Category: General-2

Chemical companies may think that by implementing ISO 14001 they meet the requirements for Responsible Care ®. ISO 14001 is an internationally accepted standard that provides the framework for an environmental management system. However, the Responsible Care ® program demands more. It adds a layer of requirements for Health & Safety and Security to be integrated along with environmental requirements.

Members of the American Chemistry Council (ACC) commit to implementing a system aligned to either the Responsible Care ® Management System (RCMS) Technical Specification or the RC 14001 which integrates the requirements of RCMS and ISO 14001 into one standard. Companies choosing the RC14001 standard can then claim conformity to both standards while putting in similar effort.

This article clarifies what each framework covers, where they overlap, and how to audit both efficiently

What RCMS Is and Who Requires It

Responsible Care ® is the American Chemistry Council’s (ACC) industry-wide performance initiative. It is not just an environmental standard. The need for a performance standard was identified following major incidents at chemical plants in the 1980s. RCMS is more than just a set of operational requirements. It outlines the requirements for a management system. Management systems include interaction from the highest level of the organization to the lowest level and enables effective interaction across processes.

ACC member companies are contractually required to certify to RC 14001 or RCMS; non-members may still be pulled in by customer or supply-chain requirements. Some organizations may voluntarily opt to confirm to the requirements of these standards. While RCMS is not a regulatory requirement, it is an obligation an ACC member opts to conform to.

RCMS follows the plan-do-check-act cycle and dovetails well with the requirements of ISO 14001. It expands upon the environmental requirements of ISO 14001 to include health & safety and security (HSS). It is also supported by the underlying ACC codes. Namely the Process Safety code, the Product Safety code and the Security code.

RCMS vs ISO 14001: Key Overlaps and Differences

Both standards, the RCMS and RC14001 are management system standards and thus based on the Plan-Do-Check-Act cycle. This means that both require the foundational aspects of a management system. These include leadership commitment, a documented policy, operational controls to manage identified risks, monitoring of the system, internal audits and management reviews.

Each of these standards also require the organization to determine their compliance obligations and to then take measures to meet them and evaluate them. The system as a whole is to be used to drive continual improvement. The key difference is that ISO 14001 has a focus solely on environmental requirements and does not address HSS requirements.

RCMS and RC14001 also integrate loosely via the Process Safety Code the OSHA PSM requirements. It is, however, not a replacement for these regulatory requirements. Further the two RC standards also address product stewardship which entails enhancing EHSS requirements throughout the supply chain from cradle to cradle.

Compared to ISO 14001, the RC standards also carry specific ACC-mandated elements (e.g., community outreach/CAER, security vulnerability assessments) with no ISO 14001 equivalent. There are also different certification requirements when it comes to RCMS and ISO 14001. The RCMS requiring just one audit by an approved provider every three years.

Why Chemical Companies Often Need Both

Depending on the customer base, especially when international, an organization can benefit from using the RC14001 standards. There is an increasing demand from stakeholders for sustainable production and procurement. As such many are seeking ISO 14001 certification. As a member of ACC companies that need to conform to RCMS may benefit from alignment with RC14001. Many downstream customers specify ISO 14001 certification contractually, independent of ACC membership

ACC membership requires member companies must certify to RC 14001 or RCMS on a fixed cycle to remain in good standing. There is however the added benefit to company reputation from an independent verification of practices to demonstrate to stakeholders and interested parties the organization’s commitment to EHSS goals.

Most chemical manufacturers end up needing both frameworks running concurrently rather than choosing one

Combining RCMS and ISO 14001 Audits

These standards aside, if your company has an integrated management system, there is no reason for you not to be doing integrated audits. So, what is an integrated audit? It is an audit where an auditor of team of auditors competent in the requirements of the various standards samples and assess the effectiveness of controls as determined and applied across the organizational processes. This to the various standards the company is certified to.

With ISO moving to the harmonized standard approach starting in 2013, most ISO management system standards including the RC14001 share the same 10 clause approach. This makes it easy to audit the system as there is shared audit evidence across standards. There is also cost savings to the company both from audit time of the auditor and the time of the auditee spent in the audit. There is less burden on the auditees overall from reduced audit fatigue.

An integrated audit essentially has a single audit schedule, combined checklists mapped to both standards’ (RCMS and ISO14001) clauses and one audit team covering both scopes. Companies choosing RC14001 have already integrated the requirements of RCMS and ISO 14001 into one standard and so perform a single audit. Integrated audits also result in fewer duplicate corrective actions for the same root cause

Building Auditor Competence for RCMS and RC14001

The above integrated audits require auditors preferably trained in both standards simultaneously, not two separately trained pools. This of course again to save on time and cost. QMII’s RC14001 Lead Auditor training approved by Exemplar Global covers the requirements of RCMS, RC14001 and the applicable ACC codes.

Auditors must understand the relevant additional RCMS elements in ISO 14001 and be able to be objectives if just performing and ISO 14001 audit versus an RCMS or RC14001 audit. An effective auditing course approaches audits as a positive activity that helps the organization identify improvement opportunities and audits as key in the preventive cycle. With this integrated competence auditors must remain objective and learn to look beyond documented processed to enable better inputs for leadership.

An auditing course apart from the requirements of the standard must also build competence in the principles of ISO 19011 and include hands on workshop that allow auditors to hit the ground running and to quickly contribute to their organization’s audit program.

Conclusion

In conclusion, RCMS and ISO 14001 aren’t competing standards, they’re complementary. RCMS adding in the HSS requirements to build on the foundation of an ISO 14001 if already in place. Those companies choosing between RCMS and RC14001 may want to opt from RC14001 given the later ease of integrating other ISO standards such as ISO 9001.  

A well-trained auditor adds value to the system. They must provide good insight to the leadership on the state of the system, and this can only come from choosing a good sample, including whom to interview, questions to ask and documents to evidence.

ACC membership requires conformity to either RCMS or RC14001. Regardless of the option chosen by an organization, a trained audit team can only add value to the system. To learn more on the differences and build your auditing skills consider QMII’s RC14001 and RCMS Lead Auditor course. 

The process-based management system approach gives any organization the best shot at systematically improving administration and addressing nonconformities, so the output of the administration is a confirming product as step one. The next step would be to continually improve the system and meet objectives. ISO 18091 (Quality management systems guidelines for the application of ISO 9001 in local government) is an international standard designed specifically to help local governments and municipal authorities implement effective quality management systems (QMS) based on ISO 9001. Using a standard which encompasses worldwide wisdom on the system approach as the basis of the system is better than reinventing the wheel every time.

The Technical committees for various standards (TC-176 for ISO 9001) bring to the table a lot of wisdom on which they frame these standards. ISO 18091:2019, the second edition, was reviewed and confirmed by ISO in 2024 and therefore remains current. It was prepared by ISO/TC 176, quality management and quality assurance. This is important because the guidance is connected directly to the accepted principles and requirements of ISO 9001 while recognizing that local government has responsibilities that are different from those of a commercial organization.

Government affects the citizen throughout life. Birth registration, education, public health, roads, water, sanitation, emergency services, licensing, land use and public safety are all delivered through processes. When these processes are left to personalities, informal practices or the priorities of the moment, results vary. A management system converts good intentions into defined responsibilities, controls, measures and opportunities for correction. It also helps preserve institutional knowledge when elected leaders or senior officials change.

The word systematizing should not be misunderstood as adding bureaucracy. The objective is to simplify and control the work so that it produces intended results. ISO 9001:2026, Clause 4.4, requires the organization to determine the processes needed for the QMS, their interactions, the criteria and methods for operation and control, the resources required, responsibilities, risks and opportunities, and the methods for evaluation and improvement. ISO 18091 explains how this process approach can be applied to public policy and municipal services.

Rather than creating a standalone set of requirements, ISO 18091 translates the core concepts, principles, and clauses of ISO 9001:2015 into terms, structures, and processes that directly address the public sector. The standard provides the core objectives for good administration particularly, citizen centric focus, reliability and transparency and alignment with UN (United Nations) SDGs (sustainable development goals) as follows:

• Citizen-Centric Focus: Adapts the ISO 9001 concept of “customer satisfaction” into citizen satisfaction, focusing on key municipal responsibilities such as public safety, infrastructure, waste management, healthcare, and education.
• Reliability & Transparency: Standardizes public administration processes to improve transparency, accountability, operational efficiency, and overall public trust (“Trusted Governance”).

• Alignment with UN SDGs: Serves as a framework to implement, track, and measure progress toward the United Nations Sustainable Development Goals (SDGs) at the municipal level.

Citizen focus begins with understanding who the interested parties are and what they reasonably require. Clause 4.2 of ISO 9001 asks the organization to determine the relevant interested parties and their requirements. In a local government these parties extend beyond the person standing at a service counter. They include residents, visitors, businesses, employees, elected representatives, regulators, service contractors, vulnerable groups and future generations affected by present decisions. ISO 18091 helps the local government translate these different expectations into manageable processes and measurable public policy.

Leadership is central and Clause 5.1 requires top management to demonstrate leadership and commitment to the QMS. For local government this means that elected and appointed leaders cannot delegate the system to a quality coordinator and consider the work complete. Leaders must establish policy and objectives, provide resources, assign authority, review performance and act when results are not achieved. The system succeeds when it becomes the way the government manages, rather than a separate quality program maintained for an audit. Accountability remains with leaders and delegation of authority as per clause 5.3 would not mean leaders are not accountable.

