Not in my copy of the Standard, ISO 9001: 2008. It insists upon only 3 points of responsibility and authority:
They don't have to actually do part or any of the various tasks involved, but they must ensure that these requirements are met.
Now, there may be other responsibilities & authorities given in a particular organisation (I think it's an important role too, and that no one can do it without having the necessary authority, not just the responsibility), but these are the only 3 mandated.
As for whether they must be a member of management or not, again, the Standard is quite specific (my bold added):