ISO 10006: ISO 10006 – Tutorial (about 60 minutes)

ISO 10006 is the international guidance standard for applying quality management to projects. It is used by project managers, project quality leads, quality managers, sponsors and the organisations that commission or deliver projects, from a small software release to a multi-year construction programme. After this tutorial you will be able to explain what ISO 10006 recommends, use its vocabulary, find your way around its structure, build a sensible project quality plan, and judge how well a project applies the guidance.

Free tutorial · about 60 minutes · 7 lessons · 4 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: The current edition is ISO 10006:2017, Quality management — Guidelines for quality management in projects, the third edition, published in November 2017 and prepared by ISO technical committee ISO/TC 176 (Quality management and quality assurance), subcommittee SC 3 (Supporting technologies). It replaced ISO 10006:2003, which itself replaced the first edition of 1997. ISO's catalogue shows that the 2017 edition was reviewed and confirmed in March 2023 (stage 90.93), so it remains the valid edition, and the catalogue lists no replacement project. Note one timing point: ISO 10006:2017 was written to match ISO 9000:2015 and ISO 9001:2015, and those two documents were replaced by new editions in 2026. ISO 10006 itself has not been revised, so this tutorial teaches the 2017 text and points out where you should read it alongside the newer quality standards. The previous edition (2003) belonged to subcommittee SC 2; the 2017 edition moved to SC 3, which also looks after ISO 10005 and ISO 10007. Verified 2026-10-29 on the ISO catalogue entry for ISO 10006:2017 and the ISO/TC 176/SC 3 list of standards.

Who this is for: project and programme managers, project quality or assurance leads, quality managers whose organisation runs work as projects, engineers and team leads who deliver project work, sponsors and customer representatives, and auditors who review project-based organisations. It is also useful for anyone who knows ISO 9001 and needs to understand how quality management changes when the work is temporary, unique and run by a team that will break up at the end.

Prerequisites: none. A general idea of how a project runs (a start, a plan, some deliverables and an end) helps, but every term is explained when it first appears. You do not need to know ISO 9001 in detail.

By the end of this tutorial:

You will be able to explain the purpose and scope of ISO 10006 and why it is guidance rather than a certifiable set of requirements.
You will be able to use the core vocabulary, including originating organization, project organization, project quality plan and progress evaluation.
You will be able to describe the structure of the 2017 edition, from clause 4 on quality management systems in projects to clause 8 on measurement, analysis and improvement.
You will be able to apply the quality management principles and the project process groups to a real project, including writing a project quality plan.
You will be able to explain how organisations evaluate their use of ISO 10006, given that no certification against it exists.
You will be able to relate ISO 10006 to ISO 9001, ISO 21502, ISO 10005, ISO 31000 and widely used project management bodies of knowledge.

Lesson 1 – Origins, purpose and scope

Why projects need their own quality guidance

Most quality management thinking grew up in factories and service operations, where the same work is done again and again. In a repetitive operation you can measure a process, find the variation, fix the cause and see the improvement in next month's figures. A project is different. It is a one-off piece of work with a start and a finish, often done by a team that has never worked together before, for a customer whose requirements may only become clear as the work progresses. By the time a problem is understood the project may be over, and the team that learned the lesson may already have moved on.

That difference creates three practical challenges. First, there is little time to "learn by repetition", so quality has to be planned into the project from the start rather than inspected in at the end. Second, a project usually sits inside a larger organisation (or several), so it inherits policies, people and systems that were designed for the permanent organisation and may not fit the temporary one. Third, quality failures in projects are often failures of the project processes themselves (unclear scope, weak change control, unrealistic schedules, poor supplier control) rather than defects in a finished product. ISO 10006 was written to help with exactly these challenges.

