ISO 9001 clause 8.5: maintain control throughout production and service
ISO 9001:2026 clause 8.5 addresses the controlled provision of products and services. It brings together the conditions for doing the work, identification and traceability, care of customer and provider property, preservation, post-delivery activities and operational changes. These requirements help protect conformity as work moves through the process.
What clause 8.5 requires in practice
Clause 8.5 is the heart of day-to-day delivery. It groups six subclauses that together describe how production and service provision is kept under control from start to finish: running work under controlled conditions (8.5.1), identifying outputs and tracing them where required (8.5.2), caring for property owned by customers or providers (8.5.3), preserving outputs (8.5.4), meeting post-delivery obligations (8.5.5), and reviewing and controlling changes (8.5.6).
Taken together they ask the organisation to know what should happen, equip and staff the work to achieve it, keep track of what has been produced and in what state, protect what is entrusted to it, support the customer after delivery, and manage change without losing conformity.
The requirements apply equally to a factory floor, a software release or a professional service. What changes between sectors is the form the controls take, not the need for them.
Establish controlled working conditions
Clause 8.5.1 addresses information, suitable resources, monitoring, competent people and other applicable conditions. It includes appropriate validation where the resulting output cannot be verified by subsequent monitoring or measurement, and actions to prevent human error.
The exact controls depend on the product or service. A documented instruction is useful only if people have the resources and understanding needed to follow it. Conversely, experienced staff still need the applicable information and controls when requirements or circumstances change.
Preserve identity, status and property
Identification and traceability help the organisation know what the output is and its status against monitoring and measurement requirements. Unique identification and related evidence are necessary where traceability is required; they are not an automatic instruction to serialise every item.
Customer and provider property needs care while under the organisation's control or in use. Preservation protects outputs during provision to the extent necessary for conformity. Those concepts can apply to information and service outputs as well as physical goods.
Why control of production and service provision matters to the business
This is where the promise made to the customer is either kept or broken. Even a well-designed offering fails if delivery varies from person to person, outputs get mixed up, customer materials go missing or changes are made on the fly. Reliable control produces consistent results, fewer complaints and lower waste, and it lets the organisation grow without relying on a few experienced individuals to hold everything together. It also builds the trust that wins repeat work. Auditors spend much of their time in operational areas observing real work, so evidence from here carries heavy weight in overall conclusions.
How to implement clause 8.5
Use the six subclauses as a checklist for each core delivery process, adapting depth to the risk. Do not create new paperwork for its own sake; often the existing process descriptions only need small additions to show how each of the six areas is handled in practice. Involve the people who do the work in testing the result.
- Map the main delivery processes from receiving an order to final handover, noting where customers, providers and their property are involved.
- For each process, define what good looks like, the resources and competence needed, and the checks that confirm it has been achieved.
- Decide how outputs are identified and how their status will be known at every stage.
- Agree how customer and provider property is received, stored, used and reported on if damaged.
- Define handling, storage and transport arrangements that preserve conformity.
- Plan after-delivery support and a route for reviewing changes to the process before they take effect.
Illustrative manufacturing example: accepted work mixed with pending work
A hypothetical manufacturer places accepted assemblies and assemblies awaiting a further check in the same transfer area. Each item looks complete, and the next team cannot reliably determine its status. A technically successful earlier process is undermined by a poor handover.
The organisation establishes suitable identification and status arrangements, protects the outputs during transfer and ensures the receiving team understands the distinction. It evaluates whether pending work remains controlled and whether handling preserves conformity. The example illustrates connected controls, not a mandated colour code or storage layout.
Illustrative IT example: managing a customer configuration
A hypothetical IT provider configures a customer's service using customer-owned information and an agreed technical baseline. During support, staff make a change that affects the customer's expected behaviour, but the updated status and support implications are not communicated internally.
The provider reviews property care, controlled service provision and the authority for operational changes. It preserves relevant information, records the change decision and ensures post-delivery support uses the correct basis. The example shows how several 8.5 requirements can interact in a service without a physical production line.
