ISO 9001, ISO 14001, ISO/IEC 27001, ISO 45001, ISO 37001 and ISO/IEC 42001 apply the harmonised structure of management system standards and place leadership in clause five. They share a core · top management must demonstrate commitment, ensure resources and be accountable for the system's effectiveness; each standard adds requirements specific to its subject. This reading, with a cut-off of May 2026, examines a recurring misunderstanding in auditing: confusing a signature or the appointment of a representative with demonstrated leadership. The Boeing, Credit Suisse and Post Office records do not prove breaches of an ISO standard; they illustrate the consequences of gaps in management, communication and accountability.
What clause five actually requires
Clause 5.1 of ISO 9001:2015 and ISO/IEC 42001:2023 opens with a responsibility of top management: demonstrating leadership and commitment. Appointing operational managers does not transfer that accountability. The following table translates the shared core into audit questions; it neither reproduces verbatim nor replaces the text of each standard.
| Verb | What it requires | Verifiable evidence |
|---|---|---|
| Establish | Policy and objectives compatible with the strategic direction | Policy signed by management, dated before implementation |
| Integrate | The system requirements into business processes | Core processes that reference the system · a business budget that provides for it |
| Ensure resources | Actual availability of people and budget | Identifiable budget line and allocated staff |
| Communicate | The importance of effective management, from top management | Communications issued by management — dated, with an identifiable sender |
| Ensure results | Achievement of the system's intended results | Management review with decisions, assigned responsibilities and deadlines |
| Direct and support | People who contribute to the system's effectiveness | Documented backing in escalated conflicts |
| Promote | Continual improvement as a management decision | Improvement actions originating in the boardroom, with follow-up |
| Support other roles | Leadership replicated in each area of responsibility | Minutes in which other managers answer for their areas |
These responsibilities leave traces that the auditor can request. Assessment does not stop at intentions; it checks decisions, resources and results against evidence.
The recurring misunderstanding in the field
The sequence repeats with few variations. Management hires a consultant to implement the system. The consultant designs, trains and prepares the audit. Management signs off on the committee, receives the certificate and hangs it on the wall. The misunderstanding is structural. Management has mistaken signing the certificate for exercising leadership. Signing is an administrative act. Leadership is an ongoing practice that appears at three moments where there is no substitute.
Moment 01 · initial decision. When the system to be implemented, its scope and the conditions for success are defined. Management that participates in that decision leads. Management that receives it already settled signs what someone else decided.
Moment 02 · operational conflict. When the technical team needs to escalate a critical observation that creates political friction — an incident, a major nonconformity, a continuity decision. At that point, the system needs to know it has a real signatory. Absent management leaves the system captured by the operational line.
Moment 03 · independent audit. When the auditor asks a question and the answer must come from management. Management that answers demonstrates that it operates the system. Management that passes the answer to the rotating person in charge demonstrates the opposite, and it goes on record.
Four patterns of non-compliance
The phantom committee
The quality, information security or AI governance committee appears on the organisation chart. It rarely meets, or it meets without leaving documented decisions. The governance body exists on paper and is missing in practice.
The non-existent sponsor
The project has a formal sponsor — almost always a C-level executive. The sponsor misses critical meetings, fails to sign off on progress and cannot be found when a blockage arises. Sponsorship is proven by the schedule, and the schedule contradicts it.
Declared resources without a budget
The policy states that management will ensure sufficient resources. The operating budget omits them. The technical team operates with whatever it can obtain. The gap between the signed policy and the budget line is, in itself, an auditable finding.
Delegated communication
The standard requires management to communicate the importance of the system. That communication is delegated to the function that operates it. The technical team ends up communicating with itself. Management's message exists only as an indirect quotation — and the operational line knows it.
The decade measured it
Pattern 04 ceased to be an audit observation. An expert panel convened under a mandate from the United States Congress examined Boeing's safety culture and published its report in February 2024 · after 250 interviews, it documented a «disconnect» between management's message on safety and what the operational line hears and believes, and described safety management as inadequate and confusing (FAA Expert Panel, 2024). Delegated communication opens a gap that 250 interviews suffice to measure.
The Swiss case measured the rest of the verbs. The Swiss Parliament's commission of inquiry into the collapse of Credit Suisse assigned primary responsibility to the bank's board and management, who ignored years of interventions by the financial supervisor — with CHF 33.700 billion in cumulative losses and CHF 31.700 billion paid in bonuses between 2010 and 2022 (PUK, 2024). The regulator intervened time and again. The board filed it away. No external supervision can compensate for leadership that chose not to lead.
Silence in the boardroom
Clause five can also be breached without delegating anything. It is breached by remaining silent. At every decision-making table, there is a question available that no one asks, and the entire organisation knows what it is. The British public inquiry into the Horizon system documented the extreme version · Post Office and its supplier knew — or should have known — about the system's errors while more than nine hundred branch managers were prosecuted on its evidence; the inquiry links at least thirteen possible suicides (Post Office Horizon IT Inquiry, vol. 1, 2025). Decades of board minutes. The question was available at every meeting.
Criterion 08 in this series names the phenomenon — silence at the table — and treats it as what it is · auditable information. For the board reading this piece, the connection is direct. The eight verbs of clause five are exercised by speaking. A management review that avoids the critical question fulfils the ritual and breaches the clause.
Why it matters more with artificial intelligence
With artificial intelligence systems within the institutional perimeter, documented leadership becomes more relevant. The frequency of change can exceed a quarterly cadence, hiring a supplier does not transfer responsibility, and decisions on scope, resources and limits require real authority. ISO/IEC 42001:2023 applies the harmonised structure and retains that responsibility of top management.
The leadership test
Identify three operational decisions signed in the last year under your management system. Check whether each signatory still operates with real authority. Check whether the technical team had visible political backing in any incident or conflict during the period.
If the three exercises reveal an absence of real leadership, your organisation operates a different system from the one it claims to certify — and it is worth knowing this before a third party documents it.
Clause five is exercised in person and leaves a trail · chaired meetings recorded in minutes, budgeted resources, visible backing in conflict. Those who delegate it organise their own institutional absence. The cases of the decade — Boeing, Credit Suisse, Post Office — gave that absence a date, a figure and a signature.