ISO 41001:2018: documentation and compliance requirements

This is what ISO 41001:2018 requires you to have, clause by clause, and what an auditor will ask to see for each of it. It covers 65 requirements across 7 areas.

It is deliberately not a checklist. A checklist asks whether you have something; this says what is required and what counts as evidence, which is the question that matters when you are building a system rather than testing one. If you would rather find out where you stand first, the same ground is covered by our free ISO 41001:2018 readiness assessment, which scores you out of 100.

4 Your organisation and what it needs from facilities

Clauses 4.1, 4.2, 4.3, 4.4.

You must have written down the outside things that affect facilities — property market, laws, safety rules, technology, energy costs, weather.

Evidence: A short list of these issues, with a note of when you last looked at it.

You must have written down the inside things — how the organisation is changing, occupancy, ageing buildings, skills, budget.

Evidence: The same list, covering internal issues.

You must know what the organisation you serve is actually trying to achieve.

Evidence: Their business plan or objectives. The facilities system exists to support these, not to run alongside them.

You must have listed everyone with an interest — the organisation you serve, staff and occupants, visitors, landlord, contractors, regulator, neighbours.

Evidence: A list of these groups and what each needs.

You must have asked the people who actually use the buildings what they need, rather than assuming.

Evidence: Occupant surveys, feedback or user group notes.

You must know which laws apply to the buildings — fire, health and safety, accessibility, energy, water, waste.

Evidence: A legal register with permits, certificates and expiry dates.

You must have written down what the facilities system covers — which buildings, sites, services and organisational units.

Evidence: A scope statement. Whether facilities are delivered in-house, outsourced or a mixture.

It must be clear who is the client and who is the provider, even if both sit inside the same company.

Evidence: The demand organisation and the facilities organisation named, and the boundary between them.

You must know what your main processes are and how they fit together.

Evidence: A process map or a list with owners.

5 Leadership

Clauses 5.1, 5.2, 5.3.

Senior management must be able to point to facilities decisions they made in the last year.

Evidence: Management review notes. Money approved. Ask them directly.

Facilities must be involved in property, workplace and organisational decisions before they are made, rather than told afterwards.

Evidence: Evidence of involvement at planning stage — a project, a move, a restructure.

You must have a written facilities policy.

Evidence: The policy, signed and dated, promising to meet requirements and to keep improving.

The policy must line up with what the organisation you serve is trying to do.

Evidence: The link between the two, in writing.

The must be policy shared with facilities staff, providers and building users.

Evidence: Where it is displayed or circulated.

It must be clear who is responsible for what — on the client side, in the facilities team and among providers.

Evidence: Organisation chart covering all three. A responsibility matrix showing who decides, who delivers and who checks.

People must know where their authority ends — what they can approve, and when they must escalate.

Evidence: Spending limits. Escalation routes. This is the commonest source of confusion in outsourced facilities, so ask the people concerned.

6 Planning

Clauses 6.1, 6.2.

You must have worked out what could go wrong with facilities, and what opportunities there are.

Evidence: A risk and opportunity list covering asset failure, service failure, safety and compliance, provider failure, cost and staffing.

Those must be risks dealt with in how you actually run things, not just listed.

Evidence: Controls built into service specifications and maintenance plans.

You must have set facilities objectives, and they must be able to be measured.

Evidence: Objectives with a target and a number.

The objectives must measure what the organisation actually needs — availability, safety, compliance, cost, comfort — rather than how busy the facilities team is.

Evidence: The link from the organisation's objectives to the facilities objectives. Counting jobs completed is activity, not outcome.

For each objective, it must be clear what will be done, by whom, by when, with what, and how you will judge it.

Evidence: An action plan covering all five points.

7 Support — people, information and documents

Clauses 7.1, 7.2, 7.3, 7.4, 7.5.1, 7.5.2, 7.5.3, 7.5.4, 7.6.

You must provide the people, money, tools and systems the facilities system needs.

Evidence: Budget covering both day-to-day and longer-term replacement. Staffing levels. Systems bought.

You must know the cost of work you have put off, and what that will mean later.

Evidence: A backlog maintenance list with the consequences.

You must know what skills each facilities job needs, including any ticket the law requires.

Evidence: A competence list by role. Statutory tickets — electrical, gas, working at height, confined space, water hygiene, asbestos, lifting.

You must be able to show the people doing the work — yours and your contractors' — hold those tickets and that they are in date.

Evidence: Certificates with expiry tracking. Contractor competence checks before they start.

You must be able to answer: Do facilities staff and providers know the policy, their part in it and what happens if things go wrong?

Evidence: Induction and awareness records. Ask them.

You must be able to answer: Do building users know what they need to know — how to report a fault, what to do in an emergency, the site rules?

Evidence: User guides. Signage. Induction for new starters and visitors.

You must have decided what to communicate about facilities, to whom, when and by whom.

Evidence: A communication plan or table.

There must be a way for users to report faults and make requests, and they must get an answer.

Evidence: A helpdesk or request system. Records of logging, priority, response and closure.

You must tell occupants in advance about work that will disturb them.

Evidence: Notification records for planned works and shutdowns.

You must have the documents and records the standard asks for.

Evidence: A list of documents and records held.

When a document is created or changed, it must be checked and approved before use.

