How many times have quality or EHS professionals participated in some version of this conversation?
“Sir or ma’am, the ISO management system requires top management to establish policies for quality, environmental performance, and occupational health and safety. We need the executive team’s involvement in defining the commitments and objectives.”
The CEO or President responds: “Just write something up and I’ll sign it.”
That response is common. It is also a warning sign.
A signature may demonstrate approval. It does not demonstrate leadership, ownership, understanding, or commitment.
The Policy Is Not an Administrative Document
ISO policies are often treated as paperwork required for certification.
The quality manager writes the Quality Policy. The environmental manager writes the Environmental Policy. The EHS manager writes the Occupational Health and Safety Policy. An executive signs each document, they are posted in the lobby, and employees are expected to memorize a few key phrases before the certification auditor arrives.
That is not leadership.
The policy is supposed to establish the direction of the management system. It should explain what the organization has committed to achieve and provide the framework for establishing meaningful objectives.
It should reflect:
The organization’s purpose and strategic direction
The products and services it provides
Its significant risks and opportunities
Customer and other interested-party expectations
Environmental impacts and compliance obligations
Occupational health and safety hazards
The organization’s commitment to improvement
The values executives expect leaders to apply when making decisions
If an executive had no meaningful role in establishing those commitments, the policy does not represent leadership’s direction, it represents what the quality or EHS manager hopes leadership will support.
Executives Do Not Have to Type the Policy
Top management does not need to sit in a conference room arguing over punctuation. The quality or EHS professional can facilitate the discussion, explain the applicable ISO requirements, prepare background information, and draft the document.
A consultant can also help organize the policy and ensure that the required commitments are addressed.
Drafting support is appropriate, outsourcing the decisions is not.
Top management must determine what the organization is willing to commit to, how those commitments align with the business strategy, and what resources will be provided to achieve them.
The executive team should be able to explain:
Why the policy contains its specific commitments
How those commitments relate to the organization’s strategy
What objectives were established from the policy
Who is accountable for achieving them
What resources have been provided
How performance is reviewed
What happens when the policy conflicts with cost, schedule, or production pressure
If leadership cannot answer those questions, the signature means very little.
Leadership Is More Than Policy Approval
ISO 9001, ISO 14001, and ISO 45001 all place responsibility for management-system effectiveness with top management.
Although each standard has a different focus, leadership expectations share several common themes.
Top management is expected to:
Accept accountability for the system’s effectiveness
Ensure policies and objectives are established
Align the management system with the organization’s strategic direction
Integrate requirements into normal business processes
Provide necessary resources
Communicate the importance of effective management
Support managers and employees in fulfilling their responsibilities
Promote continual improvement
Review performance and make decisions
Ensure the system achieves its intended outcomes
Executives may assign responsibilities, but they cannot delegate accountability and then disappear.
The quality manager is not accountable for every quality failure. The environmental manager is not accountable for every environmental decision. The EHS manager is not accountable for every injury or unsafe operational choice.
The executive team owns the business systems that produce those outcomes.
The Three Policies Should Mean Something Different
Organizations sometimes create three nearly identical policies by changing a few words, that misses the purpose of each management system.
Quality
The Quality Policy should reflect how the organization intends to consistently meet customer and applicable requirements, improve its processes, and strengthen customer satisfaction.
That commitment must influence product design, supplier selection, staffing, training, production, inspection, testing, release, and corrective action.
A company cannot claim commitment to quality while knowingly shipping nonconforming products to meet a deadline.
Environmental
The Environmental Policy should reflect the organization’s commitments to environmental protection, compliance obligations, and improved environmental performance.
Those commitments must influence purchasing, process design, waste management, emissions, water use, energy consumption, maintenance, emergency planning, and capital decisions.
A company cannot claim commitment to environmental protection while repeatedly deferring necessary controls because they do not generate production revenue.
Occupational Health and Safety
The Occupational Health and Safety Policy should establish commitments to safe and healthy working conditions, eliminating hazards, reducing risks, fulfilling applicable requirements, consulting and involving workers, and continually improving performance.
Those commitments must influence staffing, scheduling, equipment design, contractor selection, maintenance, production pressure, stop-work decisions, and resource allocation.
A company cannot claim that safety is a core value while rewarding leaders who meet production goals by bypassing required controls.
The Policy Matters When Priorities Conflict
A policy is easy to support when it costs nothing. The real test comes when:
Stopping production is expensive
A customer is waiting for an order
A required environmental control delays startup
A machine needs to remain out of service
A supplier fails to meet quality requirements
A worker stops a job because conditions changed
A corrective action requires capital funding
An audit identifies a weakness leadership would prefer not to address
A process is producing acceptable output through an uncontrolled workaround
This is where policy becomes governance. The policy should guide decisions when quality, environmental protection, worker safety, production, cost, and schedule compete.
If executives did not participate in establishing the policy, they may not feel bound by it when those conflicts occur.
That is why “Just write something and I’ll sign it” is so damaging. Leadership has approved the words without accepting the decisions behind them.
