Direct Answer: A sales management procedure is the documented process that governs how your organization communicates with customers, determines what they actually need, reviews those requirements, and decides the exact moment it becomes bound to supply. ISO 9001 places it at Clause 8.2 and ISO 13485 at Clause 7.2. Most organizations treat it as paperwork. It is the only control standing between a promise made in a hallway and an operation that has to keep it.
Somebody at your company said yes this week. You probably do not know who, and you almost certainly do not know what was promised. A customer asked whether you could handle something slightly outside the usual, and a capable person answered that yes, of course you could. That sentence is the most expensive one most businesses produce, and a sales management procedure exists for exactly one reason: to make sure that when it is said, the organization has already decided it can be kept.
A sales management procedure is the process almost nobody wants to write. It sits in the function where quality involvement is thinnest, it is defended by people who are measured on speed, and it looks from the outside like bureaucracy applied to the one part of the business that is finally working. Across 28 years, Management Systems International (MSI) has watched more downstream failures trace back to this process than to any other — and has watched more organizations refuse to write it than any other.
The Definition
What is a sales management procedure?
Define. Decide. Record.
A sales management procedure covers four connected activities: communicating with the customer, determining the requirements for the product or service, reviewing those requirements before committing to supply, and controlling changes to them after commitment. It is sometimes called a contract review procedure, which is the older term ISO itself used in earlier editions of the standard.
The scope is wider than the name suggests. It is not a procedure about selling. It is a procedure about the point at which selling becomes an obligation the rest of the organization has to discharge — and about everything that has to be known before that point is crossed.
The ISO 9001:2015 standard places this at Clause 8.2, Requirements for products and services, split into four subclauses: customer communication, determining the requirements, review of the requirements, and changes to requirements. ISO 13485:2016 places the equivalent work at Clause 7.2, Customer-related processes, with its own structure and its own additional obligations. Neither standard uses the phrase “sales procedure” anywhere. Both are describing one.
A well-built sales management procedure is short relative to its consequences. It runs a handful of pages, it is executed dozens or hundreds of times a month, and it is the moment at which the organization's capability and the organization's promises are either reconciled or permitted to drift apart. MSI's guide to what makes an effective ISO procedure applies here with more force than anywhere else in the standard.
The Objection
Why sales teams resist a sales management procedure — and why they are not wrong
Speed. Trust. Friction.
Sales professionals resist a sales management procedure because most of the ones they have been handed genuinely did slow them down. The objection is empirical, not cultural. A procedure that routes every order through the same review regardless of size is bypassed within a month, and the people who bypass it are usually right to.
It is worth stating the objection properly rather than dismissing it, because a sales management procedure the sales function does not believe in is a document, not a control.
Sales is measured on speed. Every gate between a customer saying yes and an order being accepted reads, from inside the quota, as time taken away from the next opportunity. That is not obstinacy. It is the incentive structure working as designed.
A control implies the judgment is not trusted. Sales professionals are hired precisely for judgment — for knowing what the company can deliver, which customers are worth stretching for, and which requests are trouble dressed as revenue. A sales management procedure that appears to replace that judgment with a form is insulting, and experienced people treat it accordingly.
Most procedures they have seen were written by people who have never sold anything. They show it. They route a repeat order for a standard item through the same five signatures as a first-of-kind build. They demand information the customer has not provided and will not provide at that stage. They were written to satisfy a clause rather than to govern work, which is the failure pattern MSI describes in its analysis of why an AI-drafted ISO 9001 procedure looks correct and operates as though it were not there.
And they have seen procedures used to assign blame. When the record exists only to establish who approved something that later went wrong, nobody volunteers to be the approver.
The reason to write a sales management procedure is not that sales cannot be trusted. It is that judgment does not survive being distributed across five people who have never compared notes.
Here is the answer to each objection, and it is a design answer rather than a cultural one.
Speed is addressed by routing. A competent sales management procedure defines a light review path and a full review path, both fully compliant, and small routine work never carries the controls built for first-of-kind work. Trust is preserved because the procedure captures the questions, not the answers — the judgment stays with the person who has it, and only the fact that the question was asked becomes a record. Availability is addressed by naming an alternate for every gating role, so no commitment waits on one person being on a plane.
