ISO 9001:2026 Is Here: What Changed and What to Do First

ISO 9001:2026, the sixth edition of the standard was published in September 2026. While there have been no major changes to operational clauses it has left many in the industry or new to the standard wondering what has changed and what these changes mean for them. Major changes to the standard include a more explicit requirement for leadership to promote a quality culture, enhanced guidance in the Annex on the meaning of the requirements, and structural changes throughout the standard.

In this article, I outline what has changed, a first 90-days action plan and where training may help with assuring your organization is aligned and conforming.

What Is ISO 9001:2026, and What Is the Timeline?

Publication and status

ISO management system standard gets reviewed every 5 years and a determination is made at the time by the technical committee on whether to revise the standard or not. The decision to revise the standard is made based on inputs from stakeholders and to keep the standard relevant to changes in industry and technology.

The previous revision of the standard was in 2015 when including among other changes the ISO 9001 standard was assigned to the harmonized structure per Annex SL. With the revision of ISO 9001 other standards in the family have already been revised or are in the process of being revised. Examples includes ISO 9000:2026, the glossary of terms used in ISO 9001 and also other guidance standards in the ISO 10000 series.

Transition period explained

The ISO consulting industry at large is pushing the need to implement the changes in your organization quickly. However, as with previous revisions of the standard, certified organizations have up to three years to transition to ISO 9001:2026. The date set for transition is September 2029. In order to make the change cost-effective companies will want to align this with their next surveillance or certification audit. Certification to ISO 9001:2015 will remain valid throughout this transition period. However, companies that are looking to get certified for the first time after September 2027 will need to certify to ISO 9001:2026.

ISO 9001:2026 Changes: What’s Actually Different

What did not change

Before I speak about the changes, I would like to address what remains the same. The standard is still aligned to the harmonized structure and the process approach based on the PDCA cycle. The standard still has clauses numbered 1 through 10 with the emphasis for certification on clauses under 4 through 10.  With the changes being primarily in concept your system will likely not need a major rewrite and in some cases based on your current documentation perhaps no re-write at all.

Changes to the standard include the inclusion of relevant terms and definitions within the standard itself, the removal of Annex B and the increase in guidance in Annex A among others. I will cover the detailed changes in the next section

Key changes to explain

  • Planning and managing change: In the clauses under 6, to better align ISO 9001 with the structure of other standards (to make integration easier) clause 6.1.2 and 6.1.3 have been added for plans to address risks and opportunities. Clause 6.3 has been strengthened for planning, communicating, monitoring and reviewing QMS changes.
  • Climate change: The 2024 amendment to ISO 9001 for climate-related considerations are now added to the standard. A great resource for those struggling with understanding how to apply and audit is the guidance document published by the TC172 Auditing Practices Group.
  • Leadership, culture and ethics: As stated earlier there is a new requirement for leadership to promote a quality culture and ethical behavior. QMII’s ISO 9001 Lead Auditor course addresses how organizations can demonstrate conformity to this requirement as also how to audit this for effectiveness. This requirement is further supported by clause 7.3 for awareness.
  • Continual Improvement: Clause 10.3 has been removed, and improvement is now covered solely in clause 10.1.
  • Performance Evaluation: Additional clarity has been provided on measuring customer perception and the clause for internal audits has seen minor structural changes.

What to Do First: A Practical Starting Plan

Step 1. Get the standard and read the changes

Alright so the heading is stating the obvious. I am, however, often surprised by how many companies do not invest in a copy of the standard because of the high sticker price. The standard will probably not be revised for at least another 7-8 years based on previous revision history. So do not rely on summaries you read on the internet. Purchase a copy, read the standard, underline all the “shall” requirements for these you must implement and conform to.

Step 2. Run a gap analysis

Each time the standard updates is also a great time to review your system through a fresh perspective. With upgrade and certifications, an organization is likely to get enhanced cooperation from all departments. Use the opportunity to review existing documentation to ensure they reflect the “as-is” of how work is done before beginning a gap analysis.

With the as-is review complete, conduct a gap analysis. Having a matrix of which documents align to which clauses of the standard will make it easier to conduct the gap analysis. Keep in mind that because the standard clause structure has changed does not necessitate a change to the documents or numbering within them. A ‘manual’ written to the clauses is often indicative of a system documented for auditors.

Step 3. Brief leadership and secure resources

At any time in the process of transitioning, take time to brief the leadership on what are the new changes, what they mean for them and what they mean for the organization. Brief them on the timeline of the changes and what support you may require from them to implement the changes. Present them with your transition plan, identifying persons responsible for each phase and deadlines. Get their approval for the plan.

This may be a good time to secure a budget for training of personnel to upgrade their auditor knowledge. An ISO 9001 lead auditor or transition course may be the requirement for you. With the auditing standard ISO 19011 updated in 2026 it may be a good idea to take the entire lead auditor course instead of just the transition, especially if your last training was more than three years ago.

