I have designed and implemented processes in a software company that were certified ISO9001:2007. There have been updates to the standard since 2007 so there may be additional requirements that I am not aware of... however:
The ISO9001 standard is about ensuring that your company designs and implements processes that have feedback loops for improving the process when product and process defects are identified.
During the design phase the requirements focus on whether the proposed solution if implemented correctly would actually solve the design brief (validation) and checking whether the implementation actually has been implemented without defect (verification)
On the feedback loop, when defects are identified, it’s not enough that they are recorded. A defect also needs to be assessed for severity, and the rework prioritised.
The key part, is that how your particular company decides to assess its severity, and make decisions about priority is not defined by the ISO standard. It’s a commercial and governance issue for the company to decide and document.
As it is written into the standard as a requirement, any certified company will have a process around assessing the severity of a defect and a process in determining the priority of the work to fix the bug. They are definitely two seperate decisions that need to be made.
Severity of the bug is only one data point. Customer impact Is another data point. There’s also effort to fix, defect age, commercial life remaining in the product, and any other factor that the company decides to include in its decision making. The one thing it should not be written as “present defect to product manager to decide priority” as that only defines the authority to make the decision and does not define the process they they follow to make the decision.
I have a preference for prioritisation that is biased towards delivering a high rate of small and important changes, as this seems to provide the best boost to overall product reliability. This means that a severe bug that will take a lot of work to fix would need its work breaking down into smaller chunks to get sufficient priority to get scheduled.