And the blame problem inverts. When a commitment goes bad and there is no record, the exposure lands entirely on the individual who made it. When the review happened and was recorded, the decision belongs to the organization. A good sales management procedure protects the salesperson more than it protects anyone else in the building. That argument, made once and made honestly, converts more sales teams than any amount of clause citation.
The Central Decision
The commitment point: the one decision the procedure exists to force
Bound. Named. Written.
The commitment point is the exact moment your organization becomes bound to supply. Every sales management procedure is built around it, because the standard requires review before commitment — and a requirement to act before a moment is unauditable until the moment is defined.
Ask three people in most organizations when the company becomes committed and you will get three answers. When the quote is issued. When the customer sends a purchase order. When the order is entered into the system. When someone says yes on the phone. All four are defensible. Only one can be the procedure's answer.
While one person sells, this ambiguity costs nothing. Their judgment is usually sound — they know what the plant can run, what the team can staff, what the lead time really is. The decision lives in their head and it works.
Then you hire four more people who can say yes to a customer.
Nothing has changed on paper. But what used to be judgment is now exposure, because there are five versions of it and none of them has been written down. This is the pattern MSI has watched most often in growing organizations, and it is why the sales management procedure is usually the right process to document first when a company is scaling. It is the one that touches revenue, and it is the one where informality converts into cost fastest.
The sales management procedure resolves this by enumerating every channel a commitment can arrive through — the formal purchase order, the emailed request, the verbal agreement at a trade show, the contractor booked over the phone, the change requested mid-project and confirmed in a corridor. Each channel gets the same question: at what point in this route are we bound? Answer it once, deliberately, and the organization stops discovering the answer afterwards.
The Requirement
What ISO 9001 Clause 8.2 actually requires
Communicate. Determine. Review.
ISO 9001 Clause 8.2 requires four things of a sales management procedure: defined customer communication including contingency arrangements, determination of requirements including the claims the organization can actually meet, review of five categories of requirement before committing to supply, and controlled handling of changes afterwards.
Clause 8.2.1 covers customer communication and names five activities: providing product and service information, handling enquiries, contracts and orders including changes, obtaining customer feedback and complaints, handling or controlling customer property, and establishing specific requirements for contingency actions when relevant.
Clause 8.2.2 covers determining requirements, and carries an obligation organizations routinely overlook — that the organization can meet the claims it makes for what it offers. That is a marketing control hiding inside a quality clause.
Clause 8.2.3 is the review itself, conducted before committing to supply, covering five categories: requirements specified by the customer including delivery and post-delivery activities; requirements not stated by the customer but necessary for the specified or intended use, when known; requirements specified by the organization; applicable statutory and regulatory requirements; and any contract or order requirements differing from those previously expressed. The standard also requires that documented information on the results of the review, and on any new requirements, be retained.
Clause 8.2.4 handles changes, requiring that relevant documented information be amended and relevant people made aware when requirements change. MSI covers the wider discipline in its analysis of ISO 9001 change management, and the parallel obligation on the delivery side in the production and service provision procedure.
Read the text in the ISO Online Browsing Platform and the whole of Clause 8.2 runs under a page. Everything difficult about it is in the operating decisions the clause does not make for you.
The Routing Decision
How to route light and full review without using order value
Criteria. Not. Value.
A sales management procedure should route review depth on characteristics of the work, never on order value. Value measures what the order is worth to you. It says nothing about what could go wrong, which is the only thing review depth should respond to.
The value threshold is the most common routing rule in circulation and the least defensible one. It is easy to write, easy to audit, and wrong in both directions: it sends a large repeat order for a catalogue item through the full gauntlet, and it waves through a small first-of-kind item with a novel tolerance, an unfamiliar regulatory pathway, or a delivery date nobody has checked against the schedule.
MSI applies the same principle in risk management procedure design and in supplier control: route on effect, never on spend. A two-dollar component in a critical position carries exposure no financial threshold can detect. The same logic governs a sales management procedure.
Characteristics that should trigger full review, stated as criteria a person can apply without interpretation:
- Anything not previously supplied in this configuration to this specification.
- Any customer-specified requirement that differs from your standard offering, however small.
