Global Community

The September issue of Quality Progress features a cover story by Lisa Uhrig that breaks down the upcoming ISO 9001:2026 revision.

Uhrig walks through the most significant changes, and a few stand out for those working in auditing and conformance:

• A greater emphasis on quality culture. The revision pushes organizations to embed quality into their culture, not just their processes. That shift will affect how management systems are audited and assessed.
• A new focus on ethical behavior. For the first time, ethics gets clearer attention within the standard. This raises important questions about evaluating conduct alongside conformance.
• Separating risk and opportunity. The standard now treats risk and opportunity as distinct concepts. This provides a sharper framework for risk-based thinking and helps auditors make more precise findings.

These changes will influence QMS certification renewals, client audit requirements, and the way teams prepare for transition.

Uhrig's article offers a comprehensive look at each new requirement, so you can plan your transition with confidence. If you support clients through certification or manage systems internally, it's a helpful roadmap for what's ahead.

Login to access the full cover story here: https://asq.org/quality-progress/articles/iso-9001–2026?id=440cafd66bba4f51871c3b55d9803aaf

We'd love to hear from you. Which of these changes feels most significant for your work? Are you already thinking about how the quality culture and ethics requirements will show up in your audits?

Drop your thoughts or questions in the replies. If you've started planning your move to ISO 9001:2026, share what's working. Let's learn from each other and get ready together.

------------------------------
Benjamin Koziol
Marketing & Digital Specialist
Exemplar Global · ASQ
------------------------------

The separation of risk and opportunity is the one that will change what I actually do on site. Most systems I audit treat opportunity as the leftover half of the risk register, so it fills up with risks written out positively and nothing is ever planned from it. Once opportunity carries its own planning requirement, the audit question becomes what the organisation went looking for rather than only what it was worried about, and that is a genuinely different conversation to have with a management team.

Quality culture and ethics feel bigger on paper but they are the harder ones to audit well. I would not want to go hunting for a culture policy, because that only produces another document. What tells me something is whether people close to the work can describe a time they stopped a job or raised a concern and what happened afterwards. If nobody can give me that example, the culture wording in the manual is not describing the organisation, and that is a finding worth writing carefully.

------------------------------
Dilawar Laghari
Auditor, Consultant and Trainer
Audit Workshop
https://auditworkshop.com/
------------------------------

Dear Dilawar,

Most of organizations will continue to address opportunities through improvement projets/actions. Quality culture and ethics are effectively the main changes. In the first year the evidence of these would be mostly documented information provided during the audit of context of the organization (strategy direction), leadership and commitment, training and awareness. The management review may address quality culture projets or activities. A new program is launched in Canada 3-4 years ago to evaluate the workplace of an organization and to issue an award for Best Workplace or Rewarded Organization where people like to work, They have a specific criteria for the assessment of the organizational workplace every year of two years. It is voluntary program. Organization culture is one of the criteria. So, the auditors may check if they maintain their workplace award in Canada. Ethics have already included in the training of professional workers.

I hope in 2028, auditors should be competent to effectively audit these new changes, insted to only verify documented information.

Thanks! 

------------------------------
Marc Kanho
Senior QMS Lead Auditor and Consultant
K-Marc Canada
------------------------------

Original Message:
Sent: 09-09-2026 11:36 PM
From: Dilawar Laghari
Subject: New Article Exploring ISO 9001:2026 Updates

The separation of risk and opportunity is the one that will change what I actually do on site. Most systems I audit treat opportunity as the leftover half of the risk register, so it fills up with risks written out positively and nothing is ever planned from it. Once opportunity carries its own planning requirement, the audit question becomes what the organisation went looking for rather than only what it was worried about, and that is a genuinely different conversation to have with a management team.

Quality culture and ethics feel bigger on paper but they are the harder ones to audit well. I would not want to go hunting for a culture policy, because that only produces another document. What tells me something is whether people close to the work can describe a time they stopped a job or raised a concern and what happened afterwards. If nobody can give me that example, the culture wording in the manual is not describing the organisation, and that is a finding worth writing carefully.

