ISO 9001 is changing.

At the time of writing, ISO/FDIS 9001 is the Final Draft International Standard and is expected to replace ISO 9001:2015 in September 2026. (ISO)

That does not mean organisations should rush to rewrite every procedure before the final standard is published.

Quality managers should instead use this time to strengthen the foundations of their existing Quality Management System. A well-maintained, actively used QMS will always be easier to transition than one that is updated only before an external audit.

Start by examining the system you already have
The forthcoming edition provides an opportunity for organisations to review and refine their management systems in response to changing business needs, technologies and stakeholder expectations.

The sensible response is not to speculate about final clause wording. It is to ask whether your existing system works as intended.

• Can employees find the correct procedures?
• Are risks reviewed when business conditions change?
• Do managers understand which quality objectives they own?
• Are corrective actions completed and checked for effectiveness?
• Can you demonstrate that decisions are based on reliable information?

These questions matter under the current standard and will remain important under the revised edition.

1. Review your process ownership
Every key process should have a clearly identified owner who understands:

• The purpose of the process
• Its required inputs and intended outputs
• The associated risks and opportunities
• How performance is measured
• Which documents and records must be maintained
• Who is responsible for improvement actions

Do not rely on an organisational chart alone. A job title does not necessarily establish meaningful process ownership.

Meet with process owners and ask them to explain how their processes operate in practice. Where the documented process and the real process differ, determine whether the documentation or the operation needs to change.

2. Clean up your controlled documents
Document-control problems often accumulate quietly.

Old templates remain in shared folders. Employees save local copies of procedures. Approvals are recorded inconsistently. Review dates pass without action. Superseded documents remain accessible.

Begin with a structured document review. Identify documents that are:

• Outdated
• Duplicated
• Awaiting approval
• Assigned to people who have left the organisation
• No longer relevant to current operations
• Inconsistent with how the work is actually performed

Confirm that the current approved version of every important document is clearly identifiable and accessible to the people who need it.

A controlled document system should make the correct way of working easier to follow. It should not create an administrative obstacle.

3. Address overdue corrective actions
An open corrective action is not automatically a sign of a weak system.

An action that remains open indefinitely, has no accountable owner or is closed without checking its effectiveness is a more serious concern. Review your current non-conformances and corrective actions.

For each one, confirm that:

1. The problem was clearly defined.
2. The immediate issue was contained.
3. The underlying cause was investigated.
4. Responsibility and a due date were assigned.
5. The agreed action was completed.
6. The outcome was checked for effectiveness.

Avoid closing an action simply because a task was performed. The real question is whether the action prevented the problem from recurring or reduced the identified risk.

4. Revisit risks and opportunities
A risk register should not be a document that is updated once a year for an audit.

Review whether your risks still reflect current business conditions. Consider changes involving:

• Customers and contracts
• Suppliers and logistics
• Technology and cybersecurity
• Skills and employee turnover
• Infrastructure and equipment
• Regulatory obligations
• Climate and environmental conditions
• New products, services or markets
• Artificial intelligence and automation

Connect important risks to actions, owners and review dates.

Where possible, integrate risk discussions into normal management meetings rather than treating risk management as a separate compliance exercise.

5. Strengthen your quality objectives
Objectives such as “improve quality” or “increase customer satisfaction” are too broad to guide meaningful action.

A useful quality objective should establish:

• What will be improved
• How it will be measured
• The current baseline
• The intended target
• The responsible owner
• The required actions
• The review frequency
• The completion date

Quality objectives should also support the organisation’s strategic direction. For example, if customer complaints are concentrated around late deliveries, an objective focused only on product defects may overlook a significant customer concern.

6. Check the integrity of your training records
A list of employees who attended a course does not necessarily prove competence.

Review whether your training system connects:

• Roles
• Required skills
• Qualifications and certifications
• Completed training
• Training expiry dates
• Competency assessments
• Identified skills gaps
• Planned development activities

Pay particular attention to employees performing work that can affect product quality, safety, compliance or customer outcomes.

