ISO 9001:2026: ISO 9001:2026 – Tutorial (about 60 minutes)

ISO 9001 is the international standard that sets the requirements for a quality management system (QMS): an organised way of running a business so that it delivers products and services that meet customer and legal requirements, and keeps getting better at doing so. Organisations of every size and sector, from factories and hospitals to software companies and councils, use it, and ISO's annual survey counts well over a million certificates worldwide. After this tutorial you will be able to explain what the 2026 edition requires, how a QMS is designed and run in practice, how certification works, and what changed from the 2015 edition.

Free tutorial · about 60 minutes · 7 lessons · 4 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: The current edition is ISO 9001:2026, Quality management systems — Requirements, the sixth edition, prepared by ISO technical committee ISO/TC 176, subcommittee SC 2 (Quality systems), and published on 16 September 2026. It replaces ISO 9001:2015 together with its Amendment 1:2024 (the climate-change amendment). The companion vocabulary standard ISO 9000 was revised at the same time; ISO 9000:2026 was published in May 2026 and is the normative reference for terms. A three-year transition applies: accreditation bodies must be ready to assess against the new edition by 31 March 2027, from 31 March 2028 new accredited certificates are issued only against the 2026 edition, and certificates against the 2015 edition stop being valid after 30 September 2029. Verified 2026-10-29 on the ISO/TC 176/SC 2 news page and DNV's transition page.

Who this is for: engineers, operations and support staff, project and product managers, quality, compliance and supplier-management professionals, and anyone who has been told "we are getting ISO 9001 certified" and wants to know what that means for their daily work. It also helps people who will be interviewed by an auditor and want to understand what the auditor is looking for.

Prerequisites: none. Some experience of working in an organisation that delivers a product or service to customers is helpful. Every term is defined when it first appears.

By the end of this tutorial:

You will be able to explain the purpose of ISO 9001, the seven quality management principles behind it, and the difference between a management system and a product specification.
You will be able to describe the ten-clause structure of ISO 9001:2026 and say what clauses 4 to 10 expect at a high level.
You will be able to apply the process approach, the Plan-Do-Check-Act cycle and risk-based thinking to real work, including the separate handling of risks and opportunities.
You will be able to identify the main changes from ISO 9001:2015, such as quality culture, ethical behaviour, planning of changes and the expanded Annex A.
You will be able to outline how certification audits, surveillance and the transition to the 2026 edition work.
You will be able to apply the standard step by step to a realistic organisation and spot common implementation mistakes.
You will be able to compare ISO 9001 with related standards such as ISO 9000, ISO 9004, ISO 14001 and sector schemes built on top of it.

Lesson 1 – Origins, purpose and scope

The problem ISO 9001 solves

Imagine two suppliers who both make the same part or offer the same service. One delivers on time, every time; when something goes wrong, the customer gets a quick explanation and the problem does not come back. The other is brilliant on a good day, but results depend on who happens to be on shift, complaints get lost, and the same mistakes keep returning. The difference is rarely talent. It is whether the organisation has a dependable way of planning its work, controlling it, checking the results and learning from failures. That dependable way of working is what a quality management system provides.

ISO 9001 does not tell you what your product should look like or how good it must be. Your customers, regulators and your own strategy decide that. Instead, ISO 9001 describes the management practices an organisation needs so that it can consistently deliver whatever it has promised, and improve over time. That is why the same standard can be used by a bakery, a bank, an aircraft parts supplier and a cloud platform team.

A short history

ISO 9001 grew out of military and industrial quality-assurance standards of the 1960s and 1970s, notably the British standard BS 5750. ISO published the first ISO 9000 family in 1987, which was heavily focused on procedures and inspection. Major revisions followed. The 2000 edition introduced the process approach and a stronger focus on customers. The 2015 edition adopted the common clause layout shared by all ISO management system standards and introduced risk-based thinking in place of a separate clause on preventive action. In 2024 a short amendment asked organisations to consider whether climate change is a relevant issue.

The 2026 edition is described by major certification bodies as a moderate, targeted update rather than a rebuild. It keeps the same clause numbers and core logic, while strengthening leadership, adding explicit expectations on quality culture and ethical behaviour, separating risks from opportunities, tightening the planning of changes, folding in the climate amendment, and expanding the explanatory annex. If you already understand ISO 9001:2015, most of your knowledge still applies.

