How do you document customer satisfaction for an ISO 9001 audit?

Document customer satisfaction for an ISO 9001 audit with dated, scored records that show four things: which method you chose, who answered, what the results said, and what you did about them. That chain is what an auditor follows. Break any link in it and the finding writes itself.

Most firms fail this clause in one specific, avoidable way. They have the feedback. They do not have the method. Somebody sends a survey when they remember to, the answers sit in a mailbox, and nobody wrote down what the process is supposed to be. The auditor is not asking whether your customers are happy. They are asking whether you can demonstrate that you looked.

This guide covers what clause 9.1.2 actually says, what auditors accept as evidence, what records to keep, and where firms get written up. If you are earlier in the process, start with how to measure customer satisfaction for consulting services. For the mechanics of the records themselves, read how to document client feedback for service improvement.

What does ISO 9001 clause 9.1.2 actually require?

Two things, and firms usually only do the first. Clause 9.1.2 of ISO 9001:2015 (opens in a new tab) requires the organisation to monitor customers' perceptions of the degree to which their needs and expectations have been fulfilled. It then requires the organisation to determine the methods for obtaining, monitoring and reviewing that information.

Read the second sentence again, because it is the one that gets audited. The standard does not tell you how to monitor. It tells you to decide how, and the decision is yours to make and yours to evidence. A firm with a mediocre satisfaction score and a documented method passes. A firm with delighted customers and no method does not.

Note the word “perceptions”. You are not evidencing that the work was good. You are evidencing what the customer thought of it, which is a different measurement and one only the customer can supply. ISO 9000:2015 (opens in a new tab) defines customer satisfaction in clause 3.9.2 as the customer's perception of the degree to which their expectations have been fulfilled. Internal quality metrics do not substitute for it.

Does ISO 9001 require a customer satisfaction survey?

No, and the people who train the auditors say so in writing. This surprises almost everyone, including some consultants who sell survey software.

The ISO 9001 Auditing Practices Group is a joint group of ISO/TC 176 and the International Accreditation Forum. It publishes free guidance for the auditors who visit you. Its paper on customer feedback tells them there is no specific requirement in ISO 9001 to perform formal customer satisfaction surveys (opens in a new tab). A survey, it adds, can of course be a useful tool for the job.

The same paper lists methods an auditor should be prepared to accept, including:

• Face-to-face evaluation at the point of delivery.
• Telephone calls or visits made periodically or after delivery.
• Questionnaires or surveys, run in-house or by independent researchers.
• Contact through service or installation staff.
• Internal enquiries among your own people who deal with customers.
• Evaluation of repeat business.
• Monitoring of accounts receivable and warranty claims.
• Analysis of customer complaints.

There is a warning attached to that last one. Complaints are often the only feedback a customer volunteers, and the APG guidance is explicit that they must not be the sole input to monitoring perception. “No complaints” is not a satisfaction measurement. It is an absence of one.

So why do most organisations end up running a survey anyway? Because of the evidence problem, not the requirement. A survey produces a dated record with a number in it. A corridor conversation produces a memory. Both satisfy the clause; only one survives an audit three years later.

What counts as evidence in an ISO 9001 audit?

Objective evidence, which has a precise definition and a low bar that is nevertheless easy to miss. ISO 9000 defines objective evidence as data supporting the existence or verity of something, obtainable through observation, measurement, test or other means. The APG guidance for auditors adds the operative part. For audit purposes it generally consists of records, statements of fact or other information which are relevant to the audit criteria and verifiable (opens in a new tab).

Verifiable is the load-bearing word. It means a second person, looking at the same material, reaches the same conclusion. It rules out anything that depends on your say-so.

Two consequences follow, and they cut in opposite directions. The first is generous: the same APG paper reminds auditors that objective evidence does not necessarily require documented information, except where ISO 9001 specifically says so. You are not obliged to generate paperwork for its own sake. The second is strict: it is your job to provide the evidence, not the auditor's job to hunt for it. Being unable to find proof of conformity is not the same as conforming.

What documented information do you actually have to retain?