------------------------------
Dilawar Laghari
Auditor, Consultant and Trainer
Audit Workshop
https://auditworkshop.com/
------------------------------

Thanks Marc, that is a fair read of year one. I agree most of the early evidence will sit in context, leadership and awareness records, and an external workplace award can be a useful input as long as the auditor still tests it with people on the floor, because an award reflects a survey at a point in time rather than what happens when a job goes wrong late on a Friday. Your point about 2028 is the real one for me: the change only lands if auditors build the interviewing skill to test culture rather than read about it, and that is where I spend most of my time with the new auditors I train.

------------------------------
Dilawar Laghari
Auditor, Consultant and Trainer
Audit Workshop
https://auditworkshop.com/
------------------------------

Original Message:
Sent: 09-10-2026 09:41 PM
From: Marc Kanho
Subject: New Article Exploring ISO 9001:2026 Updates

Dear Dilawar,

Most of organizations will continue to address opportunities through improvement projets/actions. Quality culture and ethics are effectively the main changes. In the first year the evidence of these would be mostly documented information provided during the audit of context of the organization (strategy direction), leadership and commitment, training and awareness. The management review may address quality culture projets or activities. A new program is launched in Canada 3-4 years ago to evaluate the workplace of an organization and to issue an award for Best Workplace or Rewarded Organization where people like to work, They have a specific criteria for the assessment of the organizational workplace every year of two years. It is voluntary program. Organization culture is one of the criteria. So, the auditors may check if they maintain their workplace award in Canada. Ethics have already included in the training of professional workers.

I hope in 2028, auditors should be competent to effectively audit these new changes, insted to only verify documented information.

Thanks! 

------------------------------
Marc Kanho
Senior QMS Lead Auditor and Consultant
K-Marc Canada
------------------------------


Original Message:
Sent: 09-09-2026 11:36 PM
From: Dilawar Laghari
Subject: New Article Exploring ISO 9001:2026 Updates

The separation of risk and opportunity is the one that will change what I actually do on site. Most systems I audit treat opportunity as the leftover half of the risk register, so it fills up with risks written out positively and nothing is ever planned from it. Once opportunity carries its own planning requirement, the audit question becomes what the organisation went looking for rather than only what it was worried about, and that is a genuinely different conversation to have with a management team.

Quality culture and ethics feel bigger on paper but they are the harder ones to audit well. I would not want to go hunting for a culture policy, because that only produces another document. What tells me something is whether people close to the work can describe a time they stopped a job or raised a concern and what happened afterwards. If nobody can give me that example, the culture wording in the manual is not describing the organisation, and that is a finding worth writing carefully.

------------------------------
Dilawar Laghari
Auditor, Consultant and Trainer
Audit Workshop
https://auditworkshop.com/
------------------------------

I am glad quality and ethic are required as part of certified ISO 9001 organizations' culture, where every employee and top management are committed to doing work right , continuously improving it to create customer value and business success. The share values and people's behaviors in an organization that makes them consistently care about doing right and therefore meeting standards. This change makes quality standards clear.

Ethics refer to the moral part. Moral principle guides behaviors and decision making in an organization. Ethics keep everybody honest, fair and responsible. This change gives auditors more work to do. I will verify conformity along side with their documents and now I have to probe or evaluate whether the system is credible, and ethically operated.

Thank you Ben for your question!

------------------------------
Godly Yao
------------------------------

Folks,

I want to share a segment from my book that talks about an audit client of mine between 2018 - 2022 and their implementation/certification of a Business Management System (BMS).  This example is what I intended as a BMS.