What "quality" means here

In everyday speech, quality often means luxury or high specification. In ISO language it means something more practical: the degree to which the characteristics of a product or service fulfil requirements. A cheap but reliable bus service that runs on time and is safe can be high quality; an expensive service that misses its promises is not. Quality also includes the less visible side of a service, such as how a complaint is handled, whether the invoice is correct, and whether the customer was told when a delay was coming.

Scope: who can use it and what it covers

ISO 9001 is generic. Any organisation, whatever its size, type or sector, can use it for any products or services it provides. The organisation decides the scope of its QMS, meaning which sites, products, services and activities the system covers, and must be honest about it: a scope that cuts out the troublesome parts of the business misleads customers. The standard has two intended benefits. First, it helps the organisation show that it can consistently provide products and services that meet customer and applicable statutory and regulatory requirements. Second, it aims to increase customer satisfaction through effective use of the system, including processes for improvement.

Certification is voluntary. ISO itself states that organisations do not have to be certified to benefit from the standard, although many customers, especially in manufacturing, public procurement and regulated supply chains, ask their suppliers for a certificate.

The seven quality management principles

ISO 9001 rests on seven principles described in ISO 9000 and in ISO's free brochure on the topic. They are not requirements you are audited against, but every requirement can be traced back to one or more of them:

Customer focus – meeting customer requirements and trying to exceed expectations is the primary aim of quality management.
Leadership – leaders set a unified purpose and direction and create conditions in which people engage with quality objectives.
Engagement of people – competent, empowered and engaged people at all levels are essential to create value.
Process approach – results are achieved more consistently when activities are understood and managed as interrelated processes that work as a coherent system.
Improvement – successful organisations keep an ongoing focus on getting better.
Evidence-based decision making – decisions based on the analysis of data and information are more likely to produce the intended results.
Relationship management – sustained success depends on managing relationships with interested parties such as suppliers and partners.

Lesson 2 – Key concepts and vocabulary

ISO 9001 uses words in precise ways, and auditors use them the same way. Since 2026, a small set of core terms is defined inside the standard itself (clause 3), while the full vocabulary stays in ISO 9000:2026. The explanations below are in plain language, not the official wording.

Quality management system (QMS) – the set of interacting processes, responsibilities, resources and documented information an organisation uses to direct and control itself with regard to quality.
Interested party – any person or organisation that can affect, be affected by, or believe itself affected by a decision or activity: customers, owners, employees, suppliers, regulators, the local community. The QMS is concerned with the relevant ones and their relevant requirements.
Context of the organisation – the internal and external issues that influence the organisation's ability to achieve the intended results of its QMS, such as market changes, technology, regulation, culture, skills and, where relevant, climate change.
Top management – the person or group who directs and controls the organisation at the highest level of the QMS scope. For a single site in a larger group, it may be the site leadership team.
Process – a set of interrelated or interacting activities that use inputs to deliver an intended result. Order handling, software release, calibration and supplier selection are all processes.
Process approach – managing activities as a system of processes, each with defined inputs, outputs, owners, resources, controls and performance measures, and understanding how they hand work to each other.
Risk – the effect of uncertainty, usually discussed as the chance that something undesirable will happen to conformity of products and services or to customer satisfaction.
Opportunity – a situation favourable to achieving an intended result, such as a new technology, a new market, a process simplification or a partnership. From 2026, opportunities have their own planning requirement rather than being bundled with risks.
Risk-based thinking – the habit of considering what could go wrong or right before acting, and building proportionate actions into processes. It replaced the separate preventive-action clause of older editions.
Quality policy – the intentions and direction of the organisation related to quality, formally expressed by top management.
Quality objective – a result to be achieved, consistent with the policy, measurable where practicable, monitored and updated.
Documented information – information the organisation must control and maintain, and the medium on which it is held. It covers both documents that describe how work is done and records that prove what was done.
Nonconformity – non-fulfilment of a requirement. A late delivery, a missing calibration record or an untrained operator can all be nonconformities.
Correction versus corrective action – a correction fixes the immediate problem (rework the part, refund the customer); a corrective action removes the cause so the problem does not recur.
Externally provided processes, products and services – anything supplied from outside the organisation that affects what it delivers, including outsourced processes such as cloud hosting, contract manufacturing or a call centre.
Quality culture and ethical behaviour – new explicit themes in 2026: the shared values, attitudes and behaviours that determine whether people actually do the right thing for quality when nobody is checking, and act with integrity.
Continual improvement – recurring activity to enhance performance. It does not have to be continuous or dramatic; small, steady improvements count.

