ISO 21001:2025: documentation and compliance requirements

This is what ISO 21001:2025 requires you to have, clause by clause, and what an auditor will ask to see for each of it. It covers 81 requirements across 7 areas.

It is deliberately not a checklist. A checklist asks whether you have something; this says what is required and what counts as evidence, which is the question that matters when you are building a system rather than testing one. If you would rather find out where you stand first, the same ground is covered by our free ISO 21001:2025 readiness assessment, which scores you out of 100.

4 Your organisation and who it serves

Clauses 4.1, 4.2, 4.3, 4.4.

You must have written down the outside things that affect you — regulations, accreditation, funding, competition, technology, student numbers.

Evidence: A short list of these issues, with a note of when you last looked at it.

You must have written down the inside things — staffing, facilities, money, how you are organised.

Evidence: The same list, covering internal issues.

You must have listed your learners and everyone else who benefits — parents or guardians, employers, funders, government, the wider community.

Evidence: A list that separates learners from other beneficiaries. The standard treats them as different groups and most organisations only think about learners.

You must have written down what each group needs from you.

Evidence: Their needs and expectations recorded against each group.

You must know which rules apply to you — law, regulator, accreditation body, affiliating university.

Evidence: A register of legal, regulatory, accreditation and affiliation requirements, with review dates.

You must have written down what the system covers — which programmes, levels, ways of delivering, campuses and learner groups.

Evidence: A scope statement naming programmes, delivery modes (classroom, online, blended, work-based) and sites.

You must know what your main processes are and how they fit together.

Evidence: A process map or a list with owners.

5 Leadership and focus on learners

Clauses 5.1.1, 5.1.2, 5.1.3, 5.2, 5.3.

Senior management must be able to point to decisions in the last year that were made using this system.

Evidence: Management review notes. Academic board minutes. Staffing and resource approvals. Ask them directly.

You must find out what learners actually need, rather than assuming.

Evidence: Learner surveys, councils, representatives, feedback routes — with evidence you responded.

You must find out what other beneficiaries need — parents, employers, funders.

Evidence: Employer or parent engagement records.

You must be able to answer: Do learner outcomes, not just learner numbers, drive your decisions?

Evidence: Evidence a decision was made on the basis of results, progression or completion.

If you teach learners with special educational needs, that reflected must be in how you are led and organised.

Evidence: A policy and arrangements for special needs education. If you do not serve such learners, answer N/A and say why — an assumption that none of your learners has additional needs is not a reason.

You must have a written policy for the education system.

Evidence: The policy, signed and dated, promising to meet requirements and to keep improving.

The policy must match your educational mission and the ideas behind this standard — fair access, inclusion, honest conduct.

Evidence: The link between the policy and your mission.

It must be shared with staff and learners.

Evidence: Where it is displayed or published.

It must be clear who is responsible for what, on both the teaching and the administrative side.

Evidence: Organisation chart. Responsibility list.

6 Planning

Clauses 6.1, 6.2, 6.3.

You must have worked out what could go wrong and what opportunities there are.

Evidence: A risk and opportunity list covering academic, operational, safeguarding, financial and reputational risks, with actions and owners.

You must have set objectives, and they must be able to be measured.

Evidence: Objectives covering learning outcomes, progression and satisfaction, with targets and numbers.

For each objective, it must be clear what will be done, by whom, by when, with what, and how you will judge it.

Evidence: An action plan covering all five points.

It must be defined when something changes — a new programme, a new campus, a new delivery method, a rule change — you must plan it before you make it.

Evidence: Change records with the effects considered beforehand.

7 Support — staff, facilities and information

Clauses 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.2.1, 7.2.2, 7.3, 7.4, 7.5.1, 7.5.2, 7.5.3.

You must provide the people, money, facilities and systems the education system needs.

Evidence: Budget. Staffing. Facilities and equipment provided.

You must know what qualifications and skills each teaching and support role needs.

Evidence: A competence list by role, covering subject knowledge and teaching ability, and any qualification the law or regulator demands.

You must be able to show the people in those roles have them, and that any registration is current.

Evidence: Qualification and registration records with expiry tracking. Recruitment records.

You must develop your teaching staff, and check that the development works.