What ISO 10006 is

ISO 10006 is part of the ISO 10000 family of supporting standards that sit around ISO 9001. ISO 9001 states requirements for a quality management system; the 10000-series documents give guidance on particular topics such as quality plans (ISO 10005), configuration management (ISO 10007), customer satisfaction and complaints (ISO 10001 to ISO 10004) and training and competence. ISO 10006 takes the quality management principles and practices of the ISO 9000 family and explains how to apply them inside projects.

Two features define the document. It is guidance: the text is written with "should" statements that recommend good practice, not "shall" statements that an auditor can check for conformity. And it is about quality management in projects, not about project management itself. The standard says so plainly and points to the ISO project management guidance (originally ISO 21500, now ISO 21502) for the general discipline of planning and running projects. ISO 10006 asks a narrower question: how do we make sure that both the project processes and the project's products and services meet the needs of the customer and other interested parties?

Two aspects of quality in a project

A central idea of ISO 10006 is that quality in projects has two sides. One is the quality of the product or service the project delivers: the bridge, the software system, the event, the report. The other is the quality of the project processes that produce it: how scope is defined, how changes are controlled, how risks are handled, how suppliers are managed, how progress is checked. A project can fail on either side. A beautiful product delivered a year late and twice over budget has failed its interested parties; so has a perfectly run project that delivers something nobody can use. The guidance treats both sides together.

Scope of application

ISO 10006 is written to apply to projects of any size, duration and complexity: small or large, short or long, simple or complex, in any environment, whatever kind of product or service the project delivers, and whether the project stands alone or is one of several projects in a programme or portfolio. Nothing in the guidance depends on the originating organization holding an ISO 9001 certificate. Where a formal quality management system exists, the guidance helps adapt it to the project; where none exists, it still gives a structured way to manage quality in the project. Because the text is general, the standard itself expects some tailoring to suit each project: a three-week marketing campaign will apply the same ideas far more lightly than a nuclear plant refurbishment.

A short history

The first edition appeared in 1997, when ISO 9001 still focused on procedures and quality assurance. The 2003 edition was aligned with the 2000 revision of the ISO 9000 family, with its process approach and its eight quality management principles. The 2017 edition, the third, brought the guidance in line with the 2015 revisions of ISO 9000 and ISO 9001, including their seven quality management principles and updated vocabulary, while keeping a clause layout familiar to users of the earlier editions. In 2026 new editions of ISO 9000 and ISO 9001 were published; ISO 10006 has not yet followed, so readers should map its references to the current editions themselves.

Lesson 2 – Key concepts and vocabulary

ISO 10006 relies on the vocabulary of ISO 9000 and adds a small number of project terms of its own. The descriptions below are paraphrased explanations for learners, not the official definitions.

Project – a one-off, unique piece of work made up of planned and controlled activities, with a start and an end date, carried out to reach an objective within agreed requirements and limits such as time, cost and resources.
Project management – the work of planning, organising and controlling everything in a project, reporting on it and keeping everyone involved motivated, so that the project meets its objectives.
Originating organization – the organisation that decides to undertake the project. It may be a company starting an internal project, a public body, or a client organisation; it sets the project's purpose and assigns it to a project organization.
Project organization – the temporary organisation that carries out the project. It may be a team inside the originating organization, a joint venture, a contractor, or a mixture of several organisations.
Project manager – the person given the authority and responsibility to manage the project and to make sure its quality management system is established, implemented and maintained.
Interested party – any person or organisation that can affect, be affected by, or believe itself to be affected by the project: the customer, end users, sponsors, the project team, suppliers, regulators, neighbours and others.
Project management plan – the document that sets out what is needed to meet the project's objectives. It may include or refer to the project quality plan and other plans.
Project quality plan – the part of the planning that specifies how quality will be achieved in the project: which processes, procedures, resources, responsibilities, checks and records apply, and when. ISO 10005 gives detailed guidance on quality plans.
Project phase – a division of the project life cycle (for example concept, design, build, test, handover) that ends with defined outputs and, ideally, a decision on whether and how to continue.
Progress evaluation – a planned assessment of what the project has achieved against its objectives and plans, carried out at suitable points in the life cycle, used to decide on corrective action and to learn.
Strategic process – the direction-setting process of a project, in which the quality management principles are applied to set the course: understanding needs, setting objectives, organising and deciding how processes will work.
Interdependency – the links between project processes and between the project and its environment, such that a change in one area (for example scope) affects others (cost, time, risk).
External provider – a supplier, subcontractor or partner outside the project organization that supplies products or services to the project.
Lessons learned – knowledge gained from carrying out the project, recorded and passed back to the originating organization so that future projects benefit.