Two more ideas tie the vocabulary together. Conformity means meeting requirements, whether they come from customers, laws, the organisation itself or ISO 9001. Effectiveness means the extent to which planned activities are carried out and planned results achieved. A QMS can conform on paper and still be ineffective; auditors are trained to look for both.

Lesson 3 – Structure of the standard

The Harmonized Structure

ISO management system standards, such as ISO 14001 for environment, ISO 45001 for occupational health and safety, and ISO/IEC 27001 for information security, share a common skeleton called the Harmonized Structure (earlier called the High Level Structure or Annex SL). Each uses the same ten top-level clauses and many identical core sentences, so an organisation can run one integrated management system covering several standards. ISO 9001:2026 adopts the latest version of this structure.

Clauses 1 to 3 are introductory: scope, normative references (ISO 9000:2026) and terms and definitions. Clauses 4 to 10 contain the requirements. The table below paraphrases what each requirement clause is about.

Clause	Title	What it asks for, in plain words
4	Context of the organization	Understand your internal and external issues (4.1), your relevant interested parties and which of their requirements the QMS will address (4.2), set the scope (4.3), and define the QMS and its processes (4.4).
5	Leadership	Top management takes accountability, promotes quality culture and ethical behaviour, keeps customer focus (5.1), sets the quality policy (5.2) and assigns roles, responsibilities and authorities (5.3).
6	Planning	Determine and act on risks and opportunities (6.1, now split into general, risks and opportunities), set quality objectives and plans to reach them (6.2), and plan changes to the QMS in a controlled way (6.3).
7	Support	Provide resources, including people, infrastructure, work environment, monitoring and measuring resources and organisational knowledge (7.1); ensure competence (7.2), awareness (7.3), communication (7.4) and control of documented information (7.5).
8	Operation	Plan and control the work that delivers products and services: customer requirements, design and development, control of external providers, production and service provision, release, and control of nonconforming outputs.
9	Performance evaluation	Monitor, measure, analyse and evaluate, including customer satisfaction (9.1); run internal audits (9.2); hold management reviews (9.3).
10	Improvement	Pursue continual improvement (10.1, which now combines the former general and continual-improvement clauses) and handle nonconformity and corrective action (10.2).

The introduction of ISO 9001 presents these clauses as one Plan-Do-Check-Act loop. Clause 6 is the Plan stage, clauses 7 and 8 together are Do, clause 9 is Check and clause 10 is Act. Leadership (clause 5) is drawn in the middle because it drives every stage, while the context of the organisation and the requirements of interested parties are the inputs that start the loop.

Figure 1 – The ten-clause Harmonized Structure of ISO 9001:2026 mapped to the Plan-Do-Check-Act cycle, with leadership at the centre driving every stage.

Inside clause 8 – Operation

Clause 8 is the longest clause and the one closest to day-to-day work. It is organised around the life of an order or service:

Operational planning and control: decide the criteria, resources and controls each delivery process needs, and control planned changes.
Requirements for products and services: communicate with customers, determine requirements (including legal ones), review that you can meet them before committing, and manage changes to them. In 2026 customer communication explicitly covers informing customers about contingency actions, for example during a service disruption.
Design and development: plan, define inputs, apply controls such as reviews, verification and validation, produce outputs and control design changes. Organisations that do no design can explain why this is not applicable.
Control of externally provided processes, products and services: select, evaluate and monitor suppliers and outsourced processes in proportion to their impact, and tell them clearly what you require.
Production and service provision: carry out the work under controlled conditions, identify and trace outputs where needed, look after customer or provider property, preserve outputs, handle post-delivery activities and control changes.
Release of products and services: release only after planned checks show requirements are met, unless an authorised person, and where applicable the customer, approves otherwise.
Control of nonconforming outputs: identify and control outputs that do not meet requirements so they are not used or delivered by mistake.