Meet post-delivery commitments
Post-delivery activities depend on relevant requirements and the nature of the offering. Customer commitments, applicable law, feedback and potential undesired consequences can influence what is needed. Warranty, maintenance or other support arrangements should not be assumed away at dispatch.
Determine what remains to be done and who is responsible. A product or service may be formally handed over while the organisation still has obligations affecting quality and customer satisfaction. The standard does not impose one universal support period.
Control changes in provision
Operational changes need review and control to the extent necessary for continuing conformity, with evidence of review, authorisation and necessary actions. A change that appears convenient locally may affect a downstream acceptance condition or customer commitment.
Distinguish these changes from QMS-level change planning and design changes, while applying the relevant provisions together where they overlap. One general change label should not obscure the particular requirement affected.
Evidence and common failures
Evidence varies across the subclauses and the work. Some provisions explicitly require documented information, while others depend on the controls appropriate to the output. Avoid inventing one universal production record that is supposed to demonstrate every requirement.
Common weaknesses include unclear status, damaged customer property left unreported, outputs degraded during transfer and changes authorised informally without the required evidence. Follow a real output or service case through provision and ask whether its conformity remains protected at every relevant handover.
Explore each numbered part
8.5.1 · establish the conditions for controlled delivery
Controlled delivery requires more than an instruction to follow the procedure. This guide explains clause 8.5.1 through manufacturing and IT service examples, connecting information, resources, competence, monitoring and release arrangements. It also clarifies when process validation matters and why human-error prevention should improve the work system rather than rely solely on reminders.
8.5.2 · identify outputs and keep their status clear
Identification prevents people acting on the wrong output or an unclear acceptance status. This guide explains clause 8.5.2 through manufacturing and BPO examples, distinguishing ordinary identification, status control and required traceability. It shows how to preserve the evidence needed for a traceable relationship without assuming every item or service needs a universal serial-number scheme.
8.5.3 · care for customer and provider property
Property entrusted to the organisation can include equipment, materials and information. This guide explains clause 8.5.3 through manufacturing and IT examples, showing how to establish identity and condition, protect appropriate use and respond when something is lost, damaged or unsuitable. It distinguishes property care from ownership transfer and from a blanket security or legal-compliance claim.
8.5.4 · preserve conformity as outputs move
An output can lose conformity after the work that created it. This guide explains preservation under clause 8.5.4 through manufacturing and software examples, including physical handling and digital transfer. It shows how to identify vulnerable stages, assign responsibility and evaluate suitable protection without prescribing identical packaging, storage or transmission controls for every organisation.
8.5.5 · manage post-delivery activities
Post-delivery responsibilities can continue after a product leaves the factory or a service milestone is accepted. This guide explains how to determine the support, maintenance and other activities that apply, connect them to customer and regulatory requirements, and retain useful evidence without promising unlimited service or inventing a universal warranty period.
8.5.6 · control production and service changes
A change to how work is delivered can invalidate an otherwise sound control. Clause 8.5.6 addresses review, authorisation and necessary action so conformity continues through changes. Explore practical manufacturing and BPO examples, the evidence to retain, and the distinction between delivery changes, QMS changes and changes to product or service design.
Frequently asked questions
Does clause 8.5 apply to service organisations?
Yes, where relevant to their provision. Information, customer property, status, changes and post-delivery commitments can all matter in a service process.
Must every product have an individual serial number?
No universal serialisation rule is imposed. Identification and traceability controls depend on the requirements and the need to ensure conformity.
Does responsibility always end at delivery?
No. Determine and meet relevant post-delivery requirements for the product or service and the circumstances.
Keep quality controls connected across the delivery path
Sterling can review production and service controls across teams and locations. Scoped implementation, employee learning and Effivity ISO & GRC automation software can support practical evidence and handovers. Independent bodies decide certification.
Explore Nonconformity Management for staff responding when provision deviates from requirements. Return to clause 8 operations for the wider system.