Step 4. Update documented information and processes

As I earlier said this is a great time to review the system and upgrade as needed. As a part of this I highly encourage a review of the risk register, if the organization has documented one. Also review your change management procedure and if you have a quality manual make the needed changes. With respect to documentation the ISO 9001:2016 standard has moved away from the use of maintain and retain within the standard. Where documentation si required it now just states shall be available as documented information.

Pro Tip: Keep it proportionate and avoid creating paperwork the standard doesn’t require.

Step 5. Train people

With the upgrades in place, it is now time to conduct refresher training for all personnel within the company. While it is easy to just cover the key changes and what it means for personnel it may be a great time to renew the entire awareness training. In addition to what you expect from all personnel in contributing to quality it’s always great to have a video by leadership conveying their commitment to the system and to providing the resources needed.

Step 6. Test through an internal audit cycle

With the upgrades completed and the system in place, let it run for a month to a month and a half before initiating an internal audit of the system. Do not forget to include the leadership in the audit plan. Here is a link to a recent webinar on Auditing Upstream that addresses this aspect of the internal audit.

Make sure that before your certification body comes in you have completed a management review, following the internal audit and that all findings from the internal audit have been addressed.

Why ISO 9001 Lead Auditor Training Matters During the Transition

What a lead auditor actually does

Having been in the ISO consulting line of work for nearly two decades I see several organizations prefer internal auditor training for internal auditors. This for a variety of reasons. QMII’s recommendation is that at least two auditors on your internal audit team be trained as lead auditors. Choosing a course that is certified by a personnel certification body such as Exemplar Global is an even better choice.

Here is my reasoning for the above. A Lead Auditor course takes a deeper dive on the standard, auditing principles and applying those principles to your management system and your audit program. The participant gets more workshop practice in the additional day of training and in the long run will serve your audit program better. A subjective auditor can slowly kill the audit program and the system. Additionally, providing the employee with certified lead auditor training demonstrates that the company is invested in their personal and professional success.

With the changes the auditor must focus on auditing the top management and not the QMS manager as the leadership for the system. Auditors must be able to interpret the standard correctly and a good auditor makes a good auditee who can challenge certification body auditors when they are being subjective. A good auditing course will get auditors to move beyond focusing on completing a checklist and merely seeking conformity to seeking effectives.

Choosing the right ISO 9001 lead auditor course

Do not choose a course based on the title alone. Ask whether it covers the edition of ISO 9001 you will be working with and the auditing guidance in ISO 19011. If you are taking the training to support your transition, ask the provider how the changes are addressed in the course. You want to understand what the requirements mean for your system, not merely be given a list of what has changed.

As I stated earlier, look for a course recognized by a personnel certification body such as Exemplar Global, and confirm what that recognition covers. Also ask about the trainer’s auditing experience and how much time is spent in practical workshops and role-plays. In my view, being able to explain a clause is only part of the training. Participants need the opportunity to ask questions, review evidence and practice reaching an objective audit conclusion.

Whether you choose virtual or in-person training, consider how you learn best and whether you can set aside the time to participate fully. Do not let the convenience of attending from your desk result in work taking priority over the training. The right ISO 9001 lead auditor training should help you return to your organization ready to apply what you have learned.

Conclusion

The transition is an opportunity to take a fresh look at your system, not a reason to rewrite every document. Keep these three points in mind:

  • Read the applicable edition of the standard rather than relying on summaries.
  • Confirm your existing certificate’s validity and transition arrangements with your certification body.
  • Begin preparing now, with changes proportionate to what your organization needs.

Start by getting the text and conducting a gap analysis against how work is actually done. Brief your leadership, agree on responsibilities and give your people the knowledge needed to make the changes work. If your auditors need a refresher or a deeper understanding of the requirements, explore QMII’s ISO 9001 lead auditor training. Choose training that supports your system and the effectiveness of your audit program. The goal is not simply to get through the next audit, but to have a system that works for your organization.

__

About the Author

Julius DeSilva is CEO of QMII (Quality Management International, Inc.), with more than 25 years of experience in quality management systems, maritime safety and security, and information security. A former seagoing officer and Exemplar Global Certified Lead Auditor (ISO 9001, ISO 27001, ISO 50001, RC14001), he has trained over 1,500 professionals as lead auditors and led consulting and auditing engagements across manufacturing, government, maritime, and aerospace sectors. He holds an MBA from the Darden School of Business, University of Virginia, and is an Associate Fellow of the Nautical Institute.

Why Companies Fail Their First ISO 9001 Certification Audit (and How to Avoid It)

At one time getting certified to a standard, for example ISO 9001 was an event. Over the years it has become a prerequisite to being successful in business. That has brought in many consultants, many with quick ready-made solutions built around templates. I at QMII have been leading the QMII Team by them working using our methodology developed over forty plus years, of avoiding a template and starting by respecting the existing management system by capturing the “as-is” of the system and then developing the management system further to meet objectives. With forty plus years in consulting, auditing and training in the process-based management system approach I wonder why some companies fail their certification. I think a company may arrive at its first ISO 9001 certification audit with an impressive manual, signed policies and carefully arranged records, yet struggle to demonstrate that its management system works. The difficulty becomes visible when the auditor follows an actual customer order, asks how a changed requirement reached production, or examines what management did about a recurring complaint. The documents describe control; however, the evidence tells a different story.