Y. The Business Management System.   A Business Management System (BMS) is not one of the ISO Management Systems.  The BMS evolved when a client of mine decided to integrate three management systems: ISO 9001:2015, ISO 14001:2015, and ISO 45001:2018.  We started to call the management system a Quality, Environmental, Occupational Health & Safety Management System and I suggested calling it a Business Management System (BMS).  As both the Lead Auditor and the Client Manager for this client, I was able to make some suggestions to this client in developing the BMS.  This client had 155 facilities across 40 countries, and all the facilities would be brought under the BMS over a few years.  Initially, they had facilities with no certified management systems, some with a QMS only, some with an EMS only and a few with both management systems.  A BMS Procedure, combining the three management systems into one BMS Management System was created by the Corporate Management System Staff.  Both the US and Global Corporate Offices were located in the United States separated by only a parking lot.  My audit team began to conduct BMS audits of both of the Corporate Offices.  From there, DQS Audit Teams began to audit U.S. facilities against the BMS since most of the facilities with both a certified QMS and EMS were located in the U.S.  I had planned to retire at the end of 2018 and so turned my position as Lead Auditor and Client Manager to another DQS Lead Auditor.  I communicated with him in 2025 and he said that the corporation continued to make good progress with the BMS.

As it turns out, I did not retire in 2018 and took on a new DQS Audit Client as both the Lead Auditor and the Client Manager of the Corporation's North American operation.  This manufacturing corporation had  14 large facilities across the United States and Canada.  Like the previous organization, there was a mix of plants with no management systems, some with an ISO 9001:2015 QMS, some with an ISO 14001:2015 EMS but none of the plants with both management systems integrated.  Like the previous organization, this Corporation decided to create an integrated management system with ISO 9001:2015, ISO 14001:2015, and ISO 45001:2018 and like the previous Corporation, decided to call it a Business Management System (BMS).  One procedure for the integrated management system was created by the Corporate Management System Staff, and the process was begun to first bring the Corporate Office under the BMS and then the plants that were already certified to the QMS and the EMS, when they came due for their annual surveillance or recertification audits. 

The BMS was led by the Top Management Team which included the CEO, all the Vice Presidents/Directors and the Management System Director.  The Context of the Organization was conducted by all the members of the Top Management Team. Each member of the Top Management Team, regardless of their department, were assigned responsibility and accountability for at least one of the BMS objectives and the associated action plans, all based on the Risks and Opportunities developed in the Context of the Organization.  This also became part of the Top Management Team Members' annual performance appraisal.  When I audited the Corporate Headquarters, I would typically spend half a day with the CEO covering the BMS Clauses 4, 5, and 6.  I would also audit every member of the Top Management Team particularly on Clause 6.  This included the VPs or Directors of Marketing, Sales, Customer Service, Purchasing, Information Technology, Research and Development, Quality and the Production, Shipping & Receiving, and Maintenance Departments.  Quite frankly, they were proud to tell me what their department was contributing to the BMS.  The principle Corporate Office in Milan, Italy decided to follow suit and implemented a BMS for the remainder of the corporation, bringing the total plants to 106 in 42 countries. 

I feel strongly that this is the future of the management systems and a direction I see businesses heading in the future.  I also see it as a means to move from just management system certification to a change in the culture of the organization and the benefits that can result.

I apologize for such a long discussion, but I felt that the whole story needed to be told.

Chris

------------------------------
Chris Spire
MSIA Associates, LLC
------------------------------

The separation of risk and opportunity is particularly significant from an auditing perspective. It could help organizations and auditors move toward a more precise evaluation of how risks and opportunities are identified, assessed, and addressed within the QMS.

I'm also very interested in how quality culture and ethical behavior will translate into objective, auditable evidence without turning the audit into a subjective assessment. These changes will certainly require auditors to look beyond documented processes and consider how the QMS is actually embedded in the organization.

------------------------------
Francisco J. Tapia Guerrero
ftapia@qualitascertification.com
www.linkedin.com/in/franktapiaguerrero
------------------------------

Hi@Francisco J. Tapia Guerrero 

Very good point! I'm really interested in seeing how organizations successfully bridge that gap integrating qualitative quality insights with substantive metrics to truly shape their culture. 