Objectives Must Follow the Policy
The policy should provide a framework for objectives. That does not mean filling a spreadsheet with generic goals such as:
Improve quality
Reduce waste
Work safely
Achieve zero incidents
Those are aspirations, not management objectives. Useful objectives should address meaningful risks, opportunities, obligations, and performance needs.
Examples may include:
Reducing customer complaints associated with a recurring defect
Improving first-pass yield in a critical process
Closing overdue corrective actions
Reducing a significant waste stream
Improving compliance-monitoring completion
Replacing equipment associated with repeated releases
Reducing ergonomic exposure in a specific task
Improving completion of safety-critical maintenance
Increasing worker participation in operational learning
Strengthening contractor qualification and oversight
Each objective should have ownership, resources, measures, deadlines, and a method for evaluating results.
If leadership signs the policy but refuses to fund the objectives, the organization does not have leadership commitment, It has executive handwriting.
Management Review Is Where Leadership Proves Ownership
Management review is often handled the same way as policy development. The quality or EHS manager prepares a large presentation, reports performance data, discusses audit findings, and identifies resource needs.
Executives listen, ask a few questions, and approve the meeting minutes.
Nothing changes.
A meaningful management review should produce management decisions. Leadership should evaluate:
Whether the system remains suitable, adequate, and effective
Whether objectives are being achieved
Whether resources are sufficient
Whether risks and opportunities have changed
Whether compliance obligations are being fulfilled
Whether corrective actions are effective
Whether customer, environmental, or safety performance is improving
Whether changes to the organization require changes to the system
What actions leadership will authorize
If the review produces no decisions, resource commitments, revised priorities, or assigned actions, it was probably a presentation rather than a management review.
What Should an Auditor Ask?
An auditor should not determine leadership commitment by verifying that the policy contains an executive signature. The auditor should speak with top management.
Useful questions include:
Why were these policy commitments selected?
How do they support the organization’s strategic direction?
What are the organization’s most important quality, environmental, and safety risks?
Which objectives are currently receiving executive attention?
What resources have been approved?
What recent business decision was influenced by the management system?
How are department leaders held accountable for performance?
What changes resulted from the last management review?
How does leadership know the system is effective?
What happens when production conflicts with a quality, environmental, or safety requirement?
The executive does not need to quote the policy from memory. The executive should be able to explain what it means and demonstrate how it influences decisions.
A Better Policy Development Process
Developing meaningful policies does not require weeks of executive meetings. A focused leadership session can establish the necessary direction.
Prepare the Inputs
The quality and EHS team should summarize:
Organizational context
Interested-party expectations
Significant risks and opportunities
Customer requirements
Environmental aspects and impacts
Compliance obligations
Occupational health and safety hazards
Current performance
Previous audit findings
Strategic business priorities
Facilitate the Leadership Discussion
Executives should discuss:
What the organization is trying to achieve
Which commitments are nonnegotiable
Where performance must improve
What behaviors are expected from managers
How conflicts between production and management-system requirements will be resolved
What resources leadership is prepared to provide
Draft the Policy
The quality or EHS professional can translate leadership’s decisions into clear policy language that satisfies the applicable standards.
Challenge the Draft
Executives should review the policy and ask:
Does this accurately represent our organization?
Are we prepared to honor these commitments?
Can we explain how they affect business decisions?
Are we willing to be held accountable for the outcomes?
Establish Objectives
The organization should convert the commitments into measurable objectives with defined ownership, resources, and timelines.
Communicate Through Action
The policy should be communicated to employees, but leadership behavior will communicate it more effectively than posters or orientation slides.
An Integrated Policy Can Work
Organizations using ISO 9001, ISO 14001, and ISO 45001 do not necessarily need three separate policies.
An integrated policy can be effective if it clearly addresses the commitments required for quality, environmental management, and occupational health and safety.
The format matters less than the substance.
Whether the organization uses one policy or three, each commitment should be appropriate to the organization and reflected in objectives, resources, operational controls, leadership decisions, and performance reviews.
Changing the company name in a generic template is not policy development.
If the same document could be posted at any factory, warehouse, hospital, construction company, or software firm without meaningful revision, it probably says very little about the organization.
A Signature Is Not Leadership
The current editions of ISO 9001 and ISO 14001 reinforce leadership accountability, strategic alignment, culture, and measurable performance. ISO 45001 already expects top management to take an active and visible role in occupational health and safety.
The direction is clear. Management systems are not side projects assigned to Quality or EHS. They are business systems that top management must lead.
The next time an executive says, “Just write something and I’ll sign it,” the appropriate response is: “I can prepare the draft, but the commitments must come from the leadership team. Before you sign it, we need to establish what this organization is prepared to own, resource (fund), measure, and enforce.”
That is not creating unnecessary work for executives, that is asking them to lead.
Appalachian EHS & Process Safety Consulting helps industrial organizations develop integrated ISO management systems, facilitate leadership-policy workshops, establish meaningful objectives, conduct internal audits, and evaluate whether executive commitment is visible in actual business decisions.