Risk-based thinking also has direct public value. Clause 6.1 requires action on risks and opportunities. A municipality can therefore consider foreseeable interruptions and failures before they harm citizens: loss of drinking water, delayed permits, failure of waste collection, deterioration of roads, cyber incidents, extreme weather, contractor failure or loss of critical knowledge. Controls can then be proportionate to the consequence. The same analysis can identify opportunities such as digital services, shared resources, preventive maintenance and clearer communication with citizens.

A reliable system also distinguishes between correction and corrective action. If a citizen receives an incorrect permit, correcting the document solves the immediate problem. Clause 10.2 goes further by requiring the organization to react to the nonconformity, deal with its consequences, determine whether the cause could create the same or a similar failure elsewhere, implement needed action and review its effectiveness. This changes administration from repeated firefighting to prevention of recurrence.

The key Components and annexes of the standard include structured tools specifically tailored to municipal management. ISO 9001 remains the primary standard. ISO 18091 is not a sector specific standard in itself. It is a guideline enabling use of the ISO 9001 for governance. The standard provides:

• Clause-by-Clause ISO 9001 Translation: Offers guidance on how each standard requirement (e.g., leadership, risk management, performance evaluation) applies to public policy and municipal administration.
• Diagnostic Assessment Tool (Annex A): A self-assessment tool utilizing 39 key performance indicators across four broad policy categories:
  • Institutional development for good governance
  • Sustainable economic development
  • Social development
  • Sustainable environmental development

• Integral Quality Management Processes (Annex B): Guidance on designing and maintaining processes that ensure reliable public service delivery.
• Integral Citizen Observatories (Annex C): Guidelines for engaging citizens directly in monitoring public policy, fostering transparency and continuous improvement.
• UN Agenda 2030 Alignment (Annex D): Maps local government management indicators directly to the 17 UN Sustainable Development Goals.

The clause-by-clause guidance covers the full management cycle: context in clause 4, leadership in clause 5, planning in clause 6, support in clause 7, operation in clause 8, performance evaluation in clause 9 and improvement in clause 10. This sequence is useful because it prevents a government from jumping directly to measurement without first defining its purpose, processes, responsibilities and controls. Measurement then becomes evidence for decisions rather than a collection of statistics with no clear use.

Annex A can provide the starting point. Its 39 indicators enable a local government to examine public policy as an integrated whole. The value lies less in declaring a score and more in identifying where conditions are unacceptable, where essential practices are only partly established and where results are being sustained. Priorities can then be based on evidence, citizen need and risk. Periodic reassessment provides a visible record of progress and exposes areas that remain dependent on temporary effort.

Annex B supports the process view. Services such as issuing a license or repairing a road are rarely the work of one department from beginning to end. They require inputs, decisions, resources, contractors, information and communication across organizational boundaries. Mapping these interactions helps identify delays, duplication, unclear handoffs and missing controls. It also allows objectives to be assigned to the complete service, not merely to the activity of an individual department.

Annex C recognizes that citizens should not be treated only as passive recipients of government output. An integral citizen observatory provides a structured way for citizens to observe public policy, examine evidence and contribute to accountability. Citizen participation becomes more useful when it is based on defined indicators and verified information. It can confirm where services are working and identify gaps that internal reporting may overlook.

Annex D connects the local indicators to the UN Sustainable Development Goals and to other assessment and management systems. This helps local government translate broad global commitments into local processes and measures. A goal such as clean water, sustainable communities or climate action becomes meaningful only when responsibility, resources, controls, measures and follow-up are established at the level where services are delivered.

The key difference in ISO 18091 from the primary standard ISO 9001 is the guidelines. ISO 9001 provides generic requirements for any organization, whereas ISO 18091 is a sector-specific guide. It does not add or alter ISO 9001’s fundamental requirements; rather, it bridges the gap between private-sector quality management language and the multi-stakeholder, public-policy realities of local government.

This distinction is important for certification. A local government may be assessed for conformity to ISO 9001, but ISO 18091 itself supplies guidance and does not create additional certifiable requirements. The guidance should therefore be used to make the ISO 9001 system relevant and effective, not as a checklist that produces another layer of documentation.

Clause 7 helps ensure that plans are supported by competent people, suitable infrastructure, organizational knowledge, communication and controlled documented information. In government, documented information provides continuity and transparency, but documentation should serve the process. A procedure that is not followed, a record that is not analyzed or a measure that does not support a decision adds little value. The necessary amount and form of documentation should depend on complexity, risk, competence and the need for accountability.

Clause 8 brings the discipline to service delivery. Requirements must be understood, changes controlled, external providers managed and nonconforming outputs identified. This is particularly relevant because many public services are delivered through contractors or partnerships. Outsourcing an activity does not outsource accountability. The local government must determine the controls needed to ensure that externally provided processes and services continue to meet requirements.

Clauses 9.1, 9.2 and 9.3 close the management loop through monitoring, internal audit and management review. Clause 9.1.2 addresses customer satisfaction; ISO 18091 places this in the context of citizens and other interested parties. Satisfaction surveys can contribute evidence, but they are not enough by themselves. Service times, complaints, recurrence of failures, infrastructure condition, regulatory compliance, access, cost and achievement of public objectives provide a fuller picture. Internal audit should test whether processes are implemented and effective, while management review should lead to decisions on improvement, resources and needed changes.

Implementation can begin on a manageable scale. The local government can define its context and interested parties, use Annex A for an initial diagnosis, select one or two high-impact services, map their processes, establish measures and responsibilities, and begin the cycle of audit, review and corrective action. Early projects should demonstrate that the system makes work clearer and services more reliable. Lessons can then be applied across other departments and levels of government.

The benefits are practical. Citizens receive more consistent services and clearer information. Employees understand responsibilities and handoffs. Leaders receive evidence on whether policies are producing intended results. Suppliers and contractors work within defined controls. Problems are recorded and their causes addressed. Objectives are linked to resources and reviewed. Transparency improves because processes, measures and decisions can be explained.

ISO 18091 can therefore help systematize government without attempting to standardize political choices or make every municipality identical. ISO 9001 itself does not require uniformity in the structure of quality management systems. Each government retains its mandate, priorities and local context. What becomes systematic is the method used to understand needs, plan services, manage risk, deliver outputs, evaluate results and improve.

The real test of good governance is not the number of procedures written or certificates displayed. It is whether the administration consistently fulfills requirements, corrects failures, learns from evidence and improves the results experienced by citizens. ISO 18091 provides a sound guideline for doing this. Used by leadership and team with purpose, it can make government more reliable, transparent and capable of sustaining improvement beyond changes in personalities and political terms.

__

About the Author:

Inderjit (IJ) Arora, Ph.D., is the Chairman of QMII. He serves as a team leader for consulting, advising, auditing, and training regarding management systems. He has conducted many courses for the United States Coast Guard and is a popular speaker at several universities and forums on management systems. Arora is a Master Mariner who holds a Ph.D., a master’s degree, an MBA, and has a 35-year record of achievement in the military, mercantile marine, and civilian industry.

Every year, thousands of organizations undergo the intense experience of an ISO 9001 audit. Measurable Objectives (ISO 9001 clause 6.2) as key performance indicators are gathered, internal audit reports are polished, conference rooms are booked, and top management gathers to present a united front to the external auditor. When the registrar signs off with zero major non-conformities, a collective sigh of relief echoes through the hallways. One customer organizes a barbecue! QMII in its forty years in providing solutions for effective management systems has seen what follows. In many organizations, then something dangerous happens. The ISO standard goes back onto the shelf until next year.

This phenomenon is often dubbed ISO fatigue or audit-season sprint and is the single biggest vulnerability in quality management. Treating ISO 9001 as an annual event rather than an everyday operational engine guarantees stress, lost productivity, and, worse, a system that serves the auditor instead of the business.

Maintaining certification between surveillance audits should never feel like holding your breath under water until the external auditor resurfaces. Instead, it should be the natural byproduct of running a sound, value-adding Quality Management System (QMS). In QMII we have worked with our customers to do just that, so their system effectively meets requirements, produces confirming products and services and continually improves by reducing waste and giving the organization ROI (return on investment).

The trap of audit driven quality occurs when an organization operates in the audit-driven mode, the standard becomes a burden. Documentation is updated retrospectively, non-conformity reports (NCRs) are rushed through closing phases weeks before the registrar’s visit, and management reviews turn into mere tick-box exercises. The question is why does this happen? There are many reasons primary one has its genesis in not interpreting ISO 9001 clause 4.4.1 correctly where in there is a lack of process ownership. Process owners view ISO 9001 lead auditing as the Quality Manager’s job rather than their operational responsibility. Over-engineered documentation is another flaw in an ineffective system.  Standard operating procedures (SOPs) were written by the organization for the auditor rather than for the people executing the processes. Additionally, disconnection from strategy makes it worst. ISO 9001 clause 5.1 requires the business and quality to be effectively merged. The QMS is treated as a compliance shadow running parallel to, rather than inside the company’s actual strategic direction. To break this cycle, the focus must shift from preparing for an audit to governing through the QMS. The updated ISO 9001 expected soon, in September 2026 is a step in the correct direction.