Why the two organisations matter

The split between originating organization and project organization is the most useful idea for beginners. In a simple internal project the two may be the same company, with the project organization being a temporary team. In many real projects they are different: a hospital (originating organization) commissions a construction joint venture (project organization), which in turn uses dozens of external providers. ISO 10006 gives guidance to both. The originating organization decides to start the project, provides direction, resources and its own quality management system, and receives the lessons learned. The project organization runs the project and manages quality day to day. Many project quality failures come from confusion about which of the two is responsible for what.

Figure 1 – The originating organization directs and resources the project organization, which serves the customer, manages providers and feeds lessons back.

The quality management principles in a project

The 2017 text uses the seven quality management principles described in ISO 9000:2015. Each has a project meaning:

Customer focus – understanding what the customer and other interested parties need from the project, and checking that the deliverables meet those needs, not just the written specification.
Leadership – the project manager and the originating organization's managers set a clear purpose and create an environment in which people can do quality work.
Engagement of people – competent, empowered team members who understand their contribution, including those working for external providers.
Process approach – managing the project as a set of linked processes with defined owners, inputs and outputs, rather than as a pile of tasks.
Improvement – learning during the project and passing knowledge on afterwards, since a project has limited time to improve itself.
Evidence-based decision making – decisions based on analysis of data from progress evaluations, tests, reviews and measurements.
Relationship management – managing relationships with suppliers, partners and other interested parties to achieve the project's objectives.

Lesson 3 – Structure of the standard

ISO 10006:2017 does not use the ten-clause Harmonized Structure found in management-system requirement standards such as ISO 9001. It keeps a clause layout close to the older ISO 9001:2008 arrangement, organised around management, resources, realization and improvement. After the usual opening clauses (scope, normative references and terms and definitions) the guidance is in clauses 4 to 8.

Figure 2 – The guidance in ISO 10006:2017 sits in clauses 4 to 8, each with a distinct focus.

Clause 4 – Quality management systems in projects

Clause 4 sets the scene. It describes the characteristics of projects (their uniqueness, phases, the organisations involved and the project management environment), explains how the quality management principles apply, and introduces the project quality plan. The core message is that the project needs its own quality management system: one that may be derived from the originating organization's system but is adapted to the project's needs and documented in the project quality plan. A small project might do this in a few pages; a large one may have a family of plans covering design, construction, testing and handover.

Clause 5 – Management responsibility in projects

Clause 5 covers what leaders do. It starts with the commitment of top management, in both the originating organization and the project organization, to a quality culture in the project. It then describes the strategic process, in which the quality management principles are applied to set the direction of the project: what the customer and other interested parties need, what the objectives are, how the project will be organised and how decisions will be taken. Finally, it deals with management reviews and progress evaluations, the two main ways in which leaders check that the project is still on course and decide what to change.

Clause 6 – Resource management in projects

Clause 6 has two parts. The resource-related processes deal with planning and controlling resources such as equipment, facilities, materials, information, software and money: identifying what is needed, when, and from where, and checking that it is available and used as planned. The personnel-related processes deal with people: setting up the project's organisational structure, allocating people with the right competence to roles, and developing the team so that individuals and the group perform well. Because project teams are temporary and often drawn from several organisations, clause 6 stresses clear roles, competence and teamwork.