The practical purpose of a quality management system is to help the organization consistently meet requirements and improve customer satisfaction. Certification provides independent assurance about that system. When the certificate becomes the primary objective, preparation can drift toward appearances. The more useful question is whether people can show how their processes deliver the intended results, recognize problems and improve. The system must show effectiveness.

This article uses ISO 9001:2026 and follows its Harmonized Structure (HS) through clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and continual improvement. The structure helps connect business needs to controls, results and learning; it does not require a company to organize its departments or procedures in clause order. The 2026 edition strengthens attention to quality culture, ethical behavior, strategy and the distinction between risks and opportunities. These changes sharpen the questions organizations should ask before their first certification audit. [1, 3]

Understand what failing the first audit means:

An initial certification audit normally has two stages. Stage 1 evaluates the organization’s preparedness for Stage 2, including its system documentation, scope and understanding of requirements. Stage 2 evaluates implementation and effectiveness. Treating Stage 1 as a paperwork formality can leave serious readiness concerns unresolved. [2]

A finding does not automatically mean that the company has failed. Major nonconformities require verified correction and corrective action before certification; for minor nonconformities, the certification body must review and accept the organization’s correction and corrective action plan. Certification follows a separate decision process. Here, “failure” means avoidable delay or inability to demonstrate conformity, not simply receiving any finding. Organizations must remember a Non-Conformity (NC) drives correction and corrective action (CA). [2]

Do not schedule the audit solely to satisfy a sales promise. Allow the system to operate sufficiently to produce credible evidence, evaluate performance and address weaknesses. ISO 9001 (as also other standards) does not prescribe a universal three-month operating period. The necessary evidence depends on the processes, their frequency and the certification arrangements.

Clause 4: The system does not reflect the actual business:

A generic context analysis may mention competition, technology and staffing without explaining their effects on quality (environment, security, health, safety and security, asset management, cyber security, food safety and the numerous other disciplines). Under clauses 4.1 and 4.2, context and relevant interested-party requirements should inform the system. A dependence on one specialist, a customer’s demanding approval conditions or an unreliable material source should influence planning and control. Completing a SWOT worksheet alone does not establish that connection.

Scope under clause 4.3 is another source of difficulty. An organization cannot declare a requirement inapplicable merely because it is inconvenient or performed externally. Consider a business that defines product specifications and commissions a contractor to complete the design. Outsourcing does not, by itself, remove design responsibility or justify treating clause 8.3 as inapplicable. The justification must reflect the organization’s actual responsibilities and its ability to provide conforming products and services.

Clause 4.4 requires attention to processes and their interactions. Departmental procedures may each look satisfactory while the handovers between sales, engineering, purchasing and delivery remain unreliable. Follow one real job across those boundaries. Establish what each process receives, what it delivers, who is accountable and how its effectiveness is evaluated. This is more revealing than checking whether every department has a procedure.

ISO 9001:2026 retains the climate considerations introduced in 2024, including a determination of whether climate change is a relevant issue under clause 4.1 and highlights potentially relevant interested-party requirements under 4.2. Determine which relevant interested-party requirements the QMS will address rather than merely listing stakeholders. For example, disruption to temperature-sensitive deliveries may matter to the QMS. A reasoned determination is needed; an environmental management system or carbon-reduction objective is not automatically required. [1, 3]

Clause 5:  Leadership has delegated ownership of the system:

A quality manager can coordinate implementation, but top management retains accountability for the QMS’s effectiveness under clause 5.1.1. An auditor may ask a senior leader why a quality objective was selected, what is preventing its achievement and what resources have been committed. Referring every question to the quality department reveals a potential disconnect between management and the system.

Leadership is demonstrated through decisions. If sales repeatedly accept delivery dates that operations cannot meet, management must address how commitments are made. A signed quality policy does little to offset incentives that reward shipment regardless of conformity. The 2026 emphasis on quality culture and ethical behavior in clause 5.1 makes this especially pertinent. Would an employee feel able to report a defect honestly, or would pressure to meet a target encourage concealment? Under clause 5.2, the quality policy should connect to the organization’s context and strategic direction. [3] Customer focus under clause 5.1.2 should influence the decisions that create promises and the controls that ensure those promises can be fulfilled.

Under clause 5.3, responsibilities and authorities should be assigned, communicated and understood. A person responsible for product acceptance needs the authority to withhold release when requirements are unmet. Prepare leaders to explain actual decisions and results. Coaching them to recite policy language adds little assurance.