There are many actions to maintain an effective QMS but as a brief summarized aid I would classify them as five pillars for maintaining an active QMS. To maintain continuous audit-readiness and drive real organizational value between surveillance visits, organizations can focus on these five foundational practices as a start. Pillar one is to have distributed internal audits wherein instead of compressing your internal audits into a high-stress audit month right before the registrar arrives, distribute the internal audits evenly across the 12-month cycle. Some organizations prefer a six-monthly cycle. These audits can be theme-based or process-based. Auditing can be planned so the organization rotates the audits by department or core process for example quarterly or monthly. Audit for effectiveness, not just compliance. Maybe a good idea to shift the internal audit question from are we following the clauses to: is this process achieving its intended operational outcome? Then finally involve operational leads by training cross-functional staff to audit peer departments. This breaks down silos and builds deep organizational awareness.

The second pillar would be the real-time CA (Corrective Action) and risk appreciation and where applicable OFI (opportunity for improvement). A healthy QMS welcomes non-conformities because they signal an opportunity to prevent business leakage. As Dr. IJ’s original quote goes “the only bad NC is the one you do not know about.” Address root causes immediately (ISO 9001 clause 9.2.2 e).  Don’t let open NCs sit dormant for months. An open non-conformity addressed promptly with robust root-cause analysis (RCA) is a mark of a mature management system. Also be sure to focus on systemic causes by avoiding assigning human error as the primary root cause. Look at process design, training, resource allocation, and tool suitability.

The third and an important pillar is conducting dynamic management reviews (ISO 9001 clause 9.3 as also in other standards in the harmonized structure). If your management Rrview meeting occurs only once a year right before the surveillance audit, it cannot effectively direct the system. It is best to integrate into existing executive business reviews by incorporating the QMS performance metrics (customer satisfaction, supplier evaluation, process yields, risk registers) into routine monthly or quarterly executive meetings. The focus should be on action and decision-making. Ensure top management uses QMS outputs to allocate resources and adjust strategic goals, keeping leadership engagement genuine and ongoing.

The fourth pillar I would say is the continuous document control & simplicity. Documented information should reflect how work is actually performed today. The “as-is” of the system is fundamental to continual improvement. Fictional systems are hard to improve without an honest baseline. It is important to keep it visual and accessible. Lean workflows, quick reference flowcharts, and short video work instructions are far easier to maintain and follow than 20-page text manuals. Also empower frontline feedback by creating a simple channel for operators and team members to flag outdated procedures or suggest process improvements in real time.

The fifth and last pillar is active risk & opportunity management. ISO 9001 clause 6.1 requires organizations to address risks and opportunities, but too many treat the risk register as a static document created during initial certification. The organization must review risks at process changes. The context of the organization (ISO 9001 clause 4.1 and 4.2) changes. Whenever a new customer requirement, equipment change, software deployment, or supply chain shift occurs, review and update the relevant process risk profile.

These five at the least and many such along the same lines, led by the leadership can ensure the management system remains relevant and a tool for continual improvement instead of becoming an expensive investment to keep auditors in business. This is all the more important as we look ahead and start preparing for expected changes with updated of ISO 9001:2026. As organizations maintain the current ISO 9001:2015 system, it is vital to keep an eye on the horizon. The International Organization for Standardization (ISO) is finalizing the next revision, ISO 9001:2026, scheduled for publication in September 2026. The good news? ISO 9001:2026 is an evolutionary refinement, not a revolutionary rewrite. The core harmonized structure and foundational requirements remain intact. However, the revision introduces key targeted enhancements that you can begin embedding into your interim maintenance routine today itself.

To that end the focus areas would be first the quality culture and ethics per ISO 9001:2026 clauses 5 & 7. Second group head if I may call it that, would be climate and context considerations per clauses 4.1 and the risk clarification and objectives as per clause 6.1.

Explicit focus on quality culture and ethical behavior (clauses 5.1 & 7.3) is a slight change in that the 2026 revision elevates Quality Culture and Ethical Behavior from implicit assumptions to explicit leadership and awareness expectations. Top management will be expected to demonstrate how shared organizational values, ethical standards, and communication foster quality. Maintenance action would require evaluation of how the organization’s corporate values, ethics policies, and employee recognition programs intersect with quality outcomes.

Integration of climate change considerations (Clause 4.1) came up as a note tweak for the 2015 version. Now it is being formally integrated with the early 2024 climate change amendment (ISO 9001:2015/Amd. 1:2024). The 2026 standard explicitly requires organizations to assess whether climate change factors impact their business context and customer satisfaction. Maintenance action would require that during routine context reviews (Clause 4.1), evaluate whether climate-related factors (e.g., supply chain disruptions, energy transition, regulatory shifts) affect operational resilience.

Clearer distinction of risk vs. opportunity (Clause 6.1) was needed. OFI was not fully amplified in the 2015 version of the standard. The revised ISO 9001:2026 clause 6.1 provides clearer structure to ensure organizations do not treat risk mitigation and opportunity pursuit as the same exercise. Looking at the maintenance action, the organizations will have to ensure their risk matrix clearly separates risk mitigation actions from strategic growth opportunities.

Let us see what details matter for the organization’s transition planning. We know the standard 3-Year transition window following the publication of the new standard in September 2026, wherein the certified organizations will have a standard 3-year transition period (until approximately September 2029) to update their QMS. There is no need to wait or pause the current ISO 9001:2015. The certifications remain valid throughout the transition. Maintaining a strong ISO 9001:2015 baseline today will make your transition seamless during regular surveillance cycles in 2027 or 2028.

A summary health checklist to cover the period between-audits will ensure your system stays vibrant and audit-ready month after month, measure your progress against a quick operational checklist with key indicators of success such as for internal audits: a focus on process efficiency and value and not just tick-boxes. CA and risk appreciation should look at RCA to ensure zero stale/ overdue action items. About the management review ensure decisions are recorded and resources allocated based on QMS data. For the process and risk review ensure the risk-register is updated with operational changes that may have occurred. And finally for 2026 standard’s alignment ensure that ethical, cultural and climate context factors are monitored.

In conclusion I thin an ISO 9001 Quality Management System should be the steering wheel of your operations, not an extra luggage rack strapped to the roof. When top management embeds QMS activities into the routine tempo of business decisions, surveillance audits cease to be nerve-wracking exams. Instead, they become valuable third-party health checks that validate a culture of continual improvement keeping your organization strong today and effortlessly prepared for the 2026 standard tomorrow.

—

About the Author:

Inderjit (IJ) Arora, Ph.D., is the Chairman of QMII. He serves as a team leader for consulting, advising, auditing, and training regarding management systems. He has conducted many courses for the United States Coast Guard and is a popular speaker at several universities and forums on management systems. Arora is a Master Mariner who holds a Ph.D., a master’s degree, an MBA, and has a 35-year record of achievement in the military, mercantile marine, and civilian industry.

Many organizations celebrate ISO 9001 certification, as also any other certification, as a major achievement. The certificate is framed, the scope is published, customers are informed, and the external audit is finally behind them. Yet a few months later, the uncomfortable question that arises before the leadership and the team asking, if we are ISO certified, why has nothing really changed?

The same problems keep recurring. Customer complaints are still handled reactively. Internal audits are still treated as a paperwork exercise. Corrective actions still close late. Processes still depend on individual heroics rather than robust systems. Management review still feels like an annual ritual rather than a business performance discussion. Employees still see ISO as “the quality department’s job.” This is, I think, not a failure of the standard but more often, it is a failure of implementation.

ISO 9001 was never intended to be a certificate on the wall. It is a management system standard designed to help an organization consistently meet customer, statutory, and regulatory requirements, while improving the effectiveness of its processes. If certification has not changed performance, behavior, decision-making, or customer outcomes, then the organization may have achieved conformity without achieving effectiveness. That distinction matters. A system can be documented, audited, and certified and yet still fail to deliver meaningful business value. The real question is not “are we certified?” The better question is, is our quality management system influencing how the organization is run?

QMII has been working on management systems and meeting client objectives since 1986. One thing is certain when a system is built for the auditors and not the business, it is almost worthless. One of the most common reasons ISO 9001 fails to deliver is that the system was designed around passing an audit rather than improving the organization.

This usually shows up in excessive procedures, generic policies, copied templates, and records created mainly to satisfy perceived audit expectations. The language of the system does not match the language of the business. Employees do not use the procedures because the procedures were not based on the “as-is” of the system. The system was template driven and its one and only aim was to get certified.

ISO 9001 does not require a parallel universe of paperwork. It expects the organization to determine the processes needed for the quality management system (clause 4.4.1 of ISO 9001), understand their sequence and interaction, define criteria and methods for effective operation and control, assign responsibilities, address risks and opportunities, and evaluate performance.

If your QMS is a collection of documents rather than a description of how the business creates and protects value, it will not deliver. A useful system should answer practical questions on effectiveness of the system and lead to continual improvement.

ISO 9001 Clause 5.1 requires accountability from the leadership. If the leadership is running the system using only clause 5.3 of ISO 9001 by delegation instead of owning it is doomed to failure. ISO 9001:2015 deliberately strengthened the role of top management. The standard moved away from the idea that quality can be delegated to a “management representative” and placed clear expectations on leadership. Top management must take accountability for the effectiveness of the QMS, ensure that the quality policy and objectives are compatible with the organization’s context and strategic direction, integrate QMS requirements into business processes, promote the process approach and risk-based thinking, provide resources, and support continual improvement. In practical terms, leadership must do more than attend the opening and closing

Employees are told quality matters, but production pressure overrides process controls. Corrective actions are assigned but not resourced. Customer complaints are discussed only after escalation. Internal audit findings are treated as irritations rather than opportunities to improve the system. A QMS delivers only when leadership uses it to make decisions. Certification may be achieved through documentation. Performance improvement requires leadership behavior.