Evidence: Approval on the document.

People must be able to find the current version where they need it, and are old versions removed.

Evidence: How documents are shared. Availability at the point of work.

Records must be kept for as long as required, including the long periods the law sets for building and safety records.

Evidence: A retention list.

You must have decided what facilities information and data you need to hold.

Evidence: A statement of the information needed — assets, drawings, manuals, compliance records.

You must have an asset register that is accurate, and when did you last check it against the buildings.

Evidence: The register with hierarchy, criticality and condition. The date of the last physical check. A register that has never been verified against reality is a common finding.

You must hold the drawings, manuals and as-built information you would need to run and repair the buildings.

Evidence: Operation and maintenance manuals. Drawings. As-built records from projects.

When a contract changes hands, you must get the data back and hand it over properly.

Evidence: Handover requirements written into contracts. Evidence data was actually transferred. Facilities data is most often lost at this point.

It must be defined what knowledge does facilities depend on, and what happens when a long-serving person or the incumbent contractor leaves.

Evidence: Site-specific knowledge written down. Plant history. Handover arrangements. Succession cover.

8 Delivering the services

Clauses 8.1, 8.2, 8.3.

You must have written down what each facilities service must deliver, and to what standard.

Evidence: Service specifications or scopes of work with performance criteria and response times.

You must have a planned maintenance schedule based on how critical each asset is and what the law requires.

Evidence: The schedule with its basis. Work orders showing planned work completed on time.

You must be able to answer: Are the statutory inspections and tests done on time — fire, electrical, water, lifting, pressure, gas?

Evidence: Certificates for each site with dates. Missed or overdue items flagged. This is the first thing an auditor checks.

You must handle reactive work within the times you agreed.

Evidence: Response and rectification times measured against the agreement.

It must be defined how do you choose facilities providers, and what do you require of them.

Evidence: Selection criteria. Tender and award records. Contracts stating the services, standards and performance regime.

You must check how providers are performing, using data you can trust.

Evidence: Performance reports with the source stated. Evidence you verify provider-reported figures rather than accepting them.

It must be defined what did you do the last time a provider let you down.

Evidence: Records of the issue, the remedy and any deduction applied.

You must plan properly for the start and end of a contract.

Evidence: Mobilisation plans. Exit arrangements covering data, assets, keys and knowledge.

You must coordinate with the people affected before you do work — occupants, the client, landlord, neighbours, authorities.

Evidence: Governance meetings with minutes at strategic, tactical and operational level. Access and out-of-hours arrangements agreed in advance.

Where more than one provider works on the same site, it must be clear who does what.

Evidence: An interface matrix or equivalent. Joint site meetings.

You must be able to answer: Are the different facilities services joined up, or do they run as separate contracts that do not talk?

Evidence: A single point of accountability. Shared systems, data and reporting across providers. Evidence of joint working.

You must have identified the gaps between services where things could fall through.

Evidence: The interface map. Records of a failure that happened in a gap, and what you changed.

9 Checking how you are doing

Clauses 9.1, 9.2, 9.3.

You must have decided what you will measure, why, and how often.

Evidence: A monitoring plan covering service delivery, compliance, asset condition, safety, energy, cost and user satisfaction.

You must know the performance data is reliable, especially where a provider reports on itself.

Evidence: Verification or spot-checking of provider-reported figures.

You must find out what building users think.

Evidence: Occupant satisfaction surveys or feedback with results and trends.

You must look at the results and act on them.

Evidence: Analysis and actions taken.

You must audit the facilities system, covering the whole standard over time.

Evidence: An audit programme covering the system, statutory compliance and provider performance. Audit reports and findings.

The auditors must be independent of the work they audit, and competent.

Evidence: Auditor training. Who audited what.

Senior management must review the system at planned intervals, with the client organisation taking part.

Evidence: Review dates and attendance, including someone from the demand side.

The review must cover everything the standard asks for.

Evidence: An agenda covering: previous actions, changes, performance and effectiveness, nonconformities, monitoring and audit results, objectives, feedback from interested parties, resources, improvement.

The review must produce decisions and actions, not just minutes.

Evidence: Decisions and an action list with owners and dates.

10 Putting things right and getting better

Clauses 10.1, 10.2, 10.3.

It must be defined when something goes wrong — a service failure, a missed inspection, an incident — you must deal with it and work out why.

Evidence: Nonconformity and corrective action records with root cause.

You must check whether the same problem exists at another site, on another asset or with another provider.

Evidence: Evidence you looked wider.

You must check later that your fix worked.

Evidence: A follow-up record with a date.

You must be able to show facilities performance is better than last year.

Evidence: Trends in service performance, compliance completion, asset condition, energy, cost and satisfaction. Completed improvements with measured results.

You must take action on problems that have not happened yet — spotted from condition surveys, trends or near misses.

Evidence: Preventive action records showing action taken before a failure. Note this is a separate requirement in ISO 41001, unlike ISO 9001.

Using this document

Nothing above asks for a manual, a template pack, or a filing system. It asks for decisions that have been taken deliberately and can be shown to have been taken — which is a far smaller job than most organisations expect, and a different one.

Length is not compliance. A procedure nobody follows is worse than no procedure, because an auditor finds the gap between the two. The test we apply is whether the person who has to do the job recognises their own work in what is written down.