Evidence: Professional development plans and records. Teaching observation, appraisal or peer review.

You must be able to answer: Are the classrooms, laboratories, workshops, libraries and other spaces suitable and safe?

Evidence: Facility suitability records. Maintenance and inspection records. Health, safety and safeguarding arrangements.

You must be able to answer: Are your buildings, materials and digital platforms accessible to learners and staff with disabilities?

Evidence: Accessibility provision. Adjustments made.

The must be learning environment suitable — including how learners are treated and supported.

Evidence: Anti-bullying and wellbeing arrangements. Pastoral support. Learner conduct rules.

Where you measure or test things that matter, you must know the results can be trusted.

Evidence: Equipment calibration where relevant. Reliability checks on assessment instruments.

It must be defined what knowledge does the organisation depend on, and what happens if a key member of staff leaves.

Evidence: Course materials and schemes of work written down rather than held in one person's head. Handover arrangements.

You must know what competence each role needs and can you show people have it.

Evidence: Competence criteria and evidence per person.

If you serve learners with special educational needs, the staff must supporting them have the right training.

Evidence: Specialist training records. If not applicable, answer N/A with the reason.

Staff must and learners know the policy, their part in it, and what happens if things go wrong.

Evidence: Induction and awareness records for both. Ask them.

You must have decided what to communicate, to whom, when and how.

Evidence: A communication plan or table.

You must be able to answer: Does information reach part-time, distance and work-based learners as well as those on campus?

Evidence: Evidence of how each group is reached.

You must be able to answer: Is communication accessible — different languages, plain wording, formats for learners with additional needs?

Evidence: Translated or adapted material.

You must have the documents and records the standard asks for.

Evidence: A list of documents and records held.

When a document is created or changed, it must be checked and approved before use.

Evidence: Approval on the document.

Staff must be able to and learners find the current version of curriculum, assessment and policy documents.

Evidence: How documents are shared.

Learner records must be kept securely and for as long as the law or regulator requires.

Evidence: A retention list. Secure storage. Controlled access. Retention for awards is often very long.

8 Delivering the education

Clauses 8.1.1, 8.1.2, 8.1.3, 8.2, 8.3, 8.4, 8.5.1, 8.5.2, 8.5.3, 8.5.4, 8.5.5, 8.5.6, 8.6, 8.7.

You must have planned how each programme will be delivered, with the staff, timetable and resources it needs.

Evidence: Programme plans. Academic calendar. Timetabling. Resource allocation.

You must have set out what counts as acceptable learner performance and progression.

Evidence: Pass marks, progression rules, award criteria.

You must have a plan for when a tutor is absent or something disrupts delivery.

Evidence: Cover arrangements. Contingency for disruption.

If you serve learners with special educational needs, their requirements must be identified and met in how you deliver.

Evidence: Individual education or support plans. Adjustments to delivery, materials and assessment. Involvement of parents or specialists. Answer N/A with a reason if not applicable.

You must set out clearly what each programme requires and what it leads to, before learners enrol.

Evidence: Programme specifications with learning outcomes, entry requirements, duration, delivery mode, assessment and award.

You must give prospective learners honest information about fees, obligations and outcomes.

Evidence: Prospectus and pre-enrolment information. Fee schedule.

You must check you can actually deliver a programme before you offer it.

Evidence: A review before launch covering staff, facilities and approvals.

Admissions criteria must be applied consistently.

Evidence: Admissions records showing the criteria applied. Any exceptions and who approved them.

It must be defined when you design a new programme, or change one, is the work planned and approved.

Evidence: A design plan with stages, responsibilities and approvals.

You must write down what the programme must achieve before you design it.

Evidence: Design inputs: learner needs, regulatory and accreditation requirements, employer input, accessibility.

The design must outputs cover the syllabus, teaching methods, assessment design and the resources needed.

Evidence: The approved programme documents.

The must be design reviewed and checked by someone independent before it is delivered.

Evidence: Review, verification and validation records. External or independent input.

Design changes must be controlled, including their effect on learners already enrolled.

Evidence: Change records with the impact on current cohorts considered.

You must control what you get from outside — partner institutions, franchised delivery, guest lecturers, placements, outsourced services.

