What an auditor may check first under ISO 9001:2026

Two questions from the comments on ISO’s launch stream for ISO 9001:2026 stayed with me. The first asked what third party auditors are likely to examine when auditing an organisation against the new edition. The second asked how an organisation can demonstrate that quality is genuinely embedded in its culture.

These questions may appear different, but they lead to the same conclusion. Many of the revised requirements cannot be demonstrated by presenting a policy or procedure alone. An auditor will want to understand what happens in practice. They are likely to speak to people, observe how work is carried out and follow the records behind important decisions.

During a transition audit, the revised requirements are an obvious place to begin. In particular, there are three areas that organisations should be ready to demonstrate.

Quality culture will be tested through your people

ISO 9001:2026 places greater emphasis on the role of top management in promoting a culture of quality and ethical behaviour. It also expects people across the organisation to understand how their actions contribute to quality.

A common response will be to create a quality culture policy, add the subject to the management review pack and include a slide in induction training. These documents may support the requirement, but they cannot prove that the culture exists in everyday work.

To understand the real culture of an organisation, an auditor may speak directly to operators and ask a simple question: what happens when you stop the line because something does not look right?

In an office or service business, the wording may be different, but the purpose of the question remains the same. The auditor wants to understand whether employees feel able to raise concerns and whether those concerns are taken seriously.

If an operator explains that the supervisor thanks them, investigates the problem and supports the decision to stop the process, this provides meaningful evidence of a quality culture. It shows that the organisation’s stated values are reflected in its actions.

If the operator pauses, looks towards the supervisor or says that the response depends on who is working that shift, the auditor may reach a very different conclusion. In that situation, the policy on the wall may not reflect what actually happens.

This also helps answer a question that appeared in the launch comments: how can an organisation demonstrate top management commitment when senior managers attend meetings but do little else?

The requirement sits with top management, but the effects of leadership should be visible throughout the organisation. The answers given by employees provide some of the clearest evidence of whether management has successfully promoted a culture of quality.

Before an external auditor asks these questions, speak to three operators yourself. Ask what happens when they identify a quality concern or stop a process. You may already have an idea of what they will say, but it is better to hear the answer from them first.

Auditors will expect to see evidence of opportunities

Risks and opportunities previously appeared together and were often treated as one activity. In practice, this usually meant that organisations concentrated on risks while giving opportunities much less attention.

Since 2015, I have audited hundreds of organisations against the previous edition of the standard. Almost every organisation showed me a risk register, but very few could clearly demonstrate how they had identified, evaluated and acted on an opportunity.

Under ISO 9001:2026, auditors are more likely to examine opportunities as a distinct part of the management system.

An opportunity could be a process that can be simplified, a customer requirement that can be met ahead of schedule, a supplier relationship that can be strengthened or an inspection step that can be removed because the available data shows that the process is stable.

The important point is not simply that an opportunity existed. The organisation should be able to show how it was identified, how it was evaluated and what decision was made. If the organisation chose not to pursue it, there should still be a clear reason for that decision.

Removing an unnecessary inspection step, for example, can save a business a significant amount of time and money. However, I have rarely seen organisations formally recognise and record this type of improvement as an opportunity.

Think of one opportunity your team acted on during the past year. Then ask whether you could explain to an auditor where it came from, how it was evaluated, what was decided and what result it produced. If that story is difficult to demonstrate, this is an area worth reviewing before your transition audit.

Climate change requires a considered and recorded decision

Since the climate action amendment introduced in 2024, organisations have been required to determine whether climate change is a relevant issue for their management system. This consideration continues under ISO 9001:2026.

This does not mean that every organisation must create a large climate programme. It means that the organisation must consider the issue and reach a reasoned conclusion.

Deciding that climate change is not relevant may be a legitimate answer, provided the organisation can demonstrate that the question was properly considered. An auditor is therefore likely to look for both the decision and the reasoning behind it.

The simplest evidence may be a management review record showing that climate change was raised, discussed and assessed. The conclusion should reflect the context of the organisation and the needs and expectations of its interested parties.

This is where some organisations may discover an unexpected gap. If you supply the automotive or aerospace sectors, or work with a major retailer, you may already be completing carbon questionnaires for at least one customer.

Those questionnaires represent a customer requirement. This may bring climate change within the scope of your quality management system, even if the organisation has previously decided that the subject is not relevant.

An auditor could easily identify a contradiction if customer files contain carbon questionnaires while management review records never mention climate change. Adding the subject to your next management review agenda takes only a few minutes and gives the organisation an opportunity to establish a clear and considered position.

The rest of your management system still matters

The overall shape of ISO 9001 remains familiar. Your process map, quality objectives, internal audit programme, management review and corrective action process will still be assessed. Some of these elements may need to be updated to reflect the revised requirements, but the foundation of your management system remains relevant.

ISO 9001:2026 continues to follow the harmonised structure used by other ISO management system standards. This is particularly helpful for organisations that operate ISO 9001 alongside standards such as ISO 14001.

Organisations certified to ISO 9001:2015 have a three year transition period, which is expected to end in September 2029. However, each organisation should confirm the applicable dates and transition arrangements with its certification body.

The transition period gives you time to assess the revised requirements properly. It does not mean that preparation should be delayed until the next external audit.

Internal auditors can begin by including quality culture, opportunities and climate change in the next audit programme. The most effective approach is the same one an external auditor is likely to use. Speak to people, observe what happens in practice and follow the evidence behind important decisions.

The real question is not whether your organisation has a new policy or an updated procedure. It is whether you can demonstrate that the requirements are understood and applied throughout the business.

Which of these three areas would your organisation struggle to evidence tomorrow?

The way I teach auditors to test requirements like these, by talking to people and following the evidence, is covered in The Total Audit Process course.