Clause 7 – Product/service realization in projects

Clause 7 is the largest clause. It organises the work of the project into seven groups of processes:

Interdependency-related processes – starting the project and producing the project management plan, managing interactions between processes, managing changes and closing processes and the project. These processes coordinate all the others.
Scope-related processes – defining the project's scope in measurable terms, breaking it into activities and controlling the work against it.
Time-related processes – working out dependencies between activities, estimating durations, developing the schedule and controlling it.
Cost-related processes – estimating costs, setting a budget and controlling spending against it.
Communication-related processes – planning who needs what information and when, managing project information and checking that communication works.
Risk-related processes – identifying, assessing, treating and monitoring risks to the project's objectives throughout its life, including opportunities as well as threats.
Purchasing-related processes – planning and controlling what is bought, documenting purchasing requirements, evaluating external providers, contracting and controlling contracts.

Figure 3 – In clause 7 the interdependency-related processes coordinate six other process groups, each with typical outputs.

The names will look familiar to project managers, because they mirror the subject areas of most project management guides. The difference is the angle: ISO 10006 asks what each process must do so that the project's results meet requirements, and how quality management practices (such as defined responsibilities, reviews, records and verification) make the process reliable. The interdependency group deserves particular attention: in a project almost every decision ripples across scope, time, cost and risk, and the guidance puts change management and coordination at the centre for that reason.

Clause 8 – Measurement, analysis and improvement in projects

Clause 8 deals with learning. It covers how the project measures and analyses performance (progress data, test results, nonconformities, customer feedback, supplier performance) and how improvement happens at two levels. The project organization improves while the project runs, by acting on progress evaluations and problems. The originating organization improves across projects, by collecting the lessons learned from completed projects and using them to change its processes, templates, training and supplier choices. Because a single project has limited chances to improve itself, the second level is where most long-term benefit comes from.

Annexes

The standard also has informative annexes that support the main text. Treat them as aids to understanding; like the rest of the document they contain recommendations, not requirements.

Lesson 4 – How it works in practice

Start with the strategic process

Applying ISO 10006 begins before any detailed planning. The originating organization and the project manager agree why the project exists, who its customer and other interested parties are, what they need, and what the project's objectives are, including quality objectives that can actually be measured (for example "zero critical defects open at go-live" or "all safety inspections passed at first attempt"). They also decide how far the originating organization's quality management system applies, which project-specific procedures are needed, and how decisions and escalations will work. Writing these decisions down early prevents the most common project quality problem: people discovering halfway through that they had different ideas about what "good" meant.

Write the project quality plan

The project quality plan turns those decisions into a working document. A typical plan covers:

the quality objectives and how they will be measured;
which processes and procedures of the originating organization apply, and which project-specific ones replace or add to them;
roles, responsibilities and authorities for quality, including who approves deliverables;
verification and validation activities: reviews, inspections, tests and acceptance criteria, and when they happen;
how documents and records will be controlled and kept;
how changes, nonconformities and corrective actions will be handled;
how external providers will be selected, controlled and checked;
the schedule of progress evaluations, management reviews and audits.

The plan should be proportionate. It is a living document: it is reviewed and updated as the project moves through its phases, and it should be agreed with the customer where the contract calls for it. ISO 10005 gives detailed guidance on what a quality plan can contain.

Run the processes and coordinate them

During delivery, the project organization runs the seven process groups of clause 7, supported by the resource and personnel processes of clause 6. In practice this means defining the scope clearly enough to verify it, keeping a schedule and budget that are realistic and controlled, running a risk process from the start rather than as an afterthought, planning communication with every interested party, and treating purchasing as a quality activity (a weak subcontractor can sink an otherwise well-run project). The interdependency processes hold it all together, above all change management: every proposed change is recorded, its effect on scope, time, cost, risk and quality is assessed, it is approved or rejected by someone with authority, and the plans are updated.