The annexes

The 2026 edition contains a substantially expanded informative Annex A that explains the structure, terminology and intent of the requirements. Informative means it adds no requirements; it helps you interpret the normative clauses. The former Annex B, a list of other ISO quality standards, was removed, and that guidance now lives in Annex A and on the ISO/TC 176/SC 2 website.

Applicability

Because the standard is generic, not every requirement fits every organisation. A distributor that buys and resells finished goods may have no design activity. The organisation may decide that a requirement is not applicable, but only when this does not affect its ability or responsibility to ensure conforming products and services and customer satisfaction, and it must justify that decision within its scope. "We do not like this clause" is not a justification.

Lesson 4 – How it works in practice

Thinking in processes

The single most useful idea in ISO 9001 is to see the organisation as a network of processes. A process has a trigger and inputs, activities, outputs and a receiver, which may be another internal process or the customer. Each process needs an owner, competent people, resources, criteria and methods for control, and indicators that show whether it is achieving its intended results. Clause 4.4 asks you to determine these elements and how processes interact.

Figure 2 – Anatomy of a single process under the process approach: inputs become outputs under the control of an owner, resources, indicators and risk-based thinking.

A practical tool is a process map that shows the main processes in three groups: management processes (strategy, management review), core or value-creating processes (sales, design, delivery, support) and support processes (people, IT, purchasing, maintenance). Each process gets a short one-page description, often called a process card, that lists its owner, inputs, outputs, key controls, records and indicators. Nothing in the standard demands this format, but it makes the system visible and easy to audit.

Risk-based thinking in two directions

Clause 6.1 asks the organisation to consider its context and interested parties and then determine the risks and opportunities that need to be addressed, so that the QMS achieves its intended results, undesirable effects are prevented or reduced, and improvement happens. The 2026 edition separates the two sides. One sub-clause deals with planning actions for risks, which must be proportionate to their potential impact on conformity and customer satisfaction. Another deals with planning actions to pursue opportunities. The reason for the split is practical: under the 2015 text, many organisations filled in a risk register and treated opportunities as an afterthought, or simply wrote the opposite of each risk.

Figure 3 – Risk-based thinking in ISO 9001:2026: risks and opportunities are determined together but planned and evaluated separately, then fed back through management review.

ISO 9001 does not require a formal risk-management method or a numerical scoring scheme. A simple likelihood and impact grid, a facilitated workshop, or failure mode and effects analysis can all work. What matters is that actions are proportionate, built into real processes, and checked for effectiveness. Auditors frequently find risk registers that nobody uses; the cure is to link each important risk to a process owner, a control and an indicator.

Leadership, culture and ethics

Top management cannot delegate accountability for the QMS. In 2026 it is also expected to promote a quality culture and ethical behaviour. In practice that means behaviours an auditor can observe: leaders who talk about quality in team meetings, who stop a shipment when the release checks fail even under commercial pressure, who reward people for reporting problems rather than hiding them, and who make sure targets do not push staff to cut corners. The awareness clause (7.3) now expects people doing work under the organisation's control to be aware of this culture too, and a note to the work-environment clause recognises that culture and ethics influence that environment.

Planning changes

Organisations change constantly: new products, new software, reorganisations, new suppliers. Clause 6.3 says changes to the QMS must be carried out in a planned way. The 2026 text widens what to consider: the purpose and consequences of the change, the integrity of the system, availability of resources and information, allocation of responsibilities, how the change will be communicated, how its effectiveness will be monitored and evaluated, and how its results will be reviewed. Think of it as change management with a feedback loop.

Documented information: as much as you need

A frequent misconception is that ISO 9001 is mostly paperwork. The standard asks for documented information where it explicitly says so, for example the scope, the quality policy, quality objectives, evidence of competence, results of reviews of customer requirements, design records, release evidence, records of nonconformities, internal audit and management review results, and anything else the organisation decides is necessary for its QMS to be effective. A quality manual is not required, and there is no list of mandatory procedures. A small company with experienced staff can be compliant with a lean set of documents; a large regulated manufacturer will need far more. The 2026 wording also makes a clearer distinction between information that must be available to support activities and documented information kept as evidence, without forcing anyone to rename existing documents.