The next thought that comes to mind is about the organization’s misunderstood “context”. A strong QMS begins with a clear understanding of the organization and its environment. Clause 4.1 understanding the organization and its context requires the organization to determine external and internal issues relevant to its purpose, strategic direction, and ability to achieve the intended results of the QMS. Clause 4.2. Interested parties requires the organization to understand relevant interested parties and their relevant requirements. In weak systems, this exercise often becomes a static SWOT analysis prepared once and filed away. It may list obvious items such as “competition,” “regulations,” “customers,” and “employees,” but it does not influence risk assessment, objectives, process controls, supplier management, resource planning, or improvement priorities. It must be remembered context is not a poster. It is the operating reality in which the QMS must function. For example, if the organization faces high staff turnover, then competence, training, knowledge retention, and process standardization become critical. If customer requirements are becoming more complex, then contract review, design control, change management, and communication need strengthening. If supply chain reliability is a recurring issue, then supplier evaluation, contingency planning, and incoming verification become important. If climate-related factors can affect operations, supply, infrastructure, or customer expectations. The update to standard expected in September reinforces that these issues should be considered where relevant. A QMS that ignores context becomes generic. A generic system may pass an audit, but it rarely improves performance.

Quality objectives (clause 6.2) are an important aspect of the QMS and yet are often not connected to process performance. Many certified organizations have quality objectives, but the objectives are often too broad, too safe, or too disconnected from process performance. Examples include “improve customer satisfaction,” “reduce complaints,” or “deliver quality products.” These are good intentions, but they are not always effective objectives. Clause 6.2  m expects objectives to be measurable, monitored, communicated, updated as appropriate, and consistent with the quality policy. The organization must also plan what will be done, what resources are required, who is responsible, when it will be completed, and how results will be evaluated. If objectives do not drive action, they are not management tools. They are slogans. Effective objectives should connect to the organization’s key processes and risks. A certified organization with weak objectives will often remain exactly where it was before certification. The certificate confirms that a system exists. Objectives determine whether the system is moving.

Connected closely to context is the risk-based thinking, which is often treated as a form, not a way of managing. Risk-based thinking is one of the central concepts in ISO 9001:2015. It is embedded throughout the standard, especially in Clause 6.1. Actions to address risks and opportunities. The organization must determine risks and opportunities that need to be addressed to give assurance the QMS can achieve intended results, enhance desirable effects, prevent or reduce undesired effects, and achieve improvement. In many organizations, risk-based thinking becomes a spreadsheet exercise. Risks are listed, scored, color-coded, and reviewed occasionally. But the risk register does not meaningfully affect process controls, training, supplier selection, inspection levels, maintenance, contingency planning, or management review. It is therefore not surprising that nothing changes. Risk-based thinking should influence how work is designed and controlled. If a process has high risk, it may need clearer criteria, competent personnel, verification steps, mistake-proofing, supplier controls, documented information, monitoring, or escalation triggers. If an opportunity exists, the organization should consider how to capture it, whether through technology, training, simplification, standardization, or improved customer communication.

When process owners do not really own their processes, it is an issue. ISO 9001 depends on the process approach. Processes must be defined, controlled, monitored, measured, and improved. Yet in many organizations, process ownership is unclear. A procedure may name an owner, but that person may not monitor process performance, review nonconformities, evaluate risks, train personnel, approve changes, or drive improvements. The quality department ends up chasing everyone for records, actions, and audit responses. This creates the impression that ISO belongs to quality rather than to the business. Clause 4.4 requires the organization to determine responsibilities and authorities for processes. Clause 5.3 requires organizational roles, responsibilities and authorities requires top management to ensure relevant roles are assigned, communicated, and understood. Process ownership must be real. A process owner should know, what the process is intended to achieve. What inputs and outputs matter. What risks can prevent success. What controls are required. What indicators show whether the process is effective. What nonconformities have occurred. What improvements are underway. What resources or competence are needed.  If process owners cannot answer these questions, the system is unlikely to deliver. The QMS may exist on paper, but operational accountability is missing.

Effective auditing is an essential part of decision making by leadership. If Internal audits check conformity but not effectiveness, then the system weakens. Internal audits are one of the most underused tools in ISO 9001. In weak systems, internal audits simply confirm that procedures exist and records are available. Auditors ask, “Do you have a procedure?” and “Can you show me the record?” This may establish conformity, but it does not necessarily test whether the process is effective. Clause 9.2 on internal audit requires the organization to conduct audits at planned intervals to provide information on whether the QMS conforms to the organization’s own requirements and ISO 9001, and whether it is effectively implemented and maintained. The word “effectively” is essential. A good internal audit should test whether the process achieves intended results. For example, an audit of purchasing should not only verify approved supplier lists and purchase orders. It should examine whether supplier controls are reducing risk, whether supplier performance is monitored, whether poor-performing suppliers are addressed, and whether purchased products and services consistently meet requirements.

An audit of corrective action should not only confirm that forms are completed. It should test whether root causes are credible, actions are appropriate, recurrence has been prevented, and lessons have been shared. If internal audits do not challenge process effectiveness, the certification audit may become the first serious test of the system. By then, opportunities for improvement have already been missed.

Corrective action must not stop at containment. Many organizations respond quickly to problems but fail to learn from them. They replace the defective item, reissue the document, retrain the employee, apologize to the customer, and close the action. The same issue then returns under a slightly different name. This is a classic sign that corrective action is not effective.

Clause 10.2 on nonconformity and corrective action requires the organization to react to nonconformities, deal with consequences, evaluate the need for action to eliminate causes, implement action, review effectiveness, update risks and opportunities where necessary, and make changes to the QMS if needed. The purpose is not to complete a form. The purpose is to prevent recurrence. Weak corrective action systems focus on symptoms. Strong systems investigate causes. They ask why the process allowed the issue to occur, why it was not detected earlier, whether the issue could exist elsewhere, whether controls are adequate, and whether the solution worked. A certified system that does not learn from failure will not improve. It will simply document recurrence.

Management review is often treated as a ceremonial meeting to satisfy ISO requirements. Slides are prepared, data is presented, minutes are recorded, and actions are listed. But the discussion may not influence strategy, resources, priorities, or change. Clause 9.3 on management review requires top management to review the QMS at planned intervals to ensure its continuing suitability, adequacy, effectiveness, and alignment with the strategic direction of the organization. Inputs include changes in context, customer satisfaction, process performance, nonconformities, audit results, supplier performance, adequacy of resources, effectiveness of actions taken to address risks and opportunities, and opportunities for improvement. If management review does not result in decisions and actions related to improvement, resources, process changes, risks, opportunities, and customer satisfaction, it is not fulfilling its purpose. A management review that does not change anything is a warning sign that the QMS is not connected to leadership control.

Continual improvement is expected by leadership, but the team dos does not engineer its success. Organizations often say they are committed to continual improvement, but they do not create the conditions for improvement to happen. Improvement depends on data, leadership, competence, time, ownership, and follow-through. Clause 10.3, continual improvement requires the organization to continually improve the suitability, adequacy, and effectiveness of the QMS. This connects directly to Clause 9.1 monitoring, measurement, analysis and evaluation, which requires the organization to determine what needs to be monitored and measured, the methods needed, when monitoring and measurement will be performed, and when results will be analyzed and evaluated. In simple terms: you cannot improve what you do not understand. If performance data is weak, late, inaccurate, or ignored, improvement becomes guesswork. If trends are not analyzed, the organization remains reactive. If customer feedback is collected but not acted upon, dissatisfaction continues. If process indicators are selected because they are easy to measure rather than because they reveal effectiveness, management will have poor visibility.

Continual improvement must be built into the management rhythm. It should be visible in objectives, audits, corrective actions, management review, process reviews, customer feedback, risk reviews, and operational meetings. Improvement is not an annual ISO activity. It is the habit of managing better.

So why has nothing changed? If ISO certification has not changed your organization, the likely reason is that the QMS has not been integrated into how the organization is led, planned, operated, evaluated, and improved.

The certificate may confirm that requirements were met at a point in time. But the value of ISO 9001 comes from daily use: leaders using the system to make decisions, process owners managing performance, employees following practical controls, risks being addressed before they become failures, audits testing effectiveness, corrective actions eliminating causes, and management reviews driving improvement.

ISO 9001 is not meant to sit beside the business. It is meant to help run the business. The remedy is not necessarily more documentation. In many cases, it is better integration, better ownership, better questions, and better use of existing information. Start by asking each process owner one question: How does your process prove that it is effective? Then ask top management, what decisions have we made because of the QMS? If those questions are difficult to answer, the organization may be certified but the system is not yet delivering.

The good news is that ISO 9001 already contains the architecture for improvement. Clauses 4 through 10 are not separate audit compartments; they are connected parts of a management system. Context informs risks and opportunities. Risks influence planning and controls. Controls shape operations. Operations generate performance data. Data feeds internal audit and management review. Nonconformities drive corrective action. Corrective action and analysis drive improvement.

When that cycle works, ISO certification becomes more than a market access tool. It becomes a disciplined way to manage performance, satisfy customers, reduce waste, strengthen accountability, and improve resilience. The certificate is only the beginning. The real test is whether the system changes decisions, behavior, and results.

__

About the Author:

This article was written by IJ, Principal Consultant at QMII. With extensive experience in ISO standards, auditing, and organizational transformation, IJ has guided global organizations in strengthening their management systems. His approach focuses on aligning ISO implementation with strategic business objectives to drive long-term performance improvement.

