ISO 9001:2026 is coming: Eight practical steps Quality Managers should take now

ISO 9001 is changing.

At the time of writing, ISO/FDIS 9001 is the Final Draft International Standard and is expected to replace ISO 9001:2015 in September 2026. (ISO)

That does not mean organisations should rush to rewrite every procedure before the final standard is published.

Quality managers should instead use this time to strengthen the foundations of their existing Quality Management System. A well-maintained, actively used QMS will always be easier to transition than one that is updated only before an external audit.

Start by examining the system you already have
The forthcoming edition provides an opportunity for organisations to review and refine their management systems in response to changing business needs, technologies and stakeholder expectations.

The sensible response is not to speculate about final clause wording. It is to ask whether your existing system works as intended.

• Can employees find the correct procedures?
• Are risks reviewed when business conditions change?
• Do managers understand which quality objectives they own?
• Are corrective actions completed and checked for effectiveness?
• Can you demonstrate that decisions are based on reliable information?

These questions matter under the current standard and will remain important under the revised edition.

1. Review your process ownership
Every key process should have a clearly identified owner who understands:

• The purpose of the process
• Its required inputs and intended outputs
• The associated risks and opportunities
• How performance is measured
• Which documents and records must be maintained
• Who is responsible for improvement actions

Do not rely on an organisational chart alone. A job title does not necessarily establish meaningful process ownership.

Meet with process owners and ask them to explain how their processes operate in practice. Where the documented process and the real process differ, determine whether the documentation or the operation needs to change.

2. Clean up your controlled documents
Document-control problems often accumulate quietly.

Old templates remain in shared folders. Employees save local copies of procedures. Approvals are recorded inconsistently. Review dates pass without action. Superseded documents remain accessible.

Begin with a structured document review. Identify documents that are:

• Outdated
• Duplicated
• Awaiting approval
• Assigned to people who have left the organisation
• No longer relevant to current operations
• Inconsistent with how the work is actually performed

Confirm that the current approved version of every important document is clearly identifiable and accessible to the people who need it.

A controlled document system should make the correct way of working easier to follow. It should not create an administrative obstacle.

3. Address overdue corrective actions
An open corrective action is not automatically a sign of a weak system.

An action that remains open indefinitely, has no accountable owner or is closed without checking its effectiveness is a more serious concern. Review your current non-conformances and corrective actions.

For each one, confirm that:

1. The problem was clearly defined.
2. The immediate issue was contained.
3. The underlying cause was investigated.
4. Responsibility and a due date were assigned.
5. The agreed action was completed.
6. The outcome was checked for effectiveness.

Avoid closing an action simply because a task was performed. The real question is whether the action prevented the problem from recurring or reduced the identified risk.

4. Revisit risks and opportunities
A risk register should not be a document that is updated once a year for an audit.

Review whether your risks still reflect current business conditions. Consider changes involving:

• Customers and contracts
• Suppliers and logistics
• Technology and cybersecurity
• Skills and employee turnover
• Infrastructure and equipment
• Regulatory obligations
• Climate and environmental conditions
• New products, services or markets
• Artificial intelligence and automation

Connect important risks to actions, owners and review dates.

Where possible, integrate risk discussions into normal management meetings rather than treating risk management as a separate compliance exercise.

5. Strengthen your quality objectives
Objectives such as “improve quality” or “increase customer satisfaction” are too broad to guide meaningful action.

A useful quality objective should establish:

• What will be improved
• How it will be measured
• The current baseline
• The intended target
• The responsible owner
• The required actions
• The review frequency
• The completion date

Quality objectives should also support the organisation’s strategic direction. For example, if customer complaints are concentrated around late deliveries, an objective focused only on product defects may overlook a significant customer concern.

6. Check the integrity of your training records
A list of employees who attended a course does not necessarily prove competence.

Review whether your training system connects:

• Roles
• Required skills
• Qualifications and certifications
• Completed training
• Training expiry dates
• Competency assessments
• Identified skills gaps
• Planned development activities

Pay particular attention to employees performing work that can affect product quality, safety, compliance or customer outcomes.

When procedures change, determine whether affected employees need communication, retraining or formal reassessment.

7. Improve your internal audit programme
Internal audits should help the organisation understand whether its processes are effective. They should not be limited to checking whether a document exists.
Plan audits according to process importance, business risk, previous findings and recent changes.

A stronger audit programme asks questions such as:

• Is the process achieving its intended result?
• Are responsibilities understood?
• Are controls being applied consistently?
• Is the information used to manage the process reliable?
• Were previous problems addressed effectively?
• What new risks or improvement opportunities have emerged?

ISO 19011:2026 is the current international guidance standard for auditing management systems. It covers audit principles, audit programme management and the conduct of management-system audits. (ISO)

8. Create a formal transition plan
Once ISO 9001:2026 is published, conduct a structured gap analysis rather than making disconnected changes.
​
Your transition plan should include:

• Obtaining and reviewing the final standard
• Identifying changed or clarified requirements
• Assigning responsibility for each gap
• Updating relevant documents and processes
• Communicating changes to employees
• Providing training where necessary
• Updating the internal audit programme
• Reviewing the transition through management review
• Coordinating the timing with your certification body

Keep evidence showing how each transition action was addressed.

Do not wait for the external auditor
The greatest risk is not that the new standard will introduce an unexpected clause. It is that existing weaknesses will make every change more difficult.

Organisations with controlled documents, accountable process owners, current risks, meaningful objectives and effective corrective actions will be in a much stronger position.

The transition should be used to improve how the business operates—not simply to update the year printed on a certificate.

How IsoRight can help

IsoRight provides a central environment for managing controlled documents, risks, objectives, audits, non-conformances, corrective actions, training records, management reviews and assigned tasks.

By strengthening these processes now, organisations can create a more reliable foundation for the transition to ISO 9001:2026 while improving their current quality-management performance.