- Any statutory or regulatory requirement not already established for this product family.
- Any delivery commitment inside your stated standard lead time.
- Any requirement whose feasibility depends on a supplier you have not yet confirmed.
- Any order arriving through a channel that bypasses the normal route.
Everything else takes the light path — a defined, recorded, genuinely faster review. Both paths satisfy the standard. That distinction is what makes the procedure survivable, and it is the single most effective concession a quality function can make to a sales function without giving up any control that matters.
The Question Set
Requirements not stated but necessary: the questions most teams skip
Ask. Confirm. Record.
Clause 8.2.3.1 b) requires review of requirements the customer has not stated but which are necessary for the specified or intended use. A sales management procedure makes this operable by converting it into a fixed question set a reviewer can actually answer, rather than leaving it as an instruction to be thorough.
This is the requirement most often reproduced verbatim into a sales management procedure and then never performed, because as written it asks a person to identify what nobody has told them. Restated as questions, it becomes routine work:
- What will this actually be used for, and is that the use we are designing and testing against?
- What environment will it operate in — temperature, handling, duty cycle, storage — that the customer has not specified?
- What will it connect to, sit inside, or be installed alongside?
- What regulatory regime applies where this is going, as opposed to where it is made?
- What does the customer assume we are providing that is not written down — documentation, packaging, training, certificates, spares?
- What has gone wrong for other customers using this in a similar way?
MSI client experience suggests this question set does something a compliance argument never predicts: it improves the sale. Asking a customer what a product will sit next to, or which certificates they need at goods-in, surfaces things they had not considered and reads as competence rather than interrogation. Organizations typically report that the review conversation itself becomes a differentiator, particularly in technical and regulated buying, where the supplier who asks better questions is visibly the one who has done this before.
The same pattern shows up wherever requirements arrive incompletely — in engineering firms confirming design inputs, in scientific service providers scoping a study, and in professional service firms defining a matter. Unstated requirements are not an ISO abstraction. They are the ordinary condition of receiving work.
The Missing Clause
Why the contingency requirement in Clause 8.2.1(e) went missing
New. Unmapped. Forgotten.
ISO 9001 Clause 8.2.1(e) requires establishing specific requirements for contingency actions when relevant. It arrived new in the 2015 revision with no predecessor in the 2008 edition — so it appeared in no correspondence table, and most organizations transitioning never encountered it. Most of the sales management procedure drafts MSI has reviewed since still make no mention of it.
The mechanism is worth understanding, because it explains a whole category of quiet nonconformity.
When organizations moved from ISO 9001:2008 to ISO 9001:2015, most worked from a correlation matrix — old clause on the left, new clause on the right — published on the ISO/TC 176/SC 2 open access site and reproduced by registrars everywhere. It was an efficient way to transition, and for the great majority of requirements it worked.
It works only for requirements that existed before. A requirement genuinely new in 2015 has nothing on the left-hand side of the table. It is not flagged as missing, because the table is not built to flag absence — it is built to map correspondence. Clause 8.2.1(e) fell into that space and was never picked up.
Then the qualifier finished the job. “When relevant” is an invitation to conclude that it is not, and in the absence of anyone having read the clause in the first place, that conclusion is reached by default.
This is the same failure mechanism as Clause 8.5.1(g), the human-error prevention requirement also new in 2015. Both arrived without a predecessor. Both fell through the correspondence tables. Both are still missing from procedures that have passed a decade of surveillance audits — because an auditor sampling against a procedure cannot find a requirement the procedure never claimed to address.
Contingency, in the context of a sales management procedure, runs in two directions. Outward: what have you committed to do if you cannot supply — notification periods, alternate sourcing, priority rules between customers when capacity is short. Inward: what do your customers' contracts already require of you in that event, and does anyone in operations know? Both belong in the procedure. Neither is usually there.
The Unrequired Section
What happens when you cannot deliver
Tell. Early. Someone.
No clause requires a sales management procedure to define who tells the customer when a commitment cannot be met, or when. That is precisely why almost no procedure contains it — and why the failure is handled improvised, late, and by whoever happens to notice.