Documented information must be controlled: identified, in a suitable format, reviewed and approved, available where needed, protected, and with changes and retention managed. Modern tools such as wikis, ticketing systems, version control and electronic quality systems are perfectly acceptable if those controls are in place.

Monitoring, audit and review

Clause 9 closes the loop. The organisation decides what to monitor and measure, when, how, and when to analyse the results. Customer satisfaction must be monitored; the 2026 text simplifies the wording and lists possible sources of information, such as complaints and social media, in a note. Data analysis feeds evaluations of process performance, supplier performance, product conformity, the effectiveness of actions on risks and opportunities, and the need for improvement.

Internal audits are planned, independent checks of whether the QMS conforms to the organisation's own requirements and to ISO 9001, and whether it is effectively implemented and maintained. The audit programme considers the importance of processes, changes and previous results; from 2026 each audit needs defined objectives as well as scope and criteria. Auditors must be objective and impartial, which usually means they do not audit their own work.

Management review is a planned meeting, or series of meetings, in which top management reviews the QMS using defined inputs, such as the status of earlier actions, changes in context and in interested parties' needs, customer satisfaction, objectives, process performance, nonconformities, audit results, supplier performance, resources and the effectiveness of risk and opportunity actions, and decides on improvements, changes and resource needs.

Nonconformity and corrective action

When something goes wrong, clause 10.2 expects the organisation to react (control and correct it and deal with the consequences), evaluate the need to eliminate the cause by reviewing the nonconformity, finding the root cause and checking whether similar problems exist or could occur, implement actions, review their effectiveness, and update risks, opportunities or the QMS if needed. Root-cause tools such as the five whys or a fishbone diagram are common, although the standard does not mandate any specific technique.

A typical implementation path

Secure top-management sponsorship, define why the organisation wants a QMS and agree the scope.
Run a gap analysis of current practice against the standard.
Analyse context and interested parties; map processes and assign owners.
Write the quality policy and set measurable objectives linked to the strategy.
Determine risks and opportunities and build actions into processes.
Define and control the documented information that is really needed; train people and raise awareness.
Operate the processes for a few months and collect records and indicator data.
Train internal auditors, run a full internal audit cycle, and fix what they find.
Hold a management review with real data.
Select an accredited certification body and go through certification.

For a small or medium organisation this commonly takes six to twelve months; the deciding factors are how mature the existing practices are and how much leadership time is invested, not the length of the standard.

Lesson 5 – Assessment, certification and compliance

Who does what

ISO writes the standard but does not certify anyone. Certification is done by independent certification bodies, also called registrars in some countries. Their competence is checked by national accreditation bodies, such as UKAS in the United Kingdom or ANAB in the United States, which assess certification bodies against ISO/IEC 17021-1 (requirements for bodies auditing and certifying management systems) and its quality-specific part, ISO/IEC 17021-3. Accreditation bodies cooperate internationally through mutual recognition arrangements, so an accredited certificate issued in one country is recognised elsewhere; the transition rules for the 2026 edition were published at this international level. Certificates from unaccredited bodies exist, but customers and tenders often refuse them. Anyone can check a certificate's status on the certification body's register or on the IAF CertSearch database where the body participates.

Three kinds of audit

First-party audit – an internal audit by the organisation itself (clause 9.2).
Second-party audit – a customer audits its supplier, often against ISO 9001 plus its own requirements.
Third-party audit – an independent certification body audits for certification.

Guidance for planning and conducting audits of any management system is given in ISO 19011.

The certification cycle

Figure 4 – The accredited certification cycle: stage 1 and stage 2 audits lead to a three-year certificate kept alive by surveillance and recertification audits.

The stage 1 audit reviews readiness: scope, documented information, understanding of context, key processes, whether internal audit and management review have taken place, and plans for stage 2. It is often partly remote. The stage 2 audit evaluates whether the QMS is implemented and effective: auditors interview people at all levels, observe work, sample records and follow processes end to end. Findings are graded. A major nonconformity is a failure that casts significant doubt on the system's ability to achieve its intended results, such as no internal audits at all or uncontrolled release of products; it must be corrected and verified before a certificate is issued. A minor nonconformity is a limited lapse that needs a credible correction plan. Many certification bodies also record observations or opportunities for improvement, which are not failures.