When procedures change, determine whether affected employees need communication, retraining or formal reassessment.

7. Improve your internal audit programme
Internal audits should help the organisation understand whether its processes are effective. They should not be limited to checking whether a document exists.
Plan audits according to process importance, business risk, previous findings and recent changes.

A stronger audit programme asks questions such as:

• Is the process achieving its intended result?
• Are responsibilities understood?
• Are controls being applied consistently?
• Is the information used to manage the process reliable?
• Were previous problems addressed effectively?
• What new risks or improvement opportunities have emerged?

ISO 19011:2026 is the current international guidance standard for auditing management systems. It covers audit principles, audit programme management and the conduct of management-system audits. (ISO)

8. Create a formal transition plan
Once ISO 9001:2026 is published, conduct a structured gap analysis rather than making disconnected changes.
​
Your transition plan should include:

• Obtaining and reviewing the final standard
• Identifying changed or clarified requirements
• Assigning responsibility for each gap
• Updating relevant documents and processes
• Communicating changes to employees
• Providing training where necessary
• Updating the internal audit programme
• Reviewing the transition through management review
• Coordinating the timing with your certification body

Keep evidence showing how each transition action was addressed.

Do not wait for the external auditor
The greatest risk is not that the new standard will introduce an unexpected clause. It is that existing weaknesses will make every change more difficult.

Organisations with controlled documents, accountable process owners, current risks, meaningful objectives and effective corrective actions will be in a much stronger position.

The transition should be used to improve how the business operates—not simply to update the year printed on a certificate.

ISO 9001 is entering a new chapter. The revised edition of the world’s best-known quality management standard is expected to be published in September 2026, replacing ISO 9001:2015. The revision has reached the Final Draft International Standard stage, which is the final approval phase before publication. Organisations certified to ISO 9001:2015 will receive a transition period in which to update their quality management systems.

Although the final standard has not yet been published, organisations should not wait until their next external audit before thinking about the transition.
​
The months ahead provide an opportunity to review the health of your existing quality management system, correct longstanding weaknesses and prepare your team for the transition in a controlled way.

Once ISO 9001:2026 is published, organisations should approach the transition as a managed improvement project.
​
1. Understand the final changes
​
Obtain an authorised copy of the new standard and review reliable guidance from ISO, your certification body or an experienced ISO consultant.
Avoid relying entirely on informal summaries. Your organisation needs to understand how the final requirements apply to its own context and processes.

2. Conduct a structured gap assessment

Compare your existing quality management system with the requirements of the new edition.
The assessment should identify:

• Requirements already adequately addressed
• Existing processes that require minor changes
• New or revised requirements requiring further action
• Documents and records that may need updating
• Training and communication requirements
• Potential changes to internal audits and management reviews

The result should be a practical transition action plan rather than simply a lengthy report.

3. Assign responsibilities and deadlinesEvery transition action should have:

• A responsible person
• A target date
• A clear expected outcome
• Supporting evidence
• A review or approval process

A transition should not become the sole responsibility of the quality manager. Process owners and senior management should be involved wherever changes affect their areas.

4. Update your controlled information

Policies, procedures, process maps, forms and other controlled information may need to be revised. Changes should follow an appropriate document-control process that records:

• What changed
• Why it changed
• Who reviewed it
• Who approved it
• When the new version became effective
• Whether affected employees were informed

This ensures that outdated documents are not accidentally used after the transition.

5. Train employees and process owners

Employees need to understand how changes affect their work. Training should be proportionate to each person’s role. A process owner may need detailed training, while other employees may only require awareness of an updated procedure or responsibility. Training records should demonstrate that the organisation did more than circulate a document by email.

6. Implement and test the changes

Updated processes should be used for a sufficient period to generate evidence that they are working. Organisations should not wait until the transition audit to discover that a revised process has not been properly implemented.

7. Conduct an internal transition audit

Your internal audit programme should assess whether the updated system conforms to the new edition and whether the changes are effective in practice. Any findings should be addressed before the certification transition audit.