A surveillance audit is an essential component of maintaining certification to management system standards such as ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22301 and many more. Unlike an initial certification audit, which evaluates the entire management system for compliance with a standard, a surveillance audit is conducted periodically, typically once or twice a year, to verify that the organization is continuing to comply with the requirements of the standard and that the management system remains effective and continually improves over time.

Preparing for a surveillance audit requires a structured and proactive approach. Organizations that maintain their management systems throughout the year generally find surveillance audits less stressful and more productive. Effective preparation not only helps ensure successful audit outcomes but also strengthens organizational performance, enhances customer confidence, and promotes a culture of continual improvement.

Purpose and Scope of the Audit

The first step in preparing for a surveillance audit is understanding its purpose and scope. Surveillance audits are designed to confirm that the certified management system is still functioning effectively and that the organization continues to meet the requirements of the applicable standard. The certification body usually provides an audit plan in advance, outlining the processes, departments, and clauses that will be reviewed and participation of the process owner.

Organizations should carefully examine the audit agenda and identify the areas that will receive special attention. Auditors often focus on changes made since the previous audit, corrective actions taken in response to past findings, internal audit results, management reviews, and key performance indicators. Understanding the audit scope allows management to allocate resources effectively and ensure that relevant personnel and records are available during the audit.

Review of Previous Findings

One of the most important preparation activities is reviewing the findings from previous audits, be it certification, surveillance, or internal or even the non-conformities raised internally without the audits. Auditors will often revisit past nonconformities and observations to verify whether corrective actions have been implemented and if the corrective action are effective or not. If there are any trends in the occurrence or recurrence of these non-conformities.

Organizations should gather evidence demonstrating that all corrective actions have been completed and that the root causes of identified issues have been addressed. This may include updated procedures, training records, monitoring reports, or revised controls. Any unresolved findings should be prioritized before the surveillance audit to avoid recurring nonconformities, which may indicate weaknesses in the management system.

Conduct Internal Audits

Internal audits are a valuable tool for assessing readiness before a surveillance audit. They provide an opportunity to identify gaps, weaknesses, and nonconformities before the external audit. Organizations should ensure that internal audits are conducted according to the planned audit schedule and cover all critical processes.

A well-executed internal audit should evaluate:

• Compliance with management system requirements.
• Adherence to organizational procedures.
• Effectiveness of process controls.
• Achievement of objectives and targets.
• Availability and accuracy of records.

Any findings from internal audits should be documented, and addressed through corrective action processes. Evidence of these activities demonstrates the organization’s commitment to continual improvement and effective system management.

Ensure Documentation Is Current and Up-to-Date

Documentation forms the backbone of any management system. During a surveillance audit, auditors review documented information to verify compliance and consistency. Therefore, organizations should perform a thorough review of all relevant documents and records before the audit.

Key documents that should be examined include:

• Policies and objectives.
• Process maps and procedures.
• Work instructions.
• Risk assessments.
• Training and competency records.
• Equipment maintenance records.
• Calibration certificates.
• Customer complaints and feedback records.
• Corrective action reports.
• Internal audit reports.
• Management review records.

Organizations should also verify that document control procedures are functioning effectively. Obsolete documents should be removed from circulation, and only approved versions should be available to employees.

Verify Employee Awareness and Competence

Employees play a critical role during surveillance audits because auditors frequently interview personnel to assess their understanding of processes and responsibilities. Staff members should be familiar with relevant policies, procedures, objectives, and their role within the management system.

Organizations can prepare employees through awareness sessions, refresher training, and communication meetings. Employees should understand:

• Their job responsibilities.
• Relevant procedures and work instructions.
• Organizational objectives.
• Quality, environmental, safety, or security policies.
• How they contribute to management system performance.

Rather than memorizing answers, employees should be encouraged to explain their actual work practices honestly and confidently. Authentic responses provide auditors with evidence that the management system is genuinely implemented rather than existing only on paper.

Review Organizational Performance

Surveillance audits often focus on performance measurement and continual improvement. Organizations should review their key performance indicators (KPIs), objectives, and targets to ensure that performance is being monitored and evaluated effectively.

Examples of performance measures may include:

• Customer satisfaction levels.
• Product or service quality indicators.
• Environmental performance metrics.
• Occupational health and safety statistics.
• Information security incident rates.
• Process efficiency measurements.

Management should be prepared to demonstrate how data is collected, analyzed, and used for decision-making. Auditors may ask for evidence showing that performance trends are reviewed regularly and that actions are taken when targets are not achieved.

Conduct a Comprehensive Management Review

Management review is a fundamental requirement of most ISO standards. Before the surveillance audit, organizations should ensure that management reviews have been conducted according to schedule and that all required topics have been addressed.

A management review should evaluate:

• Internal and external audit results.
• Customer feedback and complaints.
• Process performance and effectiveness.
• Status of corrective actions.
• Resource adequacy.
• Risks and opportunities.
• Achievement of objectives.
• Opportunities for improvement.

The outputs of the management review should include decisions and actions aimed at enhancing system effectiveness. Auditors will often examine management review records to determine the level of leadership involvement and commitment.

Assess Risks and Opportunities

Modern management system standards emphasize risk-based thinking. Organizations should review their risk assessments and ensure that identified risks and opportunities remain current and relevant.

Preparation activities should include:

• Reviewing risk registers.
• Evaluating mitigation measures.
• Assessing emerging risks.
• Monitoring control effectiveness.
• Updating risk assessments where necessary.

Auditors may seek evidence that risk considerations are integrated into planning, operations, and decision-making processes. Demonstrating proactive risk management strengthens confidence in the management system.

Evaluate Corrective Action Processes

Corrective action management is a key area of interest during surveillance audits. Auditors want to see that problems are systematically identified, investigated, and resolved.

Organizations should review all corrective actions initiated since the last audit and verify that:

• Root causes were identified.
• Appropriate actions were implemented.
• Effectiveness was verified.
• Results were documented.

A robust corrective action process demonstrates a commitment to continual improvement and helps prevent recurring issues.

Prepare Audit Logistics and Resources

Effective logistical preparation contributes significantly to a smooth audit experience. Organizations should designate an audit coordinator responsible for facilitating communication between auditors and internal personnel.

Preparations may include:

• Confirming the audit schedule.
• Arranging meeting rooms.
• Ensuring access to records and documents.
• Identifying process owners and key contacts.
• Providing necessary equipment and internet access.
• Organizing facility tours if required.

Well-organized logistics help create a professional impression and allow auditors to focus on evaluating the management system rather than dealing with administrative delays.

Perform a Final Readiness Check

Before the surveillance audit begins, organizations should conduct a final readiness assessment or a mock audit. This exercise helps identify any remaining weaknesses and allows employees to practice responding to auditor questions.

The readiness review should verify:

• Availability of required records.
• Completion of corrective actions.
• Employee awareness.
• Compliance with procedures.
• Effectiveness of management system processes.

Addressing issues discovered during this final review can significantly improve audit outcomes.

Conclusion

Preparing for a surveillance audit requires commitment rather than last-minute efforts. Organizations that regularly monitor performance, conduct internal audits, maintain accurate documentation, manage risks, and implement corrective actions are generally well positioned for successful surveillance audits. By understanding the audit scope, engaging employees, reviewing management system effectiveness, and ensuring that evidence of compliance is readily available, organizations can demonstrate ongoing conformity to standards and their dedication to continual improvement. Ultimately, effective preparation transforms the surveillance audit from a compliance exercise into a valuable opportunity to strengthen organizational performance and sustain long-term certification success.

__

About the Author:

Anjalika Singh is the President of QMII (Quality Management International, Inc.), a global management systems consulting firm headquartered in Ashburn, Virginia. Over the course of her career, she has developed a sharp intuitive sense combined with strong operational and training management skills, making her a key asset in QMII’s consulting and training initiatives. Her work focuses on practical lead-auditor training and helping organizations adopt ISO and industry-specific management systems in a way that delivers real business value. Anjalika also serves as President and CEO of iCertifications, LLC, where she leads efforts to make accredited ISO certification services accessible to small and medium-sized businesses.

Most corrective actions fail not from a lack of process, but because organizations treat nonconformities as paperwork exercises rather than real problem-solving opportunities. This article explains why superficial corrective actions persist, what skilled auditors actually look for, and how to build a CAPA process that drives lasting improvement under ISO 9001 Clause 10.2.

Corrective actions are intended to eliminate the causes of problems and prevent them from happening again. In theory, they are one of the most powerful tools organizations have for improving quality, safety, and operational performance. In practice, however, many corrective actions fail to deliver lasting results. Problems recur, audit findings repeat, and organizations find themselves addressing the same issues again and again.

The failure of corrective actions rarely occurs because organizations lack procedures or tools. Instead, it typically happens because corrective actions are treated as quick fixes rather than structured problem-solving efforts. Under ISO 9001 Clause 10.2, organizations are required to implement a robust corrective and preventive action (CAPA) process — yet skilled auditors consistently find that requirement met only on paper. Instead of accepting superficial solutions, they look for deeper evidence that the organization has truly identified and eliminated the root causes of the problem.

Understanding why corrective actions fail, and what auditors expect instead, helps organizations build stronger quality management systems (QMS) that support continuous improvement rather than temporary compliance.

The Most Common Reason Corrective Actions Fail: Treating Symptoms Instead of Root Causes

The primary reason corrective actions fail is that organizations address symptoms rather than root causes. When a nonconformity occurs, there is often pressure to close the audit finding quickly. Managers want the finding closed, production teams want to resume normal operations, and documentation must be updated before the next audit cycle.

