.svg)
Under ISO 9001:2026 an auditor will test quality culture, opportunities and climate change first. How each is tested, and what evidence to have ready.
Two questions from the comments under ISO's launch stream for ISO 9001:2026 stayed with me. One asked what third-party auditors need to remember to check when auditing an organisation against the 2026 edition. The other asked how the new edition expects an organisation to demonstrate that quality is embedded in its culture.
Both questions have the same answer. Most of the new requirements cannot be evidenced with a document, so an auditor will test them by talking to people and by looking for records of decisions. In a transition audit, the new requirements are the obvious place to begin, and three of them are where I would expect an auditor to spend time first.
Top management now has to promote a culture of quality and ethical behaviour, and people across the organisation have to be aware of it. This sits in the body of the standard as a requirement.
The predictable response is a quality culture policy, a page in the management review pack and a slide in induction training. An auditor may look at all three, but none of them demonstrates a culture. Culture is the one thing in the standard that a document cannot prove.
An auditor will ask your operators one question, in some form or another: what happens here when you stop the line because something does not look right? In an office or a service business the wording changes, but the test is the same.
If the answer is that the supervisor thanks them and the problem is looked at, you have a culture of quality and the policy on the wall is true. If the answer is a pause, a look at the supervisor, or a version of "it depends who is on shift", the policy is a piece of paper and your auditor now knows it.
A related concern came up in the launch comments: how do you evidence top management commitment when senior managers attend meetings and little else? The requirement sits with top management, and the answers your operators give are some of the clearest evidence of whether top management has promoted anything at all.
Before anybody external does it, go and ask three operators that question this week. You probably already know what they will say, and it is better to hear it from them first.
Risks and opportunities used to sit in one clause and were treated as one job. The new edition separates them, with requirements for each.
Since 2015 I have audited hundreds of organisations against the old clause. Almost every one of them showed me a risk register, and almost none of them showed me an opportunity. Under the new edition, an auditor will ask to see one.
In audit terms, an opportunity is a change you identified and evaluated, and then either took or consciously chose not to take, with a reason. The evidence an auditor will look for is that trail: where the opportunity was identified, how it was evaluated, and what was decided and why.
Examples include a process you could simplify, a customer requirement you could meet before the deadline, a supplier you could bring closer, or an inspection step you could remove because the data shows the process is stable. That last one is worth real money, and I have rarely seen the people who did it record it as an opportunity.
Name one opportunity your team acted on last year, and then check whether you could evidence it to an auditor.
You now have to determine whether climate change is a relevant issue for your management system, and act on it where it is. Deciding that it is not relevant is a legitimate answer, provided you can show you asked the question.
An auditor will therefore look for the decision and the reasoning behind it. The simplest evidence is a management review record showing that the question was raised, discussed and answered.
The auditor will also look at your interested parties. If you supply automotive, aerospace or a major retailer, you are probably completing a carbon questionnaire for at least one customer. That is an interested party requirement, which brings climate change inside your quality management system whether it interests you or not. A customer file containing carbon questionnaires, alongside a management review that never mentions climate change, is an easy gap for an auditor to find.
Adding one line to your next management review agenda takes ten minutes, and it gives you a considered position to show the auditor.
The shape of the standard has not changed. Your process map, quality objectives, internal audit programme and corrective action process all still stand, and an auditor will assess them in the way they always have. The structure of the standard has been aligned with the other ISO management system standards, which saves work for anyone running ISO 9001 alongside ISO 14001.
Organisations certified to ISO 9001:2015 have a three-year transition period, ending in September 2029 [CONFIRM: Paul's wording for the three-year transition period set by an IAF resolution], and your certification body needs accreditation to the new edition before it can audit you against it. That gives you time to run your own internal audits against these three areas first. If you are an internal auditor, build them into next year's programme and use the same tests an external auditor will use: talk to people, and look for recorded decisions.
Which of these three areas would your organisation struggle to evidence tomorrow? The way I teach auditors to test requirements like these, by talking to people and following the evidence, is covered in The Total Audit Process course.
A step by step guide to the complete audit process from planning to reporting. Build confidence in conducting audits and writing clear, professional nonconformities.