Check progress and learn as you go

Progress evaluations are the heartbeat of ISO 10006 in practice. They are planned at points that make sense for the project, often at the end of each phase or at major milestones, and they look at more than the schedule: are the objectives still achievable, are the deliverables meeting their acceptance criteria, are the processes working, are the risks under control? Ideally they involve people who can be objective about the work. The results feed management reviews, where the originating organization and the project organization decide on corrective action, changes to plans or, in some cases, whether the project should continue at all.

Figure 4 – Progress evaluations at planned points drive corrective action during the project, and lessons learned improve the next one.

Close the project properly

Closure is where many projects lose the value of their experience. ISO 10006 treats closing as a process in its own right: confirm that the deliverables have been accepted, close contracts with external providers, settle open nonconformities and changes, archive the records the customer or regulators need, release people and resources, and hold a final review that captures lessons learned in a form the originating organization can use. A lessons-learned report that nobody reads is not enough; the originating organization should decide who will act on the findings.

Roles in practice

ISO 10006 does not prescribe job titles, but most projects that apply it well have recognisable roles. A sponsor or senior manager in the originating organization owns the purpose and resources of the project. The project manager is responsible for the project's quality management system and for making the processes work. A project quality lead (on larger projects) helps write the quality plan, organises verification and audits, and tracks nonconformities and actions. Work package or team leads own the quality of their parts. The customer's representative approves requirements and accepts deliverables. External providers have their own quality responsibilities, set out in contracts.

Typical artefacts

Expect to see a project charter or brief, a project management plan, a project quality plan, a requirements or scope statement, a work breakdown, a schedule and budget, a risk register, a communication plan, a change log, an issue and nonconformity log, purchasing and contract records, verification and test records, progress evaluation reports, management review minutes and a closure report with lessons learned. ISO 10006 does not require any particular template; it recommends that the information exists, is controlled and is used.

Lesson 5 – Assessment, certification and compliance

No certification against ISO 10006

Because ISO 10006 is a guidance document written in "should" statements, there is no accredited certification of organisations or projects against it. An auditor cannot declare a project "conformant" to recommendations that each organisation is expected to tailor. If a provider advertises "ISO 10006 certification" for an organisation, treat the claim with caution and ask what exactly is being certified and against which requirements. Training providers may issue certificates of attendance or course completion for ISO 10006 training; these show that a person studied the guidance, not that an organisation conforms to anything.

Where certification does come in

Many project-based organisations hold ISO 9001 certification for their quality management system, with their project work in the scope. In that case the ISO 9001 requirements are what the certification body audits, and ISO 10006 is a helpful source of good practice for meeting those requirements in a project setting. An ISO 9001 auditor visiting such an organisation will typically ask to see how projects are planned and controlled, how customer requirements are captured, how design and changes are managed, how external providers are controlled, and what happens to nonconformities and lessons learned. A project quality plan built on ISO 10006 makes that evidence easy to find.

Ways to evaluate how well ISO 10006 is applied

Self-assessment or gap analysis – the organisation compares its project practices with the guidance, clause by clause, and records strengths and gaps. This is the most common use.
Internal audits – auditors from outside the project check whether the project quality plan is being followed and whether it is effective, using the auditing guidance of ISO 19011.
Progress evaluations and management reviews – the project's own built-in checks, which ISO 10006 itself recommends.
Customer or second-party audits – a client may audit a contractor's project quality arrangements, often against a contract clause that asks for a quality plan in line with ISO 10005 or ISO 10006.
Post-project reviews – the originating organization reviews completed projects to see whether the lessons learned were captured and used.

What evaluators look for

A useful evaluation looks for evidence, not just documents. Is there a project quality plan, and do the team know it and use it? Are quality objectives measurable and reported? Are changes assessed for their effect on quality before approval? Are external providers evaluated before contracts are signed and monitored afterwards? Are progress evaluations held when planned, and do they lead to decisions? Are nonconformities recorded and closed with real corrective action? And at the end, did the lessons learned change anything in the originating organization? Paper that exists only for audits is a weakness, not a strength.