Clause 9.1.1 is where the retention requirement lives, and it applies to your satisfaction results. Clause 9.1.2 does not say “keep records” in so many words, which is why it gets skimmed. Clause 9.1.1 covers monitoring, measurement, analysis and evaluation as a whole, and requires the organisation to retain appropriate documented information as evidence of the results.

Practically, a clause 9.1.2 file that holds up contains five things:

1. The defined method. One page. Who you ask, when, how, who runs it, and what you do with the answers.
2. The raw results, dated. Every response, with the date it arrived, not a summary someone typed up afterwards.
3. The denominator. How many people you invited and how many replied. A score without a responder count is not verifiable.
4. The analysis. What the numbers meant, whether the trend is up or down, and what you compared them against.
5. The action. The improvement, corrective action or decision that came out of it, with a date and an owner.

Retention is your call. ISO 9001 sets no period, so define one and honour it. Three years covers a full certification cycle; keeping the cycle before it as well is what lets you show a trend rather than a snapshot. If the records identify individuals, that generosity has a legal limit, which the guide to documenting client feedback covers in detail.

Which clauses does customer satisfaction touch?

Five, and an auditor who finds a gap in one will walk straight into the next. Clause 9.1.2 is the entry point, not the whole exam.

The last row is where most nonconformities are raised. Feedback that never reaches a management review is data the system did not use, and a management system that does not use its data is the thing clause 9 exists to detect.

What will the auditor ask about your customer feedback process?

The APG guidance tells auditors to treat customer feedback as a process, not as a clause to tick. That single sentence explains why audits of this area feel more searching than the rest of clause 9. The auditor is following a chain, and they will keep pulling until it breaks.

The published guidance walks auditors through five questions. They are worth rehearsing before anyone shows up.

Two further things the guidance authorises, which catch firms off guard. Auditors are told to stay alert for signals that contradict your numbers — returned goods, warranty claims, revised invoices, credit notes, media coverage, consumer websites. And in some cases an auditor may verify information directly with your customers. A satisfaction file that disagrees with the credit notes is worse than no file at all.

How do you show your customer sample is representative?

State your sampling rule before the auditor asks, and base it on risk rather than convenience. The APG guidance accepts that asking every customer would often cost too much. It then tells auditors to check the rule you used, and to satisfy themselves that the sample is representative and reflects the risks to you and to your customers.

Which means the question is not “how many did you ask?” but “how did you choose?” Defensible criteria look like this:

• Every engagement above a value threshold, stated in the method, with no discretion at the point of sending.
• Every engagement of a given type — all long-term assignments, say, rather than a selection of them.
• All customers in a defined period, with the period fixed in advance.
• Every new customer's first delivery, because a first impression carries more risk than a tenth.

What is not defensible is choosing after the fact. If the person who selects the customers to survey is also the person the results reflect on, you have a selection problem, and it is visible from outside. Fix it structurally: fix the rule, then let the rule pick.

The APG paper adds a subtlety worth catching. You may have more than one category of customer, and they may see you differently. A firm can please the buyer who signs the contract and irritate the team who has to work with the output. Sampling only the signatory hides exactly the information the clause was written to surface.

How do you prove you analysed the results rather than just collected them?

Show a comparison. Collection is clause 9.1.2. Analysis is clause 9.1.3, and it is a separate requirement that names the degree of customer satisfaction explicitly. Auditors are told to follow the process through to what conclusions were drawn about the effectiveness of the quality management system.

The guidance suggests three questions to answer in writing. They are a good template for the analysis note itself:

1. Are there any trends? By category, not only in the overall average.
2. Is the situation stable, improving or deteriorating? Answer it in a sentence, and say against which period.
3. Are customer needs and expectations changing? The scores that moved will usually tell you.

This is where fixed questions stop being a preference and start being an evidence requirement. If you reword the survey each time, there is no trend to analyse, because nothing is comparable to anything. An auditor does not need to know statistics to notice that this quarter's questions are different from last quarter's.

Benchmarking against your industry is not required by ISO 9001, but the APG guidance says an auditor may reasonably ask about it to put your feedback in perspective. Having an answer costs nothing and signals a system that is genuinely being used.

What are the most common findings on clause 9.1.2?

Almost all of them are one of five failures, and four are process failures rather than data failures.