Clause 6: Planning produces registers rather than action:

A risk register may be complete while the organization continues to rely on uncontrolled assumptions. Clause 6.1 links risks and opportunities to planned action, integration into processes and evaluation of effectiveness. If reliance on a single supplier threatens delivery, recording a high-risk score is only the beginning. The organization might qualify an alternative, adjust stock arrangements or strengthen contingency planning, then assess whether the action reduced exposure.

ISO 9001 does not prescribe a risk register, a particular scoring matrix or a formal risk management methodology. The method should suit the business. The 2026 edition distinguishes actions addressing risks from actions addressing opportunities within clause 6.1. An opportunity deserves deliberate consideration: improved order-entry validation, for example, may reduce clarification delays and errors. Identify the beneficial result sought and evaluate the action taken; do not treat an opportunity as merely a low-risk score. [1] A longer register is not necessarily better planning.

Quality objectives under clause 6.2 need meaningful measures and plans for achievement. “Improve quality” gives little direction. Reducing order-entry errors from an established baseline, with an owner, resources, completion date and evaluation method, provides something management can act on. Missing an objective does not automatically establish a nonconformity; the auditor must consider the relevant requirement, planning, monitoring and response.

Changes require similar discipline under clause 6.3. Introducing new software, relocating work or replacing an experienced employee can alter the system. Consider the purpose, consequences, resources, responsibilities and integrity of the QMS, then plan implementation and evaluate the result. Communicate changes to the people affected. The 2026 revision strengthens change management; approving a change is not the same as demonstrating that it achieved its purpose. [4] A carefully prepared original system can become unreliable through poorly managed change.

Clause 7: Training and documentation are mistaken for capability:

Attendance records show that someone attended training. Clause 7.2 requires the organization to determine necessary competence; ensure people are competent and evaluate the effectiveness of actions taken to acquire competence. For an inspector, appropriate evidence might include observed performance, successful assessment and authorization for specified work. A course certificate alone may not establish the ability to make reliable acceptance decisions.

Awareness under clause 7.3 is also practical. Employees should understand how their work contributes to effectiveness and what can happen when requirements are not met. Ask a dispatch employee what happens when labeling instructions are unclear. Knowing where to seek clarification and when to stop is more useful than memorizing an ISO clause number. The 2026 awareness provisions also address quality culture and ethical behavior. Discuss real choices, such as recording an inspection honestly when a delivery deadline is at risk. [3]

Documented information under clause 7.5 must support work and be controlled. A shared electronic system is acceptable; printing every record is unnecessary. The important questions concern approval, access, revision, protection, retention and retrieval. A beautifully maintained master procedure offers little protection when an obsolete instruction remains in use at the workstation. The amount of documentation should reflect what is required to operate and demonstrate control, not the size of a purchased template package.

Resources also include organizational knowledge under clause 7.1.6 and suitable monitoring and measuring resources under 7.1.5. Do not stop at checking calibration labels. Where a measuring device is found unfit for its intended purpose, assess whether earlier results may have been affected and take appropriate action. Similarly, identify knowledge that would disappear if a key employee left. These weaknesses can undermine conformity despite complete training files.

Clause 8: Controls break down during real work:

Operational evidence is where an apparently complete system is tested most directly. Under clauses 8.2.2 and 8.2.3, the organization determines and reviews requirements before committing to supply. A purchase order acknowledgment is not necessarily evidence that technical, delivery and applicable statutory or regulatory requirements were adequately reviewed. Changes must also reach the people who need them under clause 8.2.4.

Consider a customer who changes a material specification after order acceptance. Sales records the change, but purchasing uses the original specification and receiving accepts the material against that outdated order. Each department can produce a record, yet the system has failed to carry the requirement through. This illustrates why an auditor follows transactions across functions instead of examining forms in isolation.

External-provider control under clause 8.4 requires more than an approved supplier list. The type and extent of control should reflect the effect of externally provided processes, products and services on conformity. Define what providers must deliver, how their performance is monitored and what triggers action. A provider’s ISO 9001 certificate can support evaluation; it does not eliminate the need for appropriate controls.

For production and service provision under clause 8.5, compare stated controls with practice on different shifts and at relevant locations. Where resulting outputs cannot be verified by subsequent monitoring or measurement, process validation becomes important under 8.5.1. Final inspection cannot compensate for every weakness in the process that creates the output.

Release under clause 8.6 should be supported by evidence that acceptance criteria have been met and by traceability to the authorizing person. Nonconforming outputs under 8.7 require control to prevent unintended use or delivery. An urgent shipment should not bypass these arrangements simply because a manager wants the order dispatched. After a correction, conformity must be verified; making the item look acceptable is insufficient.

Clause 9: Internal assurance is too superficial:

An internal audit that asks only whether documents exist can leave major weaknesses undiscovered. Clause 9.2 calls for information about both conformity and effective implementation and maintenance. Auditors need competence and arrangements that ensure objectivity and impartiality. A consultant’s implementation work does not automatically establish an impartial internal audit of that same work.