Capacity is lost. A supplier fails. A test comes back wrong the week before shipment. Every organization experiences this, and most handle the operational half well — they rework, they expedite, they find another source. The half they handle badly is the communication, because nobody owns it.
The questions a sales management procedure should answer, and typically does not: who decides that a commitment is at risk rather than merely tight? At what threshold does the customer get told — a day of slippage, a week, any at all? Who makes that call, and who makes it when that person is unavailable? What is offered alongside the notification, so the conversation is not purely bad news? And where is it recorded, so the pattern becomes visible before it becomes a customer's decision to leave?
Customers forgive the failure far more readily than they forgive the silence. The failure is a supply problem. The silence is a character judgment.
This is where a sales process connects to the rest of the management system rather than sitting beside it. Late notification generates complaints, complaints generate corrective action, and unexamined patterns of late delivery are among the most reliable predictors of declining customer satisfaction and of the returns and disputes that follow.
Medical Device
How ISO 13485 Clause 7.2 diverges from ISO 9001
Training. Notices. Regulators.
A device organization's sales management procedure sits at ISO 13485 Clause 7.2, not Clause 8.2. It carries two obligations with no ISO 9001 counterpart — determining any user training needed for safe and specified use, and communicating advisory notices — plus communication with regulatory authorities that the quality standard never contemplates.
ISO 13485 predates the harmonized ten-clause structure, so its numbering does not map across. Anyone adapting a Clause 8.2 sales management procedure by renumbering it will produce a document missing requirements the standard genuinely contains, which is the core argument in MSI's ISO 13485 Gap Analysis resource.
Clause 7.2.1 d) — user training. The organization must determine any user training needed to ensure specified performance and safe use of the device. This is a determination made during requirements review, at the point of commitment. It has no equivalent anywhere in ISO 9001, and it is routinely absent from device procedures adapted from quality templates.
Clause 7.2.3 d) — advisory notices. Customer communication must include arrangements for advisory notices, which connects the sales process to post-market surveillance and field action. A quality-derived sales management procedure has nowhere to put this.
Communication with regulatory authorities. Clause 7.2.3 extends the communication obligation beyond the customer entirely.
The stakes changed on February 2, 2026, when the FDA Quality Management System Regulation took effect, incorporating ISO 13485:2016 by reference into 21 CFR Part 820. Clause 7.2 is now a federal requirement for finished device manufacturers, and the agency's published QMSR guidance confirms the scope. MSI covers the rule in detail in its QMSR and Part 820 alignment analysis and its ISO 13485 management review guide.
One further obligation arrives from law rather than from either standard. Under Section 506J of the Federal Food, Drug, and Cosmetic Act, manufacturers of certain devices must notify the FDA of a permanent discontinuance or manufacturing interruption likely to cause a meaningful supply disruption — an obligation that applies during or in advance of a declared public health emergency. The FDA's supply chain and shortages guidance and its 506J notification FAQ set out when it applies. No clause checklist will ever point a device organization at it, which is exactly why a sales management procedure written for devices has to carry it anyway.
Organizations running both standards face a further decision, covered in MSI's guidance on integrated management systems: one procedure or two. One works, provided every point of divergence is named, the stricter requirement is taken as the house standard, and the reason for each decision is recorded rather than reconstructed in the audit room.
The Evidence
The records a sales management procedure has to produce
Located. Owned. Retained.
Every record a sales management procedure generates needs three things stated: where it lives, which role owns it, and how long it is kept. A records table with blanks in it is not an administrative oversight — to anyone examining the system, an undetermined field reads as a decision that was never made.
The minimum set a sales management procedure must produce: the requirements review record itself, capturing the five review categories and the outcome; the record of new requirements identified during review; the resolution of any differences between what was quoted and what was ordered; the communication log covering enquiries, feedback and complaints; the change record for requirements amended after commitment; and, for devices, the advisory notice and user training determinations.
The review record is the one that matters most, and its design decides whether the sales management procedure works. Built as a gate — completed before commitment, with the commitment conditional on it — it performs the control. Built as a form filled in afterwards for the file, it documents a control that did not happen. The distinction is invisible in an audit that only checks the record exists, which is why so many organizations hold a decade of review records for reviews that were never actually conducted.