• No determined method. Feedback happens, but nobody defined how. This is the direct hit on the second sentence of the clause.
• A method that is not followed. The procedure says quarterly; the records show two rounds in three years. Writing a method you ignore is worse than writing a modest one you keep.
• Complaints used as the only input. Explicitly flagged in the auditor guidance, and a common shortcut in firms that rarely get complaints.
• Collection without evaluation. Scores exist; no analysis, no trend, no conclusion. Clause 9.1.3 is the one that gets cited.
• No route into management review. Clause 9.3.2 lists customer satisfaction as a required input. If it is not in the minutes, it did not happen.

There is a sixth that is not strictly a nonconformity but reliably draws attention: a perfect record. Every customer scoring at the top of the scale suggests an instrument that cannot detect dissatisfaction, and an instrument that cannot detect a problem cannot drive improvement. Fix it at the point of scoring. Tell responders that top marks are rare, and that a good engagement usually sits below them. The scores spread out, and a spread is both more honest and more useful to an auditor.

How does a professional services firm evidence this?

By measuring the people, because in professional services the people are the product. A manufacturer can point at returned goods and warranty claims. A consultancy has no returns. Its service is delivered by named individuals, in the customer's own building, and the customer's perception is a perception of them.

That makes per-engagement, per-consultant feedback the natural evidence base for clause 9.1.2 in a consultancy. It is also the only feedback granular enough to act on. A firm-wide satisfaction average tells you the year went fine. Scores per engagement tell you which team, which client and which category to fix, which is what clause 10 wants next.

Three engagement shapes cover most professional work, and each needs its own question set: long-term assignments inside a client's team, workshops and courses, and service delivered at a distance. Those are the client satisfaction surveys for consulting work, and each scores four fixed categories on the same 0–10 scale, so results stay comparable across clients, consultants and years.

Can a tool make you ISO 9001 compliant?

No, and treat any vendor who says otherwise as a source of future nonconformities. There is no such thing as an ISO 9001 certified survey tool. Certification applies to a management system, not to software, and the auditor audits your process rather than your subscriptions.

What a tool genuinely contributes is narrower. It is the part that is tedious by hand:

• A consistent instrument. The same questions every time, so a trend exists to analyse.
• Dated, retained records. Timestamps you did not have to maintain, kept where they will still be in three years.
• A visible denominator. Invited versus responded, recorded automatically rather than reconstructed.
• Independence from the person being rated. A neutral link instead of a request from the consultant whose work is in question.
• Verifiability. Results a third party can check at source rather than take on trust.

The method, the sampling rule, the analysis and the management review remain yours. No tool writes those, and an auditor will ask you for them, not for a login.

How does Feedback Journey fit a clause 9.1.2 file?

It supplies the record layer: fixed questions, dated responses, responder counts, and a summary a third party can verify. That is the part of the evidence chain that is fiddly to keep by hand and the part auditors examine most closely.

Concretely, four properties map onto what the clause and the auditor guidance ask for:

1. Fixed question sets per engagement type. Four categories, scored 0–10, unchanged between surveys — so clause 9.1.3 has a genuine trend to work with rather than a pile of incomparable forms.
2. Scoring guidance at the moment of answering. The scale is explained as the responder uses it. And 0 means “I don't know” rather than “terrible”, so a guess does not enter the data as an invented 7.
3. Responder counts and dates on every result. Invited versus responded, and the date of the most recent response, which is the denominator an auditor needs to judge whether the sample is representative.
4. A range you cannot curate. A verifiable proof of client satisfaction covers everything between a first and a last survey, with nothing removable from the middle. It carries a QR code, so the reader can check the figures at source. Selection is the first thing an auditor probes, and a fixed range answers it before it is raised.

The action step has a home too. A weak category becomes a documented improvement plan with a starting situation, an end date and a written conclusion. That is the shape clause 10 expects. It is also a tidier exhibit than a promise made in a meeting. For firms doing this across a team, client feedback for consultancy leaders aggregates the same records at department and organisation level. Responder personal data is handled under the privacy policy.

Does the ISO 9001:2026 revision change any of this?

Not in a way that spoils evidence you build now. ISO 9001:2026 is due out on 16 September 2026 (LRQA, publication date confirmed (opens in a new tab)). A three-year transition is expected, running to around September 2029. ISO 9001:2015 certificates stay valid the whole way through.