A useful audit follows evidence from requirement to result. Select an actual order, examine a changed requirement, test supplier controls and verify release. Include appropriate samples across the scope, considering process importance, changes and previous results. A clean audit report is valuable only if the sampling and evaluation justify its conclusions. The absence of findings is not itself proof of audit quality.

Performance evaluation under clause 9.1 should also go beyond producing dashboards. A company may report excellent on-time delivery while routinely changing promised dates after accepting orders. Clarify what the measure means and whether it reflects the customer’s experience. Customer satisfaction monitoring under 9.1.2 is broader than complaints alone; silence does not establish satisfaction.

Management review under clause 9.3 must use relevant inputs and produce decisions and actions. A brief meeting with the required headings, but no examination of trends or resource needs, may provide little evidence of effective review. Equally, a separate ceremonial “ISO meeting” is unnecessary if established management arrangements address the required inputs and outputs and retain the necessary evidence. Review should help management decide what to change and then follow through.

Clause 10: Problems are corrected without preventing recurrence:

Replacing a rejected component is a correction. Corrective action under clause 10.2 addresses the cause so that recurrence can be prevented. “Operator error” may describe an event without explaining why the system allowed it. Consider unclear criteria, unsuitable tools, conflicting instructions, workload, supervision and changes in the process before concluding that retraining is the answer.

The response should consider whether similar nonconformities exist or could occur elsewhere. If one workstation used an obsolete drawing, examine how drawings are controlled across the relevant operation. Replacing that single copy may resolve the immediate defect while leaving the underlying cause untouched.

Effectiveness needs evidence. Define what would show that the action worked, such as correct revision use across a meaningful sample of subsequent jobs. Closing an action because a procedure was revised verifies completion, not necessarily effectiveness. The depth of action should be proportionate to the effects of the nonconformity, and results should feed improvement under clause 10.1.

Make readiness a management decision:

Before committing to Stage 2, management should ask process owners to demonstrate a complete job, an important change and a resolved problem. Can they retrieve the relevant evidence, explain the controls and show the results? Have internal audits tested implementation? Has management review led to decisions? Have significant weaknesses been addressed and the effectiveness of corrective actions evaluated?

These are practical readiness tests, not additional ISO requirements. They bring the system back to its purpose. A first certification audit should examine an organization’s established way of managing its work. When people understand their responsibilities, controls operate in practice and management learns from evidence, certification becomes a credible recognition of that capability. The real achievement is a system that continues to work after the auditor leaves.

Conclusion:

The leadership in any organization should invest in their system demanding desired outputs. The audits should enable leadership to make better decisions and ensure planned resourcing. The QMS (quality management system) must help the organization consistently meet requirements and improve customer satisfaction, not just become certifiable. Purpose of a MS. Is not only to be auditable but to achieve the objectives.  Certification provides independent assurance about that system. Making the certificate the primary objective is in a way a leadership failure. Leadership must motivate the employees to show their processes deliver the intended results, recognize problems and improve. The system must be effective. Certificates will follow and are important but not the primary aim of the MS.

__

About the Author

Inderjit (IJ) Arora, Ph.D., is the Chairman of QMII. He serves as a team leader for consulting, advising, auditing, and training regarding management systems. He has conducted many courses for the United States Coast Guard and is a popular speaker at several universities and forums on management systems. Arora is a Master Mariner who holds a Ph.D., a master’s degree, an MBA, and has a 35-year record of achievement in the military, mercantile marine, and civilian industry.

Employees Ignore the QMS: How to Build Real Buy-In Beyond the Quality Team

ISO 9001:2026 just dropped and leadership promoting a quality culture is one of the new requirements. Since inception in 1986 QMII has stressed that an effective management system means more than just a folder of documents. True system effectiveness comes from personnel motivated, competent and knowledgeable of the requirements. Often with a poorly implemented system gaining QMS employee engagement can be a challenge. This leaves the quality manager doing all the heavy lifting and the system engagement only coming the week before an audit.

In this article I seek to highlight the steps organizations can take to gain engagement from the workforce. The steps outlined will help organizations reduce the resistance to change and move the mindset from one of just compliance. QMII’s clients’ have benefitted from this over the years and so should you.

Why Employees Treat the QMS as “Quality Team Paperwork”

As I visit clients for the first time, I hear people refer to me as “the ISO guy”. Herein is probably the first mistake that organizations make in their quality management system implementation journey. Treating the system as an ISO system or a quality system rather than how the company operates and gets work done. In doing so organizations tend to document their system to meet audit and customer requirements, prepare to pass audits and treat their QMS as an add-on that can be switched on and off as needed.

As with any change, implementing a QMS will come with this fair share of resistance. Each employee wants to know what’s in it for me. Why should they keep these additional records and document what they do when perhaps their pay will see no increase. Some have concerns about their job security if they document how they do what they do. Others feel they will be restricted in what they do and perhaps there will also be more documented accountability. All valid fears that must be alleviated by the leadership in explaining why the system is important and why personnel should treat their QMS as more than just paperwork.