------------------------------
Frank Higley-Sanchez
------------------------------

Original Message:
Sent: 09-11-2026 11:38 PM
From: Francisco J. Tapia Guerrero
Subject: New Article Exploring ISO 9001:2026 Updates

The separation of risk and opportunity is particularly significant from an auditing perspective. It could help organizations and auditors move toward a more precise evaluation of how risks and opportunities are identified, assessed, and addressed within the QMS.

I'm also very interested in how quality culture and ethical behavior will translate into objective, auditable evidence without turning the audit into a subjective assessment. These changes will certainly require auditors to look beyond documented processes and consider how the QMS is actually embedded in the organization.

------------------------------
Francisco J. Tapia Guerrero
ftapia@qualitascertification.com
www.linkedin.com/in/franktapiaguerrero
------------------------------

This discussion raises an important question for me: perhaps the challenge is not how to "audit culture" directly, but how to audit whether the claimed culture is consistently reflected in the way the management system actually operates.

An auditor does not necessarily need a single "culture metric." Instead, I would look for convergence between different sources of evidence: what leadership says, what employees experience, what happens when bad news is reported, how nonconformities are handled, whether people feel able to stop or challenge a process, how recurring problems are escalated, and whether management decisions remain consistent with stated quality values when cost or delivery pressure increases.

Any one of these indicators on its own may be subjective. But when several independent sources point in the same direction, they begin to form credible audit evidence.

The opposite is equally revealing. A company may have excellent quality policies, awareness records and employee surveys, yet repeated workarounds, suppressed problems or incentives that reward output at the expense of conformity may tell a very different story.

This may also change the auditor's role. The competence required will not simply be knowing what evidence to request, but knowing how to triangulate evidence and recognize contradictions between the documented system, the reported system, and the system actually being practiced.

Perhaps that is where quality culture and ethical behavior can become auditable without turning the audit into a subjective judgment.

I would be interested to hear how others see this: what combination of evidence would give you sufficient confidence to conclude that an organization's stated quality culture is genuinely embedded in practice?

------------------------------
Ahmed Rashidy Abdo

Founder & Managing Director | Quality For All (QFA)
Quality Management Consultant | Management Systems Auditor | International Trainer

Building professional competency and organizational excellence across the Middle East & Africa.

https://qfaplus.com
------------------------------

Hello Dear Members,

The ISO 9001:2026 is finally released. Thanks!

------------------------------
Marc Kanho
Senior QMS Lead Auditor and Consultant
K-Marc Canada
------------------------------

Original Message:
Sent: 09-16-2026 10:30 AM
From: Ahmed Rashidy Abdo
Subject: New Article Exploring ISO 9001:2026 Updates

This discussion raises an important question for me: perhaps the challenge is not how to "audit culture" directly, but how to audit whether the claimed culture is consistently reflected in the way the management system actually operates.

An auditor does not necessarily need a single "culture metric." Instead, I would look for convergence between different sources of evidence: what leadership says, what employees experience, what happens when bad news is reported, how nonconformities are handled, whether people feel able to stop or challenge a process, how recurring problems are escalated, and whether management decisions remain consistent with stated quality values when cost or delivery pressure increases.

Any one of these indicators on its own may be subjective. But when several independent sources point in the same direction, they begin to form credible audit evidence.

The opposite is equally revealing. A company may have excellent quality policies, awareness records and employee surveys, yet repeated workarounds, suppressed problems or incentives that reward output at the expense of conformity may tell a very different story.

This may also change the auditor's role. The competence required will not simply be knowing what evidence to request, but knowing how to triangulate evidence and recognize contradictions between the documented system, the reported system, and the system actually being practiced.

Perhaps that is where quality culture and ethical behavior can become auditable without turning the audit into a subjective judgment.

I would be interested to hear how others see this: what combination of evidence would give you sufficient confidence to conclude that an organization's stated quality culture is genuinely embedded in practice?

------------------------------
Ahmed Rashidy Abdo

Founder & Managing Director | Quality For All (QFA)
Quality Management Consultant | Management Systems Auditor | International Trainer

Building professional competency and organizational excellence across the Middle East & Africa.

https://qfaplus.com
------------------------------