In this environment, corrective actions often take the form of simple responses such as:

• Retraining employees
• Updating procedures
• Reminding staff to follow the process
• Increasing inspections

While these actions may appear reasonable, they rarely eliminate the underlying reason the problem occurred. For example, if a procedure was unclear, simply retraining employees will not solve the problem unless the procedure itself is corrected. If production errors occur because equipment calibration is inconsistent, reminding operators to “be more careful” will not prevent recurrence.

Skilled auditors recognize this pattern immediately. When they see corrective actions focused only on retraining or communication, they often suspect that the real cause has not been identified.

Pressure to Close Findings Quickly

Another major contributor to failed corrective actions is the organizational pressure to close findings quickly. Many organizations measure audit performance by how rapidly nonconformance findings are closed rather than by how effectively problems are solved.

This approach encourages superficial fixes. Teams focus on documentation updates or minor adjustments that satisfy the audit checklist rather than investigating the deeper system issues that caused the problem.

For example, if a nonconformance occurred because multiple departments misunderstood a process requirement, a quick corrective action might involve updating a single document. However, the real issue may be poor cross-department communication, unclear ownership, or inadequate training structures.

Auditors who are experienced in management systems understand that meaningful corrective actions often require time. They expect to see structured analysis rather than rushed responses.

Lack of Root Cause Analysis

A failed corrective action is often the result of inadequate root cause analysis (RCA). Many organizations claim to perform root cause analysis as part of their CAPA process, but in reality, they stop at the first obvious explanation rather than tracing the nonconformity back to its systemic origin.

True root cause analysis requires systematic investigation using methods such as:

• The 5 Whys technique
• Fishbone (Ishikawa) diagrams
• Failure mode and effects analysis (FMEA)
• Process mapping

These tools help teams move beyond surface explanations and identify the systemic factors that allowed the problem to occur.

For example, suppose an audit finding shows that a required inspection step was skipped. A superficial explanation might be “operator forgot to perform inspection.” However, deeper analysis may reveal that:

• The inspection checklist is confusing
• Production schedules encourage skipping steps
• The inspection step is not integrated into the workflow
• Training records are incomplete

Without identifying these deeper factors, the corrective action will not prevent recurrence.

Corrective Actions That Focus Only on Individuals

Another common mistake is blaming individuals rather than examining system weaknesses. When corrective actions focus on employee errors, they often result in retraining or disciplinary actions.

While human error can certainly contribute to problems, effective corrective actions focus on system design rather than individual mistakes. Well-designed systems reduce the likelihood of errors through clear procedures, effective controls, and supportive tools.

Skilled auditors pay close attention to whether corrective actions address systemic issues. If a corrective action simply states that employees will be retrained, auditors may question whether the organization has examined factors such as workload, process design, equipment reliability, or management oversight.

Weak Verification of Effectiveness

Even when corrective actions appear reasonable, they may still fail if organizations do not verify their effectiveness. Many corrective actions are closed once the planned activity is completed, rather than after confirming that the problem has truly been resolved.

For example, if a new procedure is implemented to prevent a quality defect, the organization should monitor relevant performance indicators to ensure that the defect does not recur. Without this follow-up verification, the corrective action may exist only on paper.

Skilled auditors look for evidence that corrective actions have been validated. This may include:

• Monitoring data showing improvement
• Follow-up internal audits
• Performance metrics before and after the change
• Documented reviews confirming sustained results

Verification ensures that corrective actions lead to real improvement rather than temporary compliance.

What Skilled Auditors Look for Instead

Experienced auditors approach corrective actions differently from organizations focused only on closing findings. Instead of looking for quick fixes, they evaluate whether the organization has truly learned from the problem.

Several key elements signal that a corrective action is meaningful and effective.

Evidence of Structured Root Cause Analysis

First, auditors expect to see structured analysis that identifies the underlying causes of the issue. This analysis should demonstrate logical reasoning rather than assumptions.

For example, a strong corrective action (CAPA) record might include documented use of the 5 Whys method or a fishbone (Ishikawa) diagram that explores potential causes related to people, processes, equipment, materials, and environment.

The analysis should clearly explain why the problem occurred and why existing controls failed to prevent it.

System-Level Improvements

Second, skilled auditors look for corrective actions that improve the system rather than addressing isolated incidents. Effective actions often involve changes such as:

• Improving process controls
• Clarifying responsibilities
• Redesigning workflows
• Enhancing monitoring mechanisms
• Updating training programs based on identified gaps

These improvements strengthen the system so that similar issues are less likely to occur in the future.

Risk-Based Thinking

Modern management standards, including ISO 9001:2015, emphasize risk-based thinking. Skilled auditors evaluate whether corrective actions consider the broader risks associated with the problem and whether the CAPA process includes appropriate preventive action to stop similar nonconformities from occurring elsewhere.

For example, if a documentation nonconformity occurred in one department, auditors may ask whether similar errors could exist elsewhere. A strong corrective action and preventive action (CAPA) process will include evaluating related processes and implementing preventive measures where necessary.

This broader perspective helps organizations move from reactive problem solving to proactive risk management.

Clear Ownership and Implementation Plans

Another indicator of effective corrective actions is clear accountability. Skilled auditors expect corrective action plans to identify responsible individuals, defined timelines, and measurable outcomes.

Without clear ownership, corrective actions can stall or be implemented inconsistently. A well-structured plan ensures that responsibilities are understood and progress can be tracked.

Verification of Long-Term Effectiveness

Finally, experienced auditors look for evidence that corrective actions have been verified over time. Organizations should demonstrate that implemented changes have been monitored and that the original problem has not reappeared.

This verification step transforms corrective actions from administrative tasks into meaningful learning opportunities.

Building a Culture of Real Improvement

Ultimately, the success of corrective actions depends on organizational culture. When organizations treat audits as opportunities for improvement rather than compliance exercises, corrective actions become powerful tools for strengthening processes.

Leaders play a crucial role in supporting this mindset. By encouraging thorough analysis, allowing adequate time for problem solving, and focusing on systemic improvement, organizations can avoid the cycle of repeated findings and ineffective fixes.

Skilled auditors are not looking for perfection. Instead, they look for evidence that the organization is genuinely committed to understanding its processes, learning from mistakes, and continuously improving its systems.

Conclusion

Corrective actions fail when they are rushed, superficial, or focused only on symptoms. Quick fixes such as retraining or procedural reminders may satisfy short-term compliance requirements, but they rarely eliminate the underlying causes of problems.

Skilled auditors recognize these limitations and look beyond simple responses. They expect structured root cause analysis, system-level improvements, risk-based thinking, clear accountability, and verification of long-term effectiveness.

Organizations that embrace these principles transform corrective actions from routine administrative tasks into meaningful drivers of improvement. Instead of repeatedly addressing the same issues, they build stronger systems that prevent problems from occurring in the first place.

In this way, corrective actions fulfill their true purpose – not just closing audit findings and satisfying ISO 9001 Clause 10.2, but enabling continuous improvement and sustainable organizational performance.

—

About the Author:

Anjalika Singh is the President of QMII (Quality Management International, Inc.), a global management systems consulting firm headquartered in Ashburn, Virginia. Over the course of her career, she has developed a sharp intuitive sense combined with strong operational and training management skills, making her a key asset in QMII’s consulting and training initiatives. Her work focuses on practical lead-auditor training and helping organizations adopt ISO and industry-specific management systems in a way that delivers real business value. Anjalika also serves as President and CEO of iCertifications, LLC, where she leads efforts to make accredited ISO certification services accessible to small and medium-sized businesses.

ISO 9001 certification cost in the US typically ranges from $6,000 to over $50,000 depending on company size, complexity, and readiness. This article breaks down every expense – from QMS documentation and internal audits to accredited certification body fees – so you can budget with confidence and decide if certification is the right investment for your organization.

The International Standards Organization (ISO) provides that the primary purpose of ISO 9001 is to ensure that the products and services you use daily are safe, reliable and of high quality. ISO 9001 emphasizes risk-based thinking, leadership engagement, optimization of processes, and the Plan-Do-Act-(PDCA) cycle. This standard assists organizations in enhancing efficiency by promoting cost reduction and improving customer satisfaction. Companies achieve this by building efficiency and reduced costs, documenting and streamlining processes, and continually improving across their quality management system (QMS).

It is the only standard in the ISO 9000 family to which organizations can be certified. According to ISO 9001 lead auditing certification is the provision by an independent body of written assurance that the product, service or system in question meets specific requirements. Certification offers objective evidence to clients that an organization confirms internationally recognized quality standards. Achieving ISO 9001:2015 certification requires demonstration of a compliant quality management system (QMS), typically verified through external audits conducted by an accredited certification body or registrar.

What Is the Real ISO 9001 Certification Cost?

If you have been contemplating obtaining ISO 9001 certification and walking through quotes for certification, more than likely you might have been shockingly surprised with the figure. For many business owners, the expense often feels more substantial than a standard certification fee and can resemble a significant capital investment. But why is it so expensive? Is it just bureaucratic red-tape, or is there a concrete justification for the price tag? In this post, we will reveal the actual costs involved, provide detail breakdown of where the funds are allocated, and assist you in determining whether ISO 9001 certification represents a strategic investment or unnecessary expense.