Evidence: A register of external providers. Agreements setting out what is required. Monitoring of their performance. Verification of teaching or assessment delivered by others.

You must check that delivery follows the plan — that the syllabus is covered and sessions happen.

Evidence: Attendance and session records. Syllabus coverage checks.

Assessment must be designed, conducted and marked in a way that is fair and secure.

Evidence: Assessment policy. Exam security arrangements. Plagiarism and academic integrity controls.

Marking must be moderated or double-checked.

Evidence: Internal moderation records. External examiner or verifier reports.

You must be able to answer: Can learners appeal a result or make a complaint, and are appeals dealt with in time?

Evidence: Appeals and complaints procedure with a register, outcomes and elapsed times.

You must be able to identify each learner's work and trace it through assessment.

Evidence: Identification and tracking of scripts, submissions and records.

You must look after property belonging to learners or others while it is with you.

Evidence: Records of items held. Reports of loss or damage.

You must protect learner work and records from loss or damage.

Evidence: Storage and backup arrangements.

You must tell learners what data you hold about them, why, and who you share it with.

Evidence: A privacy notice in plain language. A record of what learner data is held and its purpose. Consent records where you rely on consent.

Access must be to learner records controlled, and is data deleted when it should be.

Evidence: Access controls. A retention and disposal schedule. Controls over data held in third-party learning platforms.

When delivery has to change part-way through a programme, the must be change controlled and communicated.

Evidence: Change records. Evidence learners were told.

Results, progression and awards must be checked and approved by the right people before they are released.

Evidence: Results approval by an authorised body. Certificate and transcript controls.

It must be defined when something goes wrong — a marking error, syllabus not covered, an invalid assessment — it must be identified and put right.

Evidence: Nonconformity records. What was done for the learners affected, and who authorised it.

9 Checking how you are doing

Clauses 9.1, 9.2, 9.3.

You must have decided what you will measure, and how often.

Evidence: A monitoring plan covering achievement, progression, retention, completion and destinations.

You must find out what learners think.

Evidence: Learner satisfaction surveys with results and trends.

You must find out what other beneficiaries think — parents, employers, funders.

Evidence: Their feedback with results.

You must find out what staff think.

Evidence: Staff satisfaction or feedback records.

You must analyse the results and act on them.

Evidence: Analysis, comparison with previous cohorts, and actions taken.

You must audit the system, covering the whole standard over time.

Evidence: An audit programme. Audit reports and findings.

The auditors must be independent of the work they audit, and competent.

Evidence: Auditor training. Who audited what.

Senior management must review the system at planned intervals.

Evidence: Review dates and attendance.

The review must cover everything the standard asks for.

Evidence: An agenda covering: previous actions, changes, learner and beneficiary feedback, objectives met, process and programme performance, audit results, external provider performance, resources, improvement.

The review must produce decisions and actions, not just minutes.

Evidence: Decisions and an action list with owners and dates.

10 Putting things right and getting better

Clauses 10.1, 10.2, 10.3, 4.4.

You must look for ways to improve, rather than waiting for something to go wrong.

Evidence: Improvement register. Projects completed.

When something goes wrong, you must deal with it and work out why.

Evidence: Nonconformity and corrective action records with root cause, covering academic and administrative problems alike.

You must check whether the same problem exists on another programme, campus or cohort.

Evidence: Evidence you looked wider.

You must check later that your fix worked.

Evidence: A follow-up record with a date.

You must be able to show learner outcomes are better than before, not just that the paperwork is tidy.

Evidence: Trends in achievement, progression, retention, completion and destinations across cohorts.

You must be able to show that fair access, inclusion and social responsibility are real in how you operate.

Evidence: Admissions and fee policies looked at for fairness. Support for learners facing money, language or physical barriers. Participation and outcome data for under-represented groups. These are principles of this standard, not optional extras.

Using this document

Nothing above asks for a manual, a template pack, or a filing system. It asks for decisions that have been taken deliberately and can be shown to have been taken — which is a far smaller job than most organisations expect, and a different one.

Length is not compliance. A procedure nobody follows is worse than no procedure, because an auditor finds the gap between the two. The test we apply is whether the person who has to do the job recognises their own work in what is written down.