MSI's guidance on QMS documentation covers the wider discipline, and the internal audit planning guide explains how to sample this process in a way that tests sequence rather than existence.
The Test
How to tell whether your sales management procedure actually works
Busy. Week. Test.
The test for a sales management procedure is not whether it passes an audit. It is whether it is followed on a busy week by the people least inclined to follow it — because a procedure that is bypassed under pressure is providing no control at exactly the moment control matters.
Three questions separate a sales management procedure that governs work from one that describes it.
Could someone who has never seen your system take an enquiry through to an accepted order using only this document? If they would need to ask a colleague which orders go which way, the routing criteria are not yet criteria.
Does every gating role have a named alternate? If review waits on one person, the procedure is bypassed the first week that person is unavailable — and the bypass, once discovered to be survivable, becomes the process.
Would the record produced last Tuesday show what was actually reviewed? Not that a review occurred. What was examined, what was found, what was decided.
MSI's experience across 200+ audits attended is that this process is rarely cited for the absence of a sales management procedure. It is cited for the order that went out without one, the review record signed after shipment, the change accepted verbally and never propagated. The document existed. The work went around it.
Start Free — No Download
Score your own contract review process in under five minutes
The Sales Management Maturity Check scores your process across eight elements — inquiry capture, requirements determination, review before commitment, resolution of differences, records, change control, contingency, and competence — on coverage and on whether it holds up on a busy week. Choose the ISO 9001 path, the ISO 13485 path, or both. Your score and band appear immediately, with nothing to enter and nothing to download. There is a genuine Controlled band that tells you to stop, because an assessment that fails everyone is not an assessment.
Build Or Buy
Writing one from scratch, or starting from a worked example
Adopt. Adapt. Audit.
The hard part of writing a sales management procedure is not the structure. Any outline gives you that. The hard part is knowing which decisions the procedure has to force — the commitment point, the routing criteria, the notification threshold, the contingency arrangements — and what a defensible answer to each one looks like in an organization like yours.
Structure without those decisions produces the document most template libraries sell: a scope statement, a responsibilities table with role names to fill in, a records table with retention periods left undetermined, and a procedure body that restates the clause rather than telling anyone what to do on a Tuesday. It passes its first audit because it exists. The blanks are still there at the third surveillance visit.
The Template & Guide — $149
The complete procedure, with the judgment calls already made
A complete working procedure in editable Word — 25 pages, written as a filled-in worked example rather than an outline. The commitment point defined explicitly, light and full review routing decided on criteria rather than order value, the unstated-requirements question set turned into questions a reviewer can answer, and the contingency path most procedures never mention. Three appendices included, not sold separately: the requirements review record built to work as the gate, the customer communication and complaint log, and the desk-level contract review work instruction. Choose the ISO 9001 version (Clause 8.2) or the ISO 13485 version (Clause 7.2) on the product page.
See the template — ISO 9001 or ISO 13485 →
Running both standards? The integrated ISO 9001 + ISO 13485 version carries both scopes in one document, with every divergence between the standards named, decided, and recorded. Browse the full ISO procedure templates and guides library.
If structured help mapping your own processes is the better route, a planning session is where that starts — a straightforward conversation about where your procedures actually stand. Call MSI at 760-434-9141. For organizations building a system from the ground up, SurePath carries the work end to end, and SureResults maintains it afterwards. Where the question is how far documented practice has drifted from actual practice, The Portrait is the independent look. Broader ISO consulting support spans all five standards MSI implements.
And if leadership has not yet decided whether a formal management system is worth the investment at all, that is a different question and a better starting point. MSI's ISO Executive Decision Briefs are free leadership-level videos on cost, timeline, and the business case — watch them before committing anything.
Questions
Sales management procedure: frequently asked questions
Ask. Answer. Apply.
Is a sales management procedure actually required by ISO 9001?
ISO 9001 does not require a documented procedure by that name. It requires the activities in Clause 8.2 to be performed and specific documented information to be retained. In practice, organizations that do not write it down cannot demonstrate the review happened before commitment, which is the part the standard is explicit about. The document is optional. The evidence is not.
Is this the same thing as a contract review procedure?