Contracts and regulation

ISO 10006 becomes binding only when someone makes it so. A contract may require the supplier to "manage quality in line with ISO 10006" or to provide a quality plan that follows its guidance; the parties then need to agree what evidence will satisfy that clause. Regulators in sectors such as construction, defence or medical devices usually set their own requirements, and ISO 10006 can help a project meet them without replacing them.

Lesson 6 – Worked example

This example follows a fictional but realistic project from start to finish to show how the pieces fit together.

The situation

Harbourline Health, a regional group of four hospitals, wants a new online appointment system so that patients can book, move and cancel outpatient appointments from a phone. The group's board approves the project and sets a target: the system must be live in all four hospitals within nine months, must integrate with the existing patient administration system, and must meet the national rules on health data protection and accessibility. Harbourline is the originating organization. It contracts Corvel Software, a 120-person company that holds ISO 9001 certification, to deliver the system. Corvel sets up a project organization: a project manager, a business analyst, six developers, two testers, a part-time quality lead, and a subcontractor that provides the text-message reminder service. Harbourline appoints its outpatient services director as sponsor and a clinic manager as the customer representative.

Step 1 – Strategic process

In the first two weeks the Corvel project manager and Harbourline's sponsor run workshops with clinic staff, patients' representatives, the IT department and the data protection officer. They agree on the project's purpose (fewer missed appointments and less phone traffic for clinic staff), the interested parties and their needs, and four measurable quality objectives: no critical or high-severity defects open at go-live; at least 95 % of a sample of test patients able to book an appointment without help; accessibility checks passed against the national guideline; and a data protection impact assessment approved before any real patient data is used. They also agree that Corvel's ISO 9001 system applies, with project-specific procedures for clinical safety review and data protection.

Step 2 – Project quality plan

The quality lead drafts a twelve-page project quality plan. It lists the quality objectives and how each will be measured, names who approves requirements (the customer representative), designs (the Corvel technical lead plus Harbourline IT) and releases (the sponsor), and sets out reviews at the end of each of five phases: discovery, design, build, testing and rollout. It describes the change process, the nonconformity log, record keeping (test evidence must be kept for the contract period), and how the text-message subcontractor will be controlled. The plan is reviewed with Harbourline and approved before design work starts.

Step 3 – Resources and people

Resource planning shows that a test copy of the patient administration system is needed by month three; Harbourline IT confirms the date in writing and the dependency goes into the risk register. Personnel planning reveals that no developer has worked with the national accessibility guideline, so two developers attend training in month one and an accessibility specialist reviews the design. The project manager runs a short team start-up session so that Corvel staff and Harbourline's clinic manager agree on how they will work together and how disagreements will be escalated.

Step 4 – Running the clause 7 processes

Scope: the business analyst writes user stories with acceptance criteria and maps each to a requirement, so that testing can show coverage. Time and cost: the schedule and budget are built bottom-up from the work breakdown, with a contingency agreed with the sponsor. Communication: a communication plan sets a fortnightly progress report to the sponsor, a monthly briefing for clinic managers, and a simple status page for staff. Risk: the risk register starts with eleven risks, including late availability of the test system, poor mobile signal in some clinics, and an opportunity to reuse an accessibility component from another Corvel product. Purchasing: Corvel evaluates two possible text-message providers on reliability, data protection and support, chooses one, and writes a contract with service levels and a right to audit.

Step 5 – A change and its ripple effects

In month four Harbourline asks for a new feature: patients should be able to join a waiting list for earlier appointments. The change is logged and assessed. The analysis shows two extra weeks of development, extra testing, a new data protection question and a risk to the go-live date. The sponsor and the project manager agree to accept the change but move a low-value reporting feature to a later release so that the date holds. Scope, schedule, budget, risk register and quality plan are all updated. Without this interdependency step, the new feature would have quietly squeezed the testing time.