It is essential to recognize that the cost of ISO 9001 certification is variable. Several factors including company size, operational complexity, and effective number of personnel determine your estimated cost. Because every organization is different in size, company complexity, industry, and risk level, the price varies widely. ISO 9001 certification cost generally ranges from $6,000 to over $50,000 depending on factors including organizational size, consultancy fees, audit duration, and the complexity/readiness of QMS documentation. IAF-accredited registrar fees, gap analysis, and surveillance audits all contribute to this range. Most organizations recover their investment within one to three years through increased new business opportunities, reduced inefficiencies, and enhanced processes. contracts and improved efficiency.

The Cost breakdown

To understand the actual ISO 9001 certification cost, you must look at the five distinct buckets where your money is spent. These fees include the application, the preparation audit, certification audit, the issuance of Certification itself, surveillance and maintenance in addition to the invisible cost which I am about to walk you through. These expenses can be categorized into preparation, consulting, external audit, and ongoing surveillance

Preparation, Documentation Review and Internal Audit

Preparation is one of the most expensive phases in the ISO 9001 certification process. This is the stage where you prepare, review and update the QMS documentation that is needed for compliance, often beginning with a gap analysis to identify where your current system falls short of ISO 9001:2015 requirements. Here, you will have to allocate a significant amount of money, time, and resources. The documentation is followed by an internal audit. You can use your internal auditors or hire a third-party consultant to conduct the internal audit. Of course, that depends on the level of complexity of your internal processes and operations, the size of your organization or the availability of employees within your organization.

Certification Audit, Issuance of Certificate and Surveillance and Maintenance

The most visible fee is the certification fee that follows is the certification audit fee. You pay a third-party, IAF-accredited certification body (registrar) to conduct the Stage 1 documentation review and Stage 2 on-site audit of your system. In addition to the professional fee and certification fee for the third-party certification body, depending on the geographic location, there will be additional fees relating to travel and accommodation. Keep in mind though companies may have moved to remote auditing depending on the size and complexity of the organization that can actually save thousands on expenses associated with hotel and accommodation.

Small Vs. Large Business The actual number of the audit days varies by the size of the organization. The following table shows an estimate of the cost and duration of audit days for small and large organizations.

Type of Business	Average No. of Audit days	Remark	Total estimated investment
Small Business (1-25 employees)	Typically requires 2-4 days of auditing	Systems are simpler and documentation is less complicated	$6K-$15K
Large Business (250+ employees)/ various locations	May require 10+ days of auditing	Complexity increases exponentially because the auditor must verify that quality is consistent across different departments and geographic locations.	Total estimated investment $30k-$100k

The hidden costs most businesses miss

Before proceeding with initiating the certification process, you should also consider the hidden expenses beyond the initial quote. This includes costs associated with internal labor time which is spent on QMS documentation and training and necessary process improvements. Corrective action and rework to address nonconformities are another hidden expense often missed to be calculated among the certification fees. It also includes professional fees, and necessary infrastructure improvement for compliance with the standard. Organizations may also spend a significant amount of time and effort in addressing nonconformities discovered during the preparation audit. Annual surveillance audits add to the ongoing financial commitment. That is why the total ISO 9001 certification cost goes beyond the invoice from the auditor. Securing ISO 9001 certification is indeed a multi-year financial obligation rather than a one-time purchase.

How to reduce your certification costs

You can reduce substantial amount of expenses associated with internal audits fees incurred in hiring a consultant to do your internal audits. All you need to do is train your team members.  You can also save costs by shopping around different consultants as the daily rates can vary by hundreds of dollars. There is, however, a benefit from having an external impartial consultant assess the effectiveness of your system. Given that they see many different systems they can also add value through identifying opportunities for improvement.

Is ISO 9001 worth the investment?

ISO 9001 certification is worth the investment for three general reasons. First and foremost, ISO 9001 Certification is the gateway to many government contracts and business partnership/ collaboration opportunities with large tier 1 businesses as they require proof of compliance in the form of certification to even consider your business in such bids. Secondly, certification enhances efficiency as a well implemented QMS — built on the PDCA cycle and continual improvement principles — results in improved processes, reduced risks and lasting improvement across your organization thereby leading to on average 20 days of operational savings. The other important gain is the ability to mitigate risks as ISO 9001 is designed to divert organizations’ focus on potential business risks. In conclustion, the ISO 9001 certification cost is much less expensive than product recalls or uncalculated business investments or lawsuits.

ISO 9001 certification is expensive on paper but in reality, certification means gains in market access, reduced risks and improved operations and efficient processes leading to customer satisfaction. Whether you are contemplating certification or aspire to transition your certified organization to the upcoming revision of ISO 9001, we at QMII can partner with you in walking every step of the process.

FAQ:

How much does ISO 9001 Certification preparation cost?

ISO Certification costs vary by the size of your organization, the complexity of your processes and the readiness of your system. The best way to find out is to request a quote from www.qmii.com or call 888.357.9001 

How long does the certification process take?

Depending on the level of readiness of your QMS, the size and complexity of processes in your organization and other additional factors, the certification takes anywhere from 3 to 12 months, with an average of 6-9 months.

How frequently does the certification need to be renewed?

ISO certification requires renewal every three years along with mandatory annual surveillance audits conducted to ensure ongoing compliance.

Does your organization need certification?

ISO certification, though voluntary, is steppingstone for any organization seeking to enhance customer satisfaction through improved operational efficiency, mitigate risks, gain market access, and aspire to meet contractual obligations or international. If you would like to explore how your organization can benefit from ISO- 9001 certification we can schedule a free consultation for you at www.qmii.com or dial 888. 357. 9001.

—

About the Author:

Liyuwork Shiferaw (Liyu) is a Compliance Officer with QMII with expertise in International Maritime Law and regulatory systems. She is a former Director of Maritime Administration in Ethiopia and has supported international maritime administration improvements, including IMO technical missions in Africa. Her experience spans safety, labor, environmental protection, audits and management systems. She holds a master’s in international Maritime Law and participant of various  international fellowships.

Quick Summary

A Corrective Action Request (CAR) is basically a structured way to deal with a problem that keeps coming back. Instead of just fixing it and moving on, a CAR helps you figure out why it happened and put the right measures in place so it doesn’t happen again – following ISO 9001 Clause 10.2.

Organizations must understand that CARs (Corrective Action Requests) and NCs (nonconformities) matter more than they often think. In any organization -whether manufacturing, service, healthcare, consulting, or any other discipline – things go wrong. A customer complaint, a missed requirement, a failed audit finding. The instinctive response is often to fix the issue quickly and move on. But quick fixes don’t prevent recurrence. That’s where a Corrective Action Request (CAR) comes in. A CAR is not just about fixing a problem; it’s about understanding why it happened and ensuring it doesn’t happen again. This guide breaks down CARs in a practical, usable way so you can apply them effectively – not just document them.

What Is a Corrective Action Request (CAR)?

A CAR is a formal request to investigate a problem (nonconformity), identify its root cause, and implement actions to prevent recurrence. Once those actions are in place, verifying that the solution actually works is equally essential. At its core, a CAR answers three critical questions:

• What went wrong?
• Why did it go wrong?
• What will prevent it from happening again?

A CAR is triggered when an issue is systemic, recurring, or significant enough that it cannot be ignored.

When Should You Raise a CAR? Understanding ISO 9001 Clause 10.2

Not every problem needs a CAR. Overusing CARs creates bureaucracy; underusing them allows problems to repeat. According to ISO 9001 Clause 10.2, which governs nonconformity and corrective action, a CAR is appropriate when:

• There is a customer complaint
• An audit finding identifies a gap
• A process fails to meet stated requirements
• A problem is recurring
• The risk or impact is high

A simple rule of thumb: if fixing the issue alone doesn’t give you confidence it won’t happen again, you need a CAR. ISO 9001 Clause 10.2.1(b) also makes clear that not all nonconformities require a full root cause analysis (RCA). Sometimes the NC is a straightforward failure to implement — not requiring an RCA. Knowing this distinction is important.

CAR vs. Correction: What Is the Difference?

This is where many organizations go wrong.
“Correction” means fixing the immediate problem – for example, replacing a defective part.
A Corrective Action Request (CAR) means eliminating the root cause – for example, fixing the process that allowed defective parts to be produced in the first place.
A CAR always goes beyond the symptom. It targets the system, not just the outcome.

The CAR Process: Step-by-Step

Step 1: Identify and Define the Problem
Start with a clear, factual description:

• What happened?
• Where and when did it occur?
• What requirement was not met?

Those involved often carry biases. Experience – while valuable – can make individuals predisposed to certain conclusions. Avoid opinions. Stick to evidence.

Weak statement: “Process failed due to negligence.”
Strong statement: “On the shop floor, the inspection step was skipped in 3 out of 10 sampled cases on March 12.”

Clarity at this stage determines the quality of everything that follows.

Step 2: Containment – Immediate Action to Stabilize the Situation
Before diving into root cause analysis, stabilize the situation. In some cases, the existing condition could lead to accidents, product loss, injury, or environmental harm. Containment actions include the following:

• Quarantining defective products
• Informing affected stakeholders
• Implementing temporary process checks
• Stopping a production line to prevent further loss

Containment is not the final solution – it is damage control.

Step 3: Root Cause Analysis (RCA) – The Heart of the CAR Process
Root cause analysis is where most CAR efforts fail. The goal is to move beyond what happened to why and how it happened. Common RCA tools include:

• 5 Whys – iteratively asking “why” to drill down to the systemic cause
• Fishbone (Ishikawa) Diagram – mapping cause-and-effect relationships across categories
• Process Mapping – visualizing where in a workflow the failure occurred

A key principle: if your root cause sounds like human error, you probably haven’t gone deep enough. Instead of “operator forgot,” ask:

• Why was the process dependent on memory?
• Why was there no fail-safe mechanism?