A certificate is valid for three years. Surveillance audits take place at least once a year in the two years between, sampling parts of the system each time, and a recertification audit is completed before expiry. Certificates can be suspended or withdrawn if the organisation fails to maintain the system or misuses the certificate. The certificate covers only the stated scope, which is printed on it; customers should read the scope rather than assume the whole company is covered.

Transition to the 2026 edition

Organisations certified to ISO 9001:2015 will be moved to the 2026 edition through a transition audit, usually combined with a scheduled surveillance or recertification audit. The key published dates are: accreditation bodies ready to assess against the new edition by 31 March 2027; from 31 March 2028 initial certifications only against the 2026 edition; and 2015-edition certificates no longer valid after 30 September 2029. A sensible plan is to do a delta gap analysis against the changed clauses, update the context analysis, risk and opportunity actions, change planning, awareness material and audit programme, brief top management on culture and ethics expectations, and then book the transition audit well before the deadline, because certification-body capacity tends to run short near the end of a transition.

Compliance without certification

Many organisations use ISO 9001 as a framework without certification, or self-declare conformity. That is allowed, but a self-declaration carries less weight with customers. Note also that ISO 9001 certification does not prove that a specific product is safe or meets a technical standard; product certification and regulatory approvals are separate schemes.

Lesson 6 – Worked example

To see how the pieces fit, follow a fictional company, Kestrel Payroll Services: 90 people in two offices, who build and run a cloud payroll application for small and medium businesses and provide a help desk. Payroll mistakes hurt real people, so customers increasingly ask for ISO 9001 in tenders. The managing director sponsors a project and appoints the head of operations as QMS lead.

Step 1 – Context, interested parties and scope

A half-day workshop lists external issues: frequent changes to tax rules, a competitive market, dependence on a single cloud provider, customer expectations of 24-hour support, and more severe weather affecting one office's power supply, which answers the climate-change question in a practical way. Internal issues include a fast-growing team, knowledge concentrated in two senior engineers, and a sales team that sometimes promises features before engineering has checked them.

Relevant interested parties and their requirements are recorded: customers (accurate, on-time payroll; data protection; clear communication during incidents), employees of customers (correct payslips), tax authorities (correct filings), the cloud provider (contractual terms), staff (training, fair workload) and investors (growth with low churn). The team decides which of these requirements the QMS will address, keeping all legal and contractual obligations in. The scope reads: design, development, hosting and support of cloud payroll software and related help-desk services, delivered from both offices.

Step 2 – Processes and owners

The process map has three management processes (strategy and planning, management review, internal audit), five core processes (sales and contract review, product design and development, release and deployment, payroll processing operations, customer support) and four support processes (people and competence, IT infrastructure and the cloud provider, supplier management, documented-information control). Each gets an owner and a one-page process card. For example, the release and deployment card lists inputs (approved changes and test results), controls (automated test suite, peer review, release approval by the product owner), outputs (released versions, release notes) and indicators (failed-release rate, rollback count).

Step 3 – Policy and objectives

Top management writes a short quality policy committing to accurate payroll, transparent communication, compliance with tax and data rules, and learning from every error. Three objectives for the year are set and made measurable: payroll calculation errors reported by customers below an agreed rate per 10,000 payslips; 95 % of priority-one support tickets answered within one hour; and customer satisfaction above a target score in the half-yearly survey. Each objective has an owner, resources, a deadline and a method of evaluation.

Step 4 – Risks and opportunities

Risks are assessed in a simple grid. The top risks are: a tax-rule change implemented late or wrongly; a cloud outage on payroll day; loss of key knowledge if a senior engineer leaves; and sales commitments the product cannot meet. Proportionate actions are built into processes: a regulatory-change watch with a named owner and a test pack for each tax update; a documented contingency plan with a second hosting region and a customer communication template for outages, which also satisfies the new expectation to inform customers about contingency actions; pairing and knowledge-base articles for critical components; and a mandatory engineering check in contract review for any non-standard feature.