The revision leans towards quality culture, ethical behaviour, climate and organisational context. On performance evaluation, BSI's guidance (opens in a new tab) on the draft says the requirements remain unchanged. The obligation to find out what customers think, by a method you determined, is not going anywhere.

The practical read: do not wait for the new edition before fixing your clause 9.1.2 evidence. A method, dated records and a trend will satisfy both editions, and starting now is what gives you a comparison to show when the transition audit arrives.

Is there a standard that tells you how to do it properly?

Yes, and it is guidance rather than requirements, which is exactly why it is useful. ISO 10004:2018 (opens in a new tab) sets out guidelines for monitoring and measuring customer satisfaction. It covers planning what to gather, choosing a method, running the process, and reviewing what comes back.

You are not certified against ISO 10004 and no auditor will require it. Citing it in your documented method is nevertheless a cheap credibility signal, because it shows the method was designed against recognised guidance rather than invented on the day. For handling complaints as a feedback input, its companion is ISO 10002.

What does a minimum viable clause 9.1.2 file look like?

If you are starting from nothing, this is a defensible position within a month. Not gold-plated. Defensible.

1. Write the method on one page. Who you survey, the rule that selects them, when, by what instrument, who runs it, and where results are reviewed. Date it and give it an owner.
2. Fix the questions. Four scored categories per engagement type, and resist every request to customise them per client.
3. Run one round against the rule. Not the friendly clients. The ones the rule picks.
4. Record the denominator. Invited, responded, and the date of the last response.
5. Write half a page of analysis. Trend by category, stable or moving, one conclusion.
6. Put it on the management review agenda, and make sure the minutes carry both the numbers and the decision.
7. Open one improvement action against the weakest category, with an end date and an owner.

Seven steps, and the audit trail runs end to end. What makes it hold up next year is that you keep doing it the same way, which is also what makes the numbers worth reading. The habits behind that are covered in the guide to collecting feedback from business clients.

What to have ready on the day

• The documented method, current version, with a revision date.
• The raw responses for the period, dated, with invited and responded counts.
• The analysis note, naming the comparison period.
• The management review minutes where the numbers appear.
• At least one action that came out of the data, and its status.
• Your retention rule, and evidence you are following it.

Frequently asked questions

Sources

• ISO 9001:2015, Quality management systems — Requirements (opens in a new tab) — clause 8.2.1 customer communication, 9.1.1 monitoring and measurement including retained documented information, 9.1.2 customer satisfaction, 9.1.3 analysis and evaluation, and 9.3.2 management review inputs.
• ISO 9001 Auditing Practices Group, “Guidance on: Customer feedback” (opens in a new tab), Edition 1, 13 January 2016 — a joint ISO/TC 176 and IAF paper for certification-body auditors: no requirement for formal surveys, accepted monitoring methods, sampling criteria, the warning against complaints as the only input, and the five process questions an auditor works through.
• ISO 9001 Auditing Practices Group, “Guidance on: Evidence collection” (opens in a new tab), Edition 1, 13 January 2016 — the definition of objective evidence, the evidence-based approach, sampling, and the organisation's responsibility to provide evidence of conformity.
• ISO 9000:2015, Quality management systems — Fundamentals and vocabulary (opens in a new tab) — clause 3.8.3 objective evidence and clause 3.9.2 customer satisfaction.
• ISO 10004:2018, Quality management — Customer satisfaction — Guidelines for monitoring and measuring (opens in a new tab) — guidelines for planning, operating and reviewing a process to monitor customer satisfaction.
• LRQA, “ISO 9001 revision update: publication date confirmed” (opens in a new tab) — publication on 16 September 2026, an anticipated three-year transition, and ISO 9001:2015 certification remaining valid throughout it.
• BSI, “ISO 9001:2026 — key changes and guidance” (opens in a new tab) — the draft's emphasis on quality culture and organisational context, and the statement that performance evaluation requirements remain unchanged.

Build the evidence

Start collecting dated, comparable client scores today — fixed questions, responder counts included, free with no credit card.

Start free — no credit cardMore guides