If you walk onto the shop floor and do not see personnel using the QMS documentation because “I know better”, “I’ve been doing it this way for years” or “It ain’t broke so why fix it” then you know you have a QMS that exists only on paper.

What ISO 9001 Actually Expects from Employees

Before I speak about what ISO 9001 expects from the employees I want to focus on what it requires of Leadership. While a QMS requires engagement from all personnel the onus to promote that engagement, support other leadership roles in implementing the system and encouraging continual improvement lies with the leadership. Leadership is accountable for the success of the system. The leadership must convey their expectations via the policy and objectives and then provide the resources needed to achieve it. They must define clear roles and responsibilities and determine the competency requirements for each position in the organization.

With the framework above set, leaders must now focus on hiring and maintaining competent personnel. In addition, they must drive awareness of the system among the workforce. In ISO 9001:2026 clause 5.2 requires the policy to be communicated, understood and applied. This means that the workforce must understand how they contribute to the policy and then apply it in their daily job. When the entire workforce is working towards a common goal as outline in the policy and objectives then it can be said that the quality culture is good. The workforce must recognize why they should not take shortcuts, who to report to when they notice a risk and the ability to stop work if needed.

A common myth is that a QMS and the ISO 9001 standard requires employees to follow procedures, obey leadership and cross train others. None of these are requirements of the standard. Outlined below are five simple steps to encourage more active participation in the system.

Fix 1: Connect Quality Objectives to Each Role

As stated in the previous paragraph it is important to have measurable goals (also required by the standard). Once the processes have been defined then relevant process owners need to be assigned. Each process owner then defines the process to the extent needed only to have confidence that the process is being carried out as planned. Thus, documentation will vary based on the size of the organization, structure, number of personnel and their experience and the complexity of the process.

ISO 9001 does not limit the number of goals that can be set. Each process can have its own measurable goal, so long as it contributes to the overall objective and does not conflict with any other objective /KPI.

Outlined below is a simple example of an objective cascade through an organization.

Example QMS Objective Cascade
LevelObjectiveMeasure and TargetOwner
OrganizationImprove customer satisfaction.Increase the customer satisfaction score from 88% to 92% by year-end.Top management
Operations processImprove on-time delivery.Increase on-time delivery from 90% to 96% by the end of Q4.Operations manager
Production teamReduce delays caused by rework.Reduce rework from 5% to 2% of units produced by the end of Q3.Production supervisor

Fix 2: Make Leadership Visible

I’ve been working with a number of organization and even through my own career nothing makes a system more effective that visible leadership. This is the reason when I audit, I ask leadership, “How do personnel evidence your commitment”? Top Management must walk the talk. A policy signed and posted on the notice board has no value when the leadership does not provide the resources to support it. When they bypass the requirements, they set for others and when quality goals are adjusted to pass audits.

Leadership must actively participate in contextual risk reviews, their decision making must be evident in the various operational aspects, and they must actively participate in management reviews. When non-conformities occur, they must ensure effective and timely action. Also, when the corrective action is ineffective, they must question why. Other ways that leadership commitment may be evidenced is in them refacing the QMS in meetings, effective communication on the state of the system to all and GEMBA walks.

For leadership a simple way to gain buy in is to not refer to the management system as the QMS. Take quality out of the name and put your company name in there so personnel “own” the system. Gain their inputs when documenting the system.

Fix 3: Replace Generic Training with Role-Based Awareness

The standard ISO 9001 does not ask for training. It requires competence. This minor difference is often lost in implementation where many companies I work with read competence as training. Competence is the ability to apply skills and knowledge effectively and training merely provides that knowledge. A leader that says they care about the system and in driving competence among personnel but then do not want to commit the time or resources to train those personnel does not show commitment.

Apart from competence the standard requires awareness training. Here is where employees need to be trained in how they can contribute to the system. This includes what to do when they evidence risks, how to recommend changes to documentation and whom to report opportunities for improvement to. They need to understand why the QMS supports them in all they do. QMS awareness training when implemented during employee onboarding should be followed by a refresher training at some periodic basis.

If you would like a template for training your employees on your QMS reach out to QMII at [email protected] .

Fix 4: Simplify Procedures and Forms

When consultants are brought in to design your system, they write the procedures based on their experience and with templates they have used in the past. QMII’s approach is to work with companies to capture the documentation the way work is actually done. No assumptions made and no fictional procedures are captured. This ensure that you say what you do and do what you say.

Consider how you can simplify QMS documentation so its easy for the user to locate and use. Think beyond procedures documented in MS word. Consider how to video files, posters, graphical representations, screen shots, flowcharts and more. Make the documentation user-friendly to locate and reference. Think computers at the point of use for ease of reference. Make suggesting changes to documentation easy while ensuring adequate control.

