ISO/UNDP 53001 clause 9: what the auditor checks
ISO 53001 clause 9 deals with performance evaluation. The auditor checks that indicators tied to the SDG objectives are measured and analysed using defined methods, that an internal audit covers the whole system and that the management review leads to decisions. Without these three elements, the system cannot steer itself.
Updated: · edition covered: ISO/UNDP 53001:2026
ISO 53001 clause 9: measuring the contribution, then judging it
In ISO 53001, clause 9 and indicators go hand in hand. The harmonized structure asks the organisation to decide what it monitors and measures, with which methods, at what intervals, and when the results are analysed. It also requires internal audits at planned intervals, carried out by people who do not audit their own work, and a review by top management that considers defined inputs and produces decisions.
What the SDGs make harder
Measuring a contribution to the Sustainable Development Goals is more delicate than measuring a complaint rate. Effects are often indirect, delayed and dependent on external data. Tracking a goal such as climate action (SDG 13) requires calculation methods that stay stable from one year to the next, otherwise trends mean nothing. Tracking linked to clean water and sanitation (SDG 6) often relies on on-site readings whose reliability has to be established, for example meter readings taken by different teams on different dates.
As in any harmonized-structure standard, the management review takes as inputs information on performance, including trends in monitoring results and the extent to which objectives have been met. For figures on the SDGs, the auditor applies the common rule: a figure that cannot be traced back to its source data does not count as evidence.
Examination grid for the three subclauses
| Subclause | What the auditor wants to demonstrate | Means of verification |
|---|---|---|
| 9.1 Monitoring, measurement, analysis and evaluation | Indicators linked to the SDG objectives are measured using defined methods; results are analysed and evaluated, not merely collected | Review of dashboards; recalculation of one indicator from raw data; interview with the person who produces it |
| 9.2 Internal audit | A programme covers the whole scope and all requirements; internal auditors are objective; findings are followed up | Reading of the programme and of internal audit reports; a sample of findings traced to closure; interview with an internal auditor |
| 9.3 Management review | Top management has considered the required inputs and taken decisions on improvement, resources and any changes | Dated minutes of the review; cross-check against the decisions implemented; interview with top management |
Findings: from conformity to a major gap
- Conformity: measurements are reliable and analysed, the internal audit has covered the system, and the management review has led to traceable decisions.
- Minor gap: an indicator whose method changed without explanation, an internal audit that missed one requirement, a management review with one input missing.
- Major gap: no internal audit carried out before the certification audit, no management review at all, or SDG results presented with no verifiable data behind them.
- Escalation: the auditor reclassifies a finding as major when the organisation cannot say whether its objectives are being met, because the system has then lost its ability to steer itself.
Recurring weaknesses in performance evaluation
The standard has no audit history yet. These weaknesses are the ones clause 9 usually brings to light in management systems built on the harmonized structure.
- A dashboard full of data but with no analysis or conclusion.
- An internal auditor assigned to audit the process they manage.
- Internal audit findings left without follow-up from one cycle to the next.
- A management review reduced to a presentation, with no decision recorded.
- A change in the calculation boundary of an indicator that distorts comparison over time.
Clearing a gap on measurement or review
ISO/IEC 17021-1 reserves stricter treatment for major nonconformities: the certification body verifies the correction and the corrective action before any favourable decision. Where an internal audit or a management review is missing, correction means that the exercise has actually been carried out and has produced results; the auditor then examines the report or minutes and may question those who took part.
A minor nonconformity is handled through a corrective action plan accepted by the certification body, whose effectiveness is checked at the next audit. The certification rules set out the arrangements.
Measurement covers the operations described in clause 8; the gaps it reveals feed into clause 10 on improvement.
Frequently asked questions
Is an internal audit compulsory before stage 2?
In practice, the auditor expects at least one internal audit cycle and one management review to have taken place before stage 2. Without them, there is no way to verify that the system checks itself, and the corresponding requirement is not met. Stage 1 exists precisely to detect this kind of gap before stage 2 begins.
Can the internal audit be outsourced to an external provider?
The harmonized structure requires internal auditors to be objective and impartial, without requiring them to be employees of the organisation. Using an external auditor is therefore possible. The certification auditor then checks that person's competence, the coverage of the programme and the handling of findings, all of which remain the organisation's responsibility.
Does the auditor check that SDG indicators are accurate?
The auditor checks the reliability of the measurement arrangements rather than every figure. On a sample, a published result is traced back to its source data and calculation method, and consistency between periods is tested. An isolated error usually amounts to a minor finding; a missing method or unverifiable data can lead to a major one.
What should management review minutes contain?
The harmonized structure defines inputs (status of previous actions, changes, performance, audit results, resources and so on) and outputs (decisions on improvement and change). The auditor checks that they appear in the minutes. For ISO 53001, the auditor expects progress against the priority SDG objectives to feature among those inputs.