Opportunities are planned separately: automating reconciliation checks that are currently manual, using customer-support data to find confusing screens, and offering a partner programme with accountancy firms. Each opportunity has an owner, a decision date and a way to judge whether it delivered.

Step 5 – Support and documentation

A competence matrix shows who is qualified to approve releases, process payroll corrections and handle priority-one tickets. Awareness sessions explain the policy, the objectives, each person's contribution, the consequences of not following the agreed processes, and what quality culture and ethical behaviour mean at Kestrel: for instance, that anyone may stop a payroll run if reconciliation fails, and that hiding an error is treated far more seriously than making one. Documents live in the existing wiki and the version-control system, with page ownership, approval workflow and history switched on. No separate quality manual is written; a short "QMS overview" page links everything.

Step 6 – Operation and suppliers

Contract review now uses a checklist in the CRM. Design and development follows the existing agile cadence, with definitions of done that include verification (tests pass) and validation (a pilot customer confirms the feature works in real payroll). The cloud provider and an outsourced penetration-testing firm are treated as external providers: selection criteria, an annual evaluation and clear requirements are recorded. A release is only deployed when the automated checks pass and the product owner approves. Nonconforming outputs, such as a payslip batch that fails reconciliation, are held and corrected before release to customers.

Step 7 – Check and improve

After four months of operation, two trained internal auditors from different teams audit each other's areas with defined objectives for each audit. They find that release approvals are sometimes given in chat rather than recorded in the pipeline, and that one office has no evidence of awareness training. Corrective actions are raised: the pipeline now blocks deployment without a recorded approval, and onboarding includes the awareness module. Root-cause analysis on the chat approvals reveals that the approval step was slow at weekends, so a deputy approver is appointed. The management review then examines objectives, customer satisfaction, audit results, supplier performance, the effectiveness of risk and opportunity actions, and changes in customer expectations, and decides to fund the reconciliation automation.

Step 8 – Certification

Kestrel chooses an accredited certification body. The stage 1 audit notes that the scope should mention the help desk explicitly; the team updates it. At stage 2 the auditor interviews developers, support agents and the managing director, follows a tax-update change from regulatory notice through testing to release, and samples complaint records. There is one minor nonconformity: supplier evaluation for the penetration-testing firm is overdue. A correction and corrective-action plan are accepted, and the certificate is issued for three years against ISO 9001:2026. A year later, the surveillance audit checks that the corrective action worked and samples different processes.

What made this work was not paperwork volume. It was clear ownership, objectives tied to what customers care about, risks and opportunities linked to real controls, and an honest internal audit that found genuine problems.

Lesson 7 – Relationship to other standards and frameworks

ISO 9001 sits at the centre of a large family. Some standards explain it, some extend it for a sector, and some sit beside it in an integrated management system.

Standard or framework	Type	Relationship to ISO 9001
ISO 9000	Fundamentals and vocabulary	Defines the concepts, principles and terms; normative reference for ISO 9001. Revised in 2026 alongside it.
ISO 9004	Guidance	Guidance on achieving sustained success and quality of an organisation, going beyond the minimum requirements; not certifiable.
ISO 19011	Guidance	Guidelines for auditing management systems; used to plan and run internal and supplier audits.
ISO 14001 and ISO 45001	Management system requirements	Environmental and occupational health and safety systems built on the same Harmonized Structure, which makes integrated systems practical.
ISO/IEC 27001	Management system requirements	Information security management system with the same clause skeleton; often combined with ISO 9001 in technology companies.
IATF 16949 and AS9100 / EN 9100	Sector requirements	Automotive and aerospace sector standards that include the ISO 9001 requirements and add sector-specific ones; they follow their own update cycles after an ISO 9001 revision.
ISO 13485	Sector requirements	Medical-device quality management standard derived from an earlier ISO 9001 structure, focused on regulatory compliance rather than continual improvement.
ISO 10000 series (for example ISO 10002, ISO 10005)	Guidance	Supporting guidance on topics such as complaints handling and quality plans.
EFQM Model, Baldrige Excellence Framework	Excellence models	Self-assessment frameworks for overall organisational excellence; broader and more strategic than a requirements standard.
Lean, Six Sigma, Kaizen	Improvement methods	Practical toolkits for improvement that can be used inside an ISO 9001 system; ISO 9001 does not prescribe them.