Step 6 – Progress evaluation at the end of build

The end-of-build progress evaluation is led by a Corvel quality auditor from another project and attended by Harbourline's customer representative. It finds that the code is complete and unit-tested, but that 14 % of accessibility checks have failed and that the subcontractor has not yet passed its security review. The evaluation leads to a management review decision: testing starts on schedule for the booking functions, but rollout cannot begin until accessibility failures are fixed and the subcontractor passes review. Corrective actions are assigned with dates, and the evaluation report is added to the project records.

Step 7 – Verification, rollout and acceptance

System and user acceptance testing run against the agreed acceptance criteria. Ninety-seven patients from a volunteer panel try the app; 96 % book without help, meeting the objective. The data protection impact assessment is approved. The system goes live in one hospital first, then in the other three over four weeks, with a daily review of defects and calls to the clinic help desk. At go-live no critical or high-severity defects remain open.

Step 8 – Closure and lessons learned

At closure, the customer signs acceptance, the subcontract moves to the operational support contract, records are archived, and the team holds a final review. Three lessons are recorded and passed to Corvel's quality manager (as the delivery organisation's own knowledge) and to Harbourline's IT governance board (as the originating organization): plan accessibility expertise from the first week; ask for test environments from clients as a contract condition, not as a favour; and include data protection review in the change assessment template. Corvel updates its project quality plan template accordingly, and Harbourline adds the test environment clause to its standard contract for future projects. The improvement loop of clause 8 is complete.

What the example shows

Nothing in the example required a certificate or a special tool. What made the difference was a strategic conversation about what quality meant, a short but real quality plan, disciplined change control, progress evaluations that led to decisions, and lessons that changed both organisations' ways of working. That is ISO 10006 in practice.

Lesson 7 – Relationship to other standards and frameworks

ISO 10006 sits at the meeting point of two worlds: quality management (the ISO 9000 family) and project management (the ISO 21500 family and the professional bodies of knowledge). Knowing the neighbours helps you use each one for what it does best.

Document	What it is	How it relates to ISO 10006
ISO 9001	Requirements for a quality management system; certifiable. Current edition 2026.	ISO 10006 helps apply the same principles and practices inside projects. Certification is against ISO 9001, never ISO 10006.
ISO 9000	Fundamentals and vocabulary of quality management, including the quality management principles. Current edition 2026.	Source of the terms and principles that ISO 10006:2017 uses (it was written against the 2015 edition).
ISO 21502	Guidance on project management: practices, roles and the project life cycle.	Covers project management itself; ISO 10006 deliberately leaves that to the ISO 21500 family and focuses on quality.
ISO 10005	Guidelines for quality plans.	Explains in detail how to write the project quality plan that ISO 10006 recommends.
ISO 10007	Guidelines for configuration management. Current edition 2017; a revision is under development.	Supports change and configuration control of project deliverables, a key interdependency topic.
ISO 31000	Guidelines for risk management.	Provides a fuller risk process that the risk-related processes of ISO 10006 can use.
ISO 19011	Guidelines for auditing management systems.	Used to plan and run internal or customer audits of project quality arrangements.
PMI's PMBOK Guide and PRINCE2	Widely used professional project management guides, not ISO standards.	Cover the same process areas from a project management angle; ISO 10006 adds a quality management lens and can sit alongside either.

ISO 10006 and ISO 9001

The most common question is whether a project needs ISO 10006 if the company already has ISO 9001. ISO 9001 tells an organisation what its quality management system must achieve; it says relatively little about the special conditions of temporary, unique work. ISO 10006 fills that gap with practical guidance. An ISO 9001 certified company can use ISO 10006 to design its project procedures and templates; an organisation without ISO 9001 can use ISO 10006 on its own to bring structure to project quality.