8. Complete a management review

Senior management should review the transition process, including:

• The status of the gap-assessment actions
• Internal audit findings
• Remaining risks
• Resource requirements
• Training progress
• Changes to objectives or processes
• Readiness for the transition audit

This provides evidence that the transition is being directed and supported by leadership.

9. Coordinate with your certification body

Your certification body will advise you how and when the transition audit will be incorporated into your certification cycle. Confirm the arrangements early so that your transition plan aligns with your surveillance or recertification schedule.

Many organisations still maintain their quality management systems through a combination of spreadsheets, shared folders, email reminders and Word documents.
This creates challenges during a standards transition.
It can become difficult to determine:

• Which documents still need to be reviewed
• Whether the latest version has been approved
• Which transition actions are overdue
• Whether employees have received the required training
• Which internal audit findings remain unresolved
• Whether sufficient evidence exists for the transition audit

A transition involving dozens of documents, processes and responsible people can quickly become difficult to coordinate manually.​

For many organisations, an upcoming external audit triggers a familiar sequence.
Documents are reviewed hurriedly. Department managers are asked to find evidence. Overdue corrective actions are chased. Training records are updated. Old forms are removed from folders. Employees are reminded what to expect.
The organisation may pass the audit.

However, the process reveals an important weakness: the management system was not genuinely audit-ready until the audit date forced everyone to focus on it.
A healthy Quality Management System should produce audit readiness as a normal outcome of daily work.

Audit readiness is not the same as audit preparation

Audit preparation is necessary. 

You should confirm the scope, timetable, locations, participants and required information. Employees should understand the audit process, and practical arrangements should be made.  Audit readiness is different.

An audit-ready organisation can demonstrate, at any reasonable point, that:

• Approved processes are being followed.
• Required records are available.
• Responsibilities are understood.
• Risks are being managed.
• Employees are competent.
• Objectives are being measured.
• Problems are recorded and addressed.
• Corrective actions are checked for effectiveness.
• Management reviews performance.
• The system is continually improved.

These conditions cannot be created convincingly during the week before an audit.

Treat the audit as a sample of the system

An auditor does not examine every transaction, record or activity. The auditor samples evidence to determine whether the management system conforms to requirements and operates effectively.

The organisation should therefore not try to predict and prepare only the records an auditor might select.

Instead, the underlying process should be consistently controlled.

When records are produced through normal work, audit evidence becomes a natural output of operations rather than a separate administrative project.

Build readiness into daily work

Keep employees’ tasks visible
Employees should know which quality-related actions have been assigned to them, when those actions are due and where the supporting evidence must be recorded.

This includes:

• Corrective actions
• Document reviews
• Training requirements
• Audit findings
• Risk-treatment actions
• Improvement initiatives
• Maintenance and calibration activities
• Supplier follow-ups
• Management-meeting actions

A task should not disappear inside meeting minutes or an email thread.

Capture evidence when the activity occurs
Do not plan to reconstruct evidence later. When an inspection is performed, record it. When training is completed, update the employee’s training history.

When a document is approved, retain the approval record. When a corrective action is completed, attach the supporting evidence.
Evidence captured close to the activity is generally more accurate and easier to verify.

Use the approved process
Employees should be able to access the current procedure, form or checklist without searching through multiple folders.

When procedures are difficult to find or impractical to follow, employees create local workarounds. Those workarounds can eventually become audit findings or operational failures.

Establish a weekly quality rhythm
A short weekly review can prevent minor issues from becoming audit emergencies.

Review:

• New non-conformances
• Overdue tasks
• Corrective actions approaching their deadlines
• Documents awaiting approval
• Training or certifications nearing expiry
• New customer complaints
• Supplier issues
• Significant production or service-quality trends

The purpose is not to hold another long meeting.
It is to identify exceptions early and assign appropriate action.