Effectively yes. Contract review is the older term ISO used in earlier editions, and many organizations still call it that. A sales management procedure is slightly wider, covering customer communication and requirement changes as well as the review itself. If your existing document is called a contract review procedure, the name is not the problem.
Our sales team will never follow a procedure. What do we do?
Find out why they will not, because the answer is usually specific and usually fair. The most common reasons are that review depth is routed on order value so routine work carries first-of-kind controls, and that a single named approver becomes a bottleneck. Fix the routing criteria, name an alternate for every gating role, and the objection generally disappears. If it does not, the remaining problem is a real one worth hearing.
How long should a sales management procedure be?
Long enough that the decisions are made in it, short enough that people read it. Around twenty to thirty pages including appendices is typical for a complete one, with the procedure body itself considerably shorter and the record forms, log, and desk-level work instruction accounting for the rest. Length is a poor proxy for quality either way — a four-page sales management procedure with every decision made beats a forty-page one that restates the clause.
Does ISO 13485 need a separate procedure from ISO 9001?
Not necessarily, but you cannot simply renumber one into the other. ISO 13485 Clause 7.2 carries user training determination and advisory notices with no ISO 9001 counterpart, and adds communication with regulatory authorities. One integrated procedure works if every divergence is named and decided rather than averaged, and the stricter requirement is adopted as the house standard.
What is the most common finding against this process?
Not an absent procedure. It is evidence that commitment preceded review — an order acknowledged before the review record was completed, a change accepted verbally and never propagated to the people who had to deliver it, or a review record signed retrospectively. The control failed on sequence, not on existence.
Will ISO 9001:2026 change any of this?
The next edition of ISO 9001 is expected to publish in September 2026, with a transition period to follow. The underlying obligations around determining and reviewing customer requirements are long-standing and are not expected to be removed. Organizations writing this procedure now should build it well rather than wait — MSI's coverage of the ISO 9001:2026 revision tracks the development, and ISO publishes the current status on its standard development page.
We are not pursuing certification. Is this still worth writing?
Yes, and this is the process where that is most obviously true. The problem it solves — several people able to commit the organization, with no shared definition of when commitment occurs — arrives whether or not a standard is ever pursued, and it arrives at exactly the point a company is trying to grow. If certification comes later, nothing written now has to be redone. The wider case for certification is a separate decision.
Related Reading
- Effective ISO procedure: the test that matters
- Risk management procedure template: ISO 9001 and 13485
- Production and service provision procedure
- ISO 9001 quality management standard
- ISO 13485 medical device standard
- Choosing your ISO implementation lead
- Internal audit services
- ISO 9001 design and development process
References and primary sources
- International Organization for Standardization — ISO 9001:2015, Quality management systems — Requirements
- ISO Online Browsing Platform — ISO 9001:2015 clause text
- ISO/TC 176/SC 2 — Open access resources and transition correlation matrices
- International Organization for Standardization — ISO 13485:2016, Medical devices — Quality management systems
- International Organization for Standardization — ISO 9001 next edition, development status
- International Organization for Standardization — ISO 9000 family of quality management standards
- U.S. Food and Drug Administration — Quality Management System Regulation (QMSR)
- U.S. Food and Drug Administration — QMSR frequently asked questions
- Electronic Code of Federal Regulations — 21 CFR Part 820
- U.S. Food and Drug Administration — Medical device supply chain and shortages
- U.S. Food and Drug Administration — Section 506J notification FAQ
- U.S. Food and Drug Administration — Medical Device Single Audit Program (MDSAP)
- American Society for Quality — ISO 9001 resources
- Global ACI — International accreditation and conformity assessment
About Management Systems International (MSI)
Diana Lynn is President and Principal ISO Consultant at Management Systems International (MSI), a consulting firm she co-founded in 1998. With 28 years of experience including extensive AS9100 work in MSI's early years, MSI's track record includes 80+ certifications supported, 200+ audits attended, and 600+ professionals trained across manufacturing, technology, medical device, government, healthcare, and other regulated industries. Today MSI implements ISO 9001, ISO 13485, ISO 14001, and ISO 45001, with an expanding focus on ISO 7101 healthcare quality.
MSI is veteran-owned and female-owned. msi-international.com · 760-434-9141