ISO 10006 and project management guides

Project management guides such as ISO 21502, PMI's PMBOK Guide and PRINCE2 describe how to plan and run projects in general. They all include quality as one topic among many. ISO 10006 turns this around: quality is the lens, and every project process is examined for its contribution to the results meeting requirements. In practice organisations combine them: they use their chosen project method for the overall way of working and ISO 10006 to make sure the quality side is covered thoroughly. Agile delivery fits as well: iterative planning, frequent reviews with the customer and retrospectives are natural ways to carry out the principles of customer focus, evidence-based decisions and improvement.

Reading the 2017 text after the 2026 quality revisions

Because ISO 9000 and ISO 9001 were revised in 2026 and ISO 10006 was not, references in the 2017 text point to editions that have since been withdrawn. The guidance itself remains sound, but an organisation that is moving its quality management system to ISO 9001:2026 should check its project procedures against the new requirements directly, rather than assuming that following ISO 10006 covers everything.

Common pitfalls and best practices

Common pitfalls

Quality plan as paperwork – writing a long project quality plan to satisfy a contract, then never using it. The team works one way and the plan describes another.
Copying the corporate system unchanged – applying every procedure of the originating organization to a small project, or none of them to a large one, instead of tailoring.
Quality only at the end – relying on final testing or inspection to find problems, when most quality issues start in unclear requirements, uncontrolled changes or weak suppliers.
Changes without impact assessment – accepting scope changes informally, so that time, cost, risk and testing effects appear later as surprises.
Progress reports that only track the schedule – reporting percent complete while ignoring whether deliverables meet their acceptance criteria.
Lessons learned that go nowhere – holding a final review but never passing the findings to anyone with the authority to change future projects.
Unclear split of responsibilities – the originating organization and the project organization each assuming the other is handling quality, supplier control or approvals.
Claiming "ISO 10006 certification" – marketing a certification that does not exist, which can mislead customers.

Best practices

Define what quality means early – agree measurable quality objectives with the customer and other interested parties in the strategic process.
Keep the quality plan short, specific and alive – proportionate to the project, reviewed at each phase and known by the team.
Put change control at the centre – assess every change for its effect on scope, time, cost, risk and quality before approval.
Treat suppliers as part of the project's quality – evaluate external providers before contracting and monitor them throughout.
Plan progress evaluations and act on them – schedule them at meaningful points, involve objective reviewers and record the decisions.
Invest in competence and teamwork – check skills gaps at the start and build a team that understands its quality responsibilities.
Close the improvement loop – give lessons learned an owner in the originating organization and update templates, training and contracts.
Use the neighbours – combine ISO 10006 with ISO 10005 for quality plans, ISO 31000 for risk and ISO 19011 for audits.

Summary and key takeaways

ISO 10006:2017 is the current, confirmed guidance standard for quality management in projects; it gives recommendations, not certifiable requirements.
Quality in projects has two sides: the quality of the project processes and the quality of the products and services they deliver.
The originating organization decides on, directs and resources the project; the project organization runs it and manages its quality day to day.
The guidance is organised in clauses 4 to 8: quality management systems in projects, management responsibility, resources, realization and improvement.
Clause 7 groups project work into interdependency, scope, time, cost, communication, risk and purchasing processes, with change management at the centre.
A proportionate, living project quality plan and planned progress evaluations are the main practical tools.
Lessons learned must flow back to the originating organization, because a single project has little time to improve itself.
Certification, where wanted, is against ISO 9001; ISO 10006 helps meet it in project settings and should be read alongside the 2026 quality standards.

Reflection questions

Think of a project you have worked on. Who was the originating organization and who was the project organization, and where did their responsibilities for quality overlap or fall between the two?
Draft three measurable quality objectives for a project you know. How would you check each one, and at which point in the life cycle?
Pick a change that was made late in a past project. Using the interdependency idea, trace its effects on scope, time, cost, risk and quality. What would a good change assessment have caught?
Your organisation already holds ISO 9001 certification. Which three parts of ISO 10006 would most improve how your projects are run, and why?
Look at the last lessons-learned report you saw. Which of its findings actually changed a process, template, contract or training course, and how could you make that happen more reliably?