Use monthly reviews to identify patterns
Weekly reviews focus on immediate control. Monthly reviews should identify trends.
Ask:

• Are the same defects recurring?
• Which departments have the most overdue actions?
• Are suppliers improving or deteriorating?
• Are customer complaints concentrated around a particular process?
• Are training gaps affecting performance?
• Are objectives progressing as planned?
• Are maintenance or calibration problems increasing?
• Are corrective actions preventing recurrence?

Reliable information is not useful only for audits. It is essential for managing quality, risk and operational performance.

Keep the internal audit programme active
An internal audit programme should operate throughout the year. Avoid scheduling every internal audit shortly before the certification assessment.

This creates a compliance rush and leaves too little time to address meaningful findings.
Plan audits according to:

• Process importance
• Risk
• Previous audit results
• Customer concerns
• Significant changes
• New employees or leadership
• New technology
• Recurring non-conformances
• Supplier or operational performance

ISO 19011:2026 provides current international guidance for auditing management systems, including the principles of auditing, management of audit programmes and the conduct of management-system audits. (ISO)

Audit process effectiveness, not paperwork alone
A process can have complete documentation and still perform poorly.
Internal auditors should look beyond whether a procedure exists.

Useful questions include:

• Does the process achieve its intended result?
• Do employees understand their responsibilities?
• Are controls being applied consistently?
• Is the process adequately resourced?
• Are measurements reliable?
• Are risks being addressed?
• Are problems identified early?
• Are corrective actions effective?
• Are improvement opportunities acted upon?

This approach makes internal auditing valuable to management rather than merely a rehearsal for certification.

Maintain a living evidence trail
For each important process, consider what evidence demonstrates effective operation.

Document control
Relevant evidence may include:

• Approval records
• Revision histories
• Distribution records
• Change requests
• Periodic reviews

Training and competence
Relevant evidence may include:

• Role requirements
• Training attendance
• Qualifications
• Competency assessments
• Skills-gap actions

Corrective action
Relevant evidence may include:

• A clear problem description
• Containment measures
• Root-cause analysis
• Assigned actions
• Completion evidence
• An effectiveness review

Supplier management
Relevant evidence may include:

• Approval criteria
• Performance data
• Certifications
• Evaluations
• Corrective actions

Management responsibility
Relevant evidence may include:

• Organisational objectives
• Performance results
• Meeting decisions
• Assigned actions
• Management-review outputs

When this information is maintained continuously, preparing for an audit becomes a review exercise rather than an evidence-recovery exercise.

Conduct quarterly system-health checks
Once a quarter, perform a broader review of the QMS.

Consider the following questions:

1. Are controlled documents current?
2. Are risks and opportunities still relevant?
3. Are objectives progressing?
4. Are audits being completed according to plan?
5. Are actions being closed on time?
6. Are effectiveness checks meaningful?
7. Are training records complete?
8. Are supplier controls proportionate to risk?
9. Is management receiving useful information?
10. Are recurring problems being eliminated?

This review can be incorporated into existing management meetings. The objective is to identify weaknesses while there is still time to improve them.

Use management review as a decision-making process
Management review should not be a presentation prepared by the quality manager while everyone else listens.

It should help leadership decide:

• Which risks require attention
• Where performance is unacceptable
• Which objectives should change
• What resources are required
• Which improvements should be prioritised
• Whether the QMS remains suitable and effective

Record decisions, assign actions and track them to completion. A management review without follow-through is only a meeting.

What to do before the external audit
Even an audit-ready organisation should complete a final readiness review.

Confirm:

• The audit scope and schedule
• The current certification information
• Key organisational changes
• Previous audit findings
• Internal audit results
• Management-review records
• Current objectives and performance
• Significant risks
• Open corrective actions
• The availability of relevant employees
• Access to required evidence

Do not hide known problems. Be prepared to explain what happened, what was done and how the organisation is monitoring the result.

The goal is not to perform for the auditor
An effective management system should help the organisation deliver consistent results, control risk and improve performance.

Passing an audit is important, but it is not the only measure of success. The strongest audit-ready organisations do not spend weeks creating the appearance of control. They build control into daily processes, maintain reliable records and act when performance changes.