•         Effective document control and compliance guide

Fix 5: Recognize and Involve People

People are more likely to support the QMS when their ideas and contributions are recognized. Recognition does not need to be expensive. Leaders can highlight useful suggestions in team meetings, thank employees who identify risks or improvement opportunities, and share examples where an employee’s input prevented a problem. These simple actions reinforce the message that quality is everyone’s responsibility and help build a culture of continual improvement.

Involvement is equally important. Organizations can introduce suggestion schemes, quality circles, and regular feedback loops that give personnel a simple way to recommend changes. In creating new documents gain reviews of the document from all relevant interested parties prior publishing the document .Employees from different departments can also be trained as internal auditors, allowing them to better understand how processes connect while bringing a fresh perspective to audits. When personnel see that their input leads to action, they are more likely to take ownership of the management system.

Measuring Whether Buy-In Is Improving

Employee buy-in should be visible in how the QMS performs. Look for fewer repeat audit findings, more near-miss and improvement reports, completed role-based awareness activities, and stronger employee feedback in surveys and management reviews. Positive trends in these simple indicators show that personnel are moving beyond compliance and taking ownership of the system.

A QMS becomes effective when objectives connect to each role, leaders remain visible, awareness is relevant, documentation is easy to use, and people are recognized for contributing. When employees see the system as the way the organization works engagement and the quality culture improve. Internal Auditor and Lead Auditor training can further build the skills needed to sustain that involvement and continual improvement.

__

About the Author

Julius DeSilva is CEO of QMII (Quality Management International, Inc.), with more than 25 years of experience in quality management systems, maritime safety and security, and information security. A former seagoing officer and Exemplar Global Certified Lead Auditor (ISO 9001, ISO 27001, ISO 50001, RC14001), he has trained over 1,500 professionals as lead auditors and led consulting and auditing engagements across manufacturing, government, maritime, and aerospace sectors. He holds an MBA from the Darden School of Business, University of Virginia, and is an Associate Fellow of the Nautical Institute.

Systematizing Government at all levels by using ISO 18091

The process-based management system approach gives any organization the best shot at systematically improving administration and addressing nonconformities, so the output of the administration is a confirming product as step one. The next step would be to continually improve the system and meet objectives. ISO 18091 (Quality management systems guidelines for the application of ISO 9001 in local government) is an international standard designed specifically to help local governments and municipal authorities implement effective quality management systems (QMS) based on ISO 9001. Using a standard which encompasses worldwide wisdom on the system approach as the basis of the system is better than reinventing the wheel every time.

The Technical committees for various standards (TC-176 for ISO 9001) bring to the table a lot of wisdom on which they frame these standards. ISO 18091:2019, the second edition, was reviewed and confirmed by ISO in 2024 and therefore remains current. It was prepared by ISO/TC 176, quality management and quality assurance. This is important because the guidance is connected directly to the accepted principles and requirements of ISO 9001 while recognizing that local government has responsibilities that are different from those of a commercial organization.

Government affects the citizen throughout life. Birth registration, education, public health, roads, water, sanitation, emergency services, licensing, land use and public safety are all delivered through processes. When these processes are left to personalities, informal practices or the priorities of the moment, results vary. A management system converts good intentions into defined responsibilities, controls, measures and opportunities for correction. It also helps preserve institutional knowledge when elected leaders or senior officials change.

The word systematizing should not be misunderstood as adding bureaucracy. The objective is to simplify and control the work so that it produces intended results. ISO 9001:2026, Clause 4.4, requires the organization to determine the processes needed for the QMS, their interactions, the criteria and methods for operation and control, the resources required, responsibilities, risks and opportunities, and the methods for evaluation and improvement. ISO 18091 explains how this process approach can be applied to public policy and municipal services.

Rather than creating a standalone set of requirements, ISO 18091 translates the core concepts, principles, and clauses of ISO 9001:2015 into terms, structures, and processes that directly address the public sector. The standard provides the core objectives for good administration particularly, citizen centric focus, reliability and transparency and alignment with UN (United Nations) SDGs (sustainable development goals) as follows:

  • Citizen-Centric Focus: Adapts the ISO 9001 concept of “customer satisfaction” into citizen satisfaction, focusing on key municipal responsibilities such as public safety, infrastructure, waste management, healthcare, and education.
  • Reliability & Transparency: Standardizes public administration processes to improve transparency, accountability, operational efficiency, and overall public trust (“Trusted Governance”).
  • Alignment with UN SDGs: Serves as a framework to implement, track, and measure progress toward the United Nations Sustainable Development Goals (SDGs) at the municipal level.

Citizen focus begins with understanding who the interested parties are and what they reasonably require. Clause 4.2 of ISO 9001 asks the organization to determine the relevant interested parties and their requirements. In a local government these parties extend beyond the person standing at a service counter. They include residents, visitors, businesses, employees, elected representatives, regulators, service contractors, vulnerable groups and future generations affected by present decisions. ISO 18091 helps the local government translate these different expectations into manageable processes and measurable public policy.