Two relationships deserve emphasis. First, the Harmonized Structure means that context, leadership, planning, documented-information control, internal audit, management review and corrective action can be shared across quality, environment, safety and information security, so an organisation need not run four separate bureaucracies. Second, sector standards built on ISO 9001 will be updated on their own timelines; an automotive or aerospace supplier should follow the announcements of the relevant sector bodies rather than assume the ISO 9001 transition dates apply directly.

For software and IT organisations, ISO 9001 also complements service-management frameworks such as ISO/IEC 20000-1 and ITIL, and engineering practices such as continuous integration and automated testing. Those practices can supply much of the control and evidence that clauses 7 to 10 ask for, provided the organisation recognises them as part of its QMS.

Common pitfalls and best practices

Common pitfalls

Treating ISO 9001 as a documentation project run by a single quality coordinator, so the system lives in binders or a portal that nobody uses.
Writing a risk register once for the audit and never linking risks to process owners, controls or indicators.
Listing opportunities as the mirror image of risks instead of planning genuine improvement actions, which the separate 2026 requirement now makes easy for auditors to spot.
Defining the scope so narrowly that the most problematic activities are left out, or claiming non-applicability for design when the organisation clearly designs products or services.
Setting objectives that are not measurable or not connected to what customers care about, and then never reviewing them.
Running internal audits as checklist exercises that never find anything, or letting people audit their own work.
Fixing symptoms through corrections without analysing root causes, so the same nonconformities return year after year.
Assuming leadership commitment means a signature on the policy, while targets and incentives quietly reward cutting corners, which conflicts with the 2026 emphasis on culture and ethics.

Best practices

Start from the business: describe how work really flows, then check it against the standard, rather than building processes to match clause numbers.
Give every process an owner, a few meaningful indicators and a short description that people actually read.
Use the tools people already work in, such as ticketing systems, wikis, CI/CD pipelines and ERP, as the controlled home for documented information and evidence.
Make leaders visible in quality: include quality topics in leadership meetings, celebrate reported problems and make clear that stopping bad output is supported.
Treat internal audit as a service that finds improvement, trains auditors well and rotates them across areas.
Feed management review with real data and record decisions with owners and dates.
Plan the move to the 2026 edition early with a delta gap analysis and update context, risks and opportunities, change planning and awareness first.
Integrate ISO 9001 with other management systems that share the Harmonized Structure to avoid duplicate procedures.

Summary and key takeaways

ISO 9001:2026 is the sixth edition of the quality management system requirements standard, published by ISO in September 2026, replacing ISO 9001:2015 and its 2024 amendment, with a transition ending on 30 September 2029.
The standard describes how to manage an organisation so that it consistently meets customer and legal requirements and improves; it does not specify the product itself.
Seven quality management principles, including customer focus, the process approach and evidence-based decision making, underpin every requirement.
Clauses 4 to 10 follow the Harmonized Structure and map onto Plan-Do-Check-Act, which makes integration with ISO 14001, ISO 45001 and ISO/IEC 27001 straightforward.
The 2026 changes are targeted: quality culture and ethical behaviour, separate planning for risks and opportunities, stronger change planning, climate change in context, clearer documented-information wording, internal audit objectives and an expanded informative Annex A.
Documented information should be as lean as effectiveness allows; there is no requirement for a quality manual.
Accredited certification uses stage 1 and stage 2 audits, a three-year certificate and annual surveillance; ISO itself does not certify.
A QMS succeeds through clear ownership, measurable objectives, real risk and opportunity actions and honest audits, not through document volume.

Reflection questions

Pick one product or service your team delivers. What are its inputs, outputs, owner and two indicators that would show whether the process achieves its intended results?
Which internal and external issues in your organisation's context could most affect its ability to satisfy customers, and is climate change one of them? Explain why or why not.
Describe a real risk and a real opportunity in your area. How would the actions you plan for each differ, and how would you know whether they worked?
What behaviours would an auditor need to see to believe that your leaders genuinely promote a quality culture and ethical behaviour?
Think of a recurring problem you have seen at work. What was the correction, what would a proper corrective action have been, and how would you check its effectiveness?