True root causes are usually process, system, or design weaknesses – not individual mistakes. Sometimes they are as simple as a lack of communication, lack of understanding, or failure to appreciate risk before proceeding.

Step 4: Develop a Corrective Action Plan (CAP)
The Corrective Action Plan defines what will eliminate the root cause. Effective corrective actions may include:

• Changing the process design
• Adding automated controls or validation
• Improving training systems that build genuine competency (not just retraining individuals)
• Modifying procedures or product design

Weak actions – like reminding staff to “be more careful” – rarely prevent recurrence.
Strong actions – like introducing a mandatory checklist with sign-off or automating a validation step – address the system. Ask yourself: Will this action still prevent recurrence even if workers are tired, busy, or new to the role?

Step 5: Implement the Corrective Action Plan
Execute the plan by assigning clear responsibility, setting deadlines, and allocating resources. This is where many CARs stall — not due to poor ideas, but weak follow-through.
After implementing the corrective action, also assess for:

• Residual risks – gaps that the CA may not fully close
• Consequential risks – new problems the CA may inadvertently create
• Efficiency impacts – whether the CA makes workers less productive

Step 6: Verify Effectiveness – The Step Most Organizations Skip
A CAR is not complete until its effectiveness is proven. Ask:

• Did the corrective action work?
• Has the issue stopped recurring?
• Is the process now stable?

Verification can be performed by process owners, but it is also common practice to include effectiveness verification as an objective during subsequent quality audits. Verification methods include:

• Data review over time
• Follow-up internal audits
• Monitoring of process performance metrics

Common Pitfalls in the CAR Process – and How to Avoid Them

Jumping to Solutions
Proposing fixes before understanding the cause is one of the most common mistakes. Enforce root cause analysis before any action planning begins.
Blaming People Instead of Processes
Human error is rarely the true root cause. Always ask, “What in the system allowed the error to occur?” Even apparent human incompetence may trace back to failures in the HR process, training design, or workload management.
Weak Corrective Actions
Actions like “retrain staff” rarely prevent recurrence on their own. Focus on systemic changes that remove the conditions enabling the problem.
No Follow-Up or Verification
Closing CARs without verifying effectiveness defeats the entire purpose. Make effectiveness verification a mandatory step – not an optional one.

Why CARs Drive Continual Improvement

A nonconformity drives correction and corrective action. When the CAR process is practical (not bureaucratic), it becomes a catalyst for continual improvement under ISO 9001. To keep the process effective:

• Keep forms simple and focused
• Train people in root cause thinking, not just template-filling
• Use CARs selectively for meaningful issues
• Review trends across CARs to identify systemic patterns

Done right, CARs become a learning engine for the organization.

Conclusion: A CAR Is a Disciplined Way of Thinking

A CAR is more than a form. It is a disciplined way of thinking that shifts an organization from reacting to preventing. Risk must be appreciated at every stage. Rather than blaming individuals, organizations should build a culture of systemic understanding. Just fixing a problem does not improve the system-root cause analysis is essential.
The most important thing to remember: a CAR is successful not when the problem is fixed but when it cannot happen again.

__

This article was written by IJ, Principal Consultant at QMII. With extensive experience in ISO standards, auditing, and organizational transformation, IJ has guided global organizations in strengthening their management systems. His approach focuses on aligning ISO implementation with strategic business objectives to drive long-term performance improvement.

Quick summary

You don’t really “fail” an ISO audit – you receive nonconformities (NCs), which are simply gaps between your documented process and actual practice. Organizations typically get 30 to 90 days to address them through root cause analysis and corrective action. Handled well, an ISO audit is one of the most practical tools for improving your management system.

In a perfect world, an audit is like a gap analysis to help a business get better. However, for most professionals, failing an audit feels like an exam grade on a report card that their boss (and their customers) will see. This concept of pass and fail in an audit is a wrong perception. The failure myth and the reality of non-conformities (NCs) need understanding. This anxiety that comes from the results of an audit implies a lack of understanding of the objectives of an audit as envisaged in clause 9.2 of ISO 9001 and other standards in the harmonized structure as well as any other management system based on the ISM Code or other industry standards. In the world of ISO (9001, 27001, 14001, etc.), the word “fail” is therefore a misnomer. You don’t usually fail an audit – you receive NCs. NCs drive correction and CA and, therefore, are one of the drivers of the continual improvement of the management system (MS).

Why the fear of ISO audit failure persists

The emotional hurdle of acknowledging why people worry has many reasons, including some places where organizations often tie audit reports to bonuses, professional reputation, or fear of losing a major contract. If the true purpose of an MS is to produce conforming products and services and ensure continual improvement of the MS, it is essential to create the environment of quality where NCs are welcomed.

“The only bad NC is the one you do not know about.” – Dr. IJ Arora, QMII

Understanding ISO audit nonconformities: major NC, minor NC, and OFI

Since we are going to prioritize NCs and work on them, let me start by briefly defining these terms.

Finding type	Definition	Impact on certification
Major nonconformity	Total breakdown of a process against a requirement, or evidence that a requirement does not exist. Implies a risk under clause 6.1 of ISO 9001.	Can delay certification
Minor nonconformity (NC)	A lapse that doesn’t jeopardize the whole system (e.g., one person missed a training log). The system exists but failed in implementation.	Requires corrective action within agreed window
Opportunity for Improvement (OFI)	A suggestion from the auditor – not a failure, but a chance to remedy or improve the management system.	No direct certification impact

The 48-hour rule: what to do immediately after an ISO audit

Most audits have an immediate aftermath – the 48-hour rule -0 in that the organization post-audit has an internal meeting (we recommend and teach it in lead auditor courses taught by QMII). We teach not to panic. The organization, the various process owners, and the quality managers are reminded that ISO standards give a remediation window. Usually, organizations have 30 to 90 days to address major NCs. Very often this window is decided by the organization itself for internal audits and by the CB (certifying body) for third-party audits.

How to communicate audit findings to leadership

During the closing meeting the auditor presents the findings. A survivor’s tip from QMII experience is that an organization has to be mature and never argue, but at the same time be sure to clarify. Ensure you understand exactly why the auditor flagged a process. Be a true professional to establish that the NC is based on a requirement and not on the whims and fancies of the auditor. NC, remember, is the nonfulfillment of a requirement. Quality managers and the entire organizational team must learn how to socialize the news with the leadership in a mature manner. Don’t start by stating the organization failed.

Example framing for leadership: “Auditors identified three key areas where our current documentation doesn’t match our practice, and we have a 60-day window to align them.”

Corrective action process under ISO 9001 clause 10.2

It is worth repeating here that an NC drives correction and corrective action (CA). Yes, it would have been ideal if managers and users of the system had discovered it. Now the shortcoming has been discovered at the audit. Therefore, the path to redemption is CA, which means root cause analysis (RCA) in the agreed time. If it is an NC that needs immediate redemption, the organization does corrections (immediate actions) and follows with CA under clause 10.2 of ISO 9001.

Root cause analysis: going beyond the quick fix

RCA is not simply fixing the mistake. ISO fundamentals require organizations to explain why it happened – that is RCA. That way the organization has the best shot at improving the MS and avoiding reoccurrence. For example, if a document wasn’t signed, the fix isn’t just signing it — it’s changing the system so it can’t be forgotten.

Building your corrective action plan: evidence and closure

The CA plan involves how to document your comeback. It involves evidence gathering. In a subsequent audit, the auditors will look to verifying that the NC has been closed. They will need evidence that the new process is working.

Key steps in the ISO corrective action and closure process

• Conduct an internal debrief within 48 hours of the audit closing meeting
• Classify each finding: major NC, minor NC, or OFI
• Assign process owners and agree on a remediation timeline (30-90 days)
• Perform root cause analysis (RCA) for each NC – do not stop at the symptom
• Implement correction (immediate fix) and corrective action (systemic fix)
• Gather objective evidence that the new process is operating effectively
• Submit the CA response to the certifying body within the agreed window
• Verify closure in the next internal or third-party audit cycle

Turning an ISO audit into a competitive advantage

There is often a clean house effect because of the audit. An audit finding often gives the quality manager the political capital to finally fix broken processes that leadership ignored previously. The audit also helps in building a quality culture. The organization moves from a compliance mindset of we must, to quality because it makes us better. Remember, the certificate on the wall is just paper unless the robust processes built to get that paper are where the real value is created.

What ISO auditors are really looking for

Don’t consider the auditors as the police. They are evaluators and they want organizations they are auditing to pass because it means the standard is being upheld globally. They come looking for conformity. They are bad auditors who come looking for NCs.

The transparency principle: why hiding issues makes things worse
Remember, “documentation is king” is a deceptive policy. “If it isn’t written down, it didn’t happen” is not correct. Transparency wins. If you try to hide a mistake and the auditor finds it, a minor NC quickly becomes a major one due to a lack of management integrity. In a mature organization, the intent of leadership should be to turn the audit into a competitive advantage.

Final thought: the ISO audit as a tool for management system growth

Consider the audit as a tool for growth. Use it to continually improve the MS, provide better and needed resources, and be able to appreciate the risks if resources are not available.

—

This article was written by IJ, Principal Consultant at QMII. With extensive experience in ISO standards, auditing, and organizational transformation, IJ has guided global organizations in strengthening their management systems. His approach focuses on aligning ISO implementation with strategic business objectives to drive long-term performance improvement.