Part 4: Auditing and summary

Paul turns to the auditor's view, showing how the turtle diagram supports an audit of any QMS process, and lists the evidence an auditor may ask for. He recommends auditing risk and opportunity within each process rather than as a one-off audit.

He closes with the summary. ISO 9001:2026 does not change the requirement to identify risk and opportunity. The change is that actions to address risks (6.1.2) and actions to address opportunities are now two separate requirements, though the same process can serve both. It is also a good moment to review whether the process built since 2015 still works.

Evidence an auditor may ask for

• How internal and external issues are identified and how often they are reviewed
• Who the interested parties are and what they require
• The process for identifying risk and opportunity
• How ownership and controls are integrated into each QMS process
• How the effectiveness of actions feeds into management review
• How improvement projects are tracked to completion and success is measured