings suppliers and subcontractors within the auditor's line of sight. A purchasing clause that nobody ever checks, or an energy rule known only at head office, gives the auditor little to work with.
The strands of 8.1 and how they are assessed
| Strand of operational control | What the auditor seeks to establish | How the auditor proceeds |
|---|---|---|
| Operating criteria | Processes carrying the priority SDGs have defined criteria (thresholds, rules, contract clauses) | Review of procedures or work instructions; questions to operators about the rules they apply |
| Application of criteria | Criteria are respected in everyday practice | Direct observation on site; sampling of activity records over the period |
| Traceability | Retained information is enough to show that processes ran as planned | Selection of operations and reconstruction of how they ran from the records |
| Changes | Planned changes are controlled and the effects of unintended changes reviewed | Interview about a recent change; search for the decisions that framed it |
| Externally provided processes | Activities entrusted to contractors or suppliers remain controlled with regard to the selected SDGs | Sample of contracts or specifications; records of supplier evaluations |
Where the line falls between minor and major
- Conformity: what the auditor observes on site matches the planned criteria, and the records allow this to be verified on a representative sample.
- Minor nonconformity: a localised lapse in application, such as an instruction not followed at one site out of several, or a supplier evaluated late, without any overall loss of control.
- Major nonconformity: a key process for a priority SDG operates with no criteria at all, an outsourced activity that concentrates the impacts escapes any control, or the organisation cannot show through any record that the planned actions happened.
- Sign of escalation: the same gap repeated across several sites or samples, which turns an incident into a process failure.
Common operational failings
These failings are regularly raised on operational control in management systems; they draw on no history specific to a standard that is still brand new.
- SDG actions run as one-off initiatives, with no criteria built into business processes.
- Social or environmental clauses written into contracts but never checked.
- A change of supplier or process decided without reviewing its effects on the selected SDGs.
- Instructions written at head office and unknown on site.
- Records too incomplete to reconstruct an operation.
How an operational gap is cleared
For a major nonconformity, ISO/IEC 17021-1 requires the certification body to verify the correction and the corrective action before any favourable decision. When the gap concerns a practice in the field, a revised document is not enough: the auditor must be able to see that the practice itself has changed, which may lead to an additional visit to the site concerned.
For a minor nonconformity, the organisation submits a corrective action plan that the certification body accepts; the auditor checks its effectiveness at the next audit, often on a different sample. How these verifications unfold is described in the certification process.
The resources drawn on by operations are examined under clause 7 on support; their results are measured under clause 9 on performance evaluation.
Frequently asked questions
Why is clause 8 so short in the harmonized structure?
The harmonized structure only lays down a common core for operation. Each standard can add its own requirements: ISO 9001, for example, deals with design and with control of external providers here. For ISO 53001, the auditor works from the operational criteria the organisation has attached to its priority SDGs. Either way, this clause still demands the most time on site.
Does the auditor visit suppliers?
No. The audit concerns the organisation seeking certification. The auditor examines how it controls outsourced processes and suppliers: selection criteria, contract clauses, evaluations, and the follow-up given to shortcomings. These elements are reviewed at the organisation itself, through document review and interviews with buyers or the managers concerned.
How many sites are visited at stage 2?
The number of sites visited depends on the scope, the number of sites, their activities and the applicable multi-site sampling rules. It is set in the audit programme drawn up by the certification body. The auditor chooses sites and samples so as to cover the activities with the largest effects on the selected SDGs.