Leadership is central and Clause 5.1 requires top management to demonstrate leadership and commitment to the QMS. For local government this means that elected and appointed leaders cannot delegate the system to a quality coordinator and consider the work complete. Leaders must establish policy and objectives, provide resources, assign authority, review performance and act when results are not achieved. The system succeeds when it becomes the way the government manages, rather than a separate quality program maintained for an audit. Accountability remains with leaders and delegation of authority as per clause 5.3 would not mean leaders are not accountable.

Risk-based thinking also has direct public value. Clause 6.1 requires action on risks and opportunities. A municipality can therefore consider foreseeable interruptions and failures before they harm citizens: loss of drinking water, delayed permits, failure of waste collection, deterioration of roads, cyber incidents, extreme weather, contractor failure or loss of critical knowledge. Controls can then be proportionate to the consequence. The same analysis can identify opportunities such as digital services, shared resources, preventive maintenance and clearer communication with citizens.

A reliable system also distinguishes between correction and corrective action. If a citizen receives an incorrect permit, correcting the document solves the immediate problem. Clause 10.2 goes further by requiring the organization to react to the nonconformity, deal with its consequences, determine whether the cause could create the same or a similar failure elsewhere, implement needed action and review its effectiveness. This changes administration from repeated firefighting to prevention of recurrence.

The key Components and annexes of the standard include structured tools specifically tailored to municipal management. ISO 9001 remains the primary standard. ISO 18091 is not a sector specific standard in itself. It is a guideline enabling use of the ISO 9001 for governance. The standard provides:

  • Clause-by-Clause ISO 9001 Translation: Offers guidance on how each standard requirement (e.g., leadership, risk management, performance evaluation) applies to public policy and municipal administration.
  • Diagnostic Assessment Tool (Annex A): A self-assessment tool utilizing 39 key performance indicators across four broad policy categories:
    • Institutional development for good governance
    • Sustainable economic development
    • Social development
    • Sustainable environmental development
  • Integral Quality Management Processes (Annex B): Guidance on designing and maintaining processes that ensure reliable public service delivery.
  • Integral Citizen Observatories (Annex C): Guidelines for engaging citizens directly in monitoring public policy, fostering transparency and continuous improvement.
  • UN Agenda 2030 Alignment (Annex D): Maps local government management indicators directly to the 17 UN Sustainable Development Goals.

The clause-by-clause guidance covers the full management cycle: context in clause 4, leadership in clause 5, planning in clause 6, support in clause 7, operation in clause 8, performance evaluation in clause 9 and improvement in clause 10. This sequence is useful because it prevents a government from jumping directly to measurement without first defining its purpose, processes, responsibilities and controls. Measurement then becomes evidence for decisions rather than a collection of statistics with no clear use.

Annex A can provide the starting point. Its 39 indicators enable a local government to examine public policy as an integrated whole. The value lies less in declaring a score and more in identifying where conditions are unacceptable, where essential practices are only partly established and where results are being sustained. Priorities can then be based on evidence, citizen need and risk. Periodic reassessment provides a visible record of progress and exposes areas that remain dependent on temporary effort.

Annex B supports the process view. Services such as issuing a license or repairing a road are rarely the work of one department from beginning to end. They require inputs, decisions, resources, contractors, information and communication across organizational boundaries. Mapping these interactions helps identify delays, duplication, unclear handoffs and missing controls. It also allows objectives to be assigned to the complete service, not merely to the activity of an individual department.

Annex C recognizes that citizens should not be treated only as passive recipients of government output. An integral citizen observatory provides a structured way for citizens to observe public policy, examine evidence and contribute to accountability. Citizen participation becomes more useful when it is based on defined indicators and verified information. It can confirm where services are working and identify gaps that internal reporting may overlook.

Annex D connects the local indicators to the UN Sustainable Development Goals and to other assessment and management systems. This helps local government translate broad global commitments into local processes and measures. A goal such as clean water, sustainable communities or climate action becomes meaningful only when responsibility, resources, controls, measures and follow-up are established at the level where services are delivered.

The key difference in ISO 18091 from the primary standard ISO 9001 is the guidelines. ISO 9001 provides generic requirements for any organization, whereas ISO 18091 is a sector-specific guide. It does not add or alter ISO 9001’s fundamental requirements; rather, it bridges the gap between private-sector quality management language and the multi-stakeholder, public-policy realities of local government.

This distinction is important for certification. A local government may be assessed for conformity to ISO 9001, but ISO 18091 itself supplies guidance and does not create additional certifiable requirements. The guidance should therefore be used to make the ISO 9001 system relevant and effective, not as a checklist that produces another layer of documentation.

Clause 7 helps ensure that plans are supported by competent people, suitable infrastructure, organizational knowledge, communication and controlled documented information. In government, documented information provides continuity and transparency, but documentation should serve the process. A procedure that is not followed, a record that is not analyzed or a measure that does not support a decision adds little value. The necessary amount and form of documentation should depend on complexity, risk, competence and the need for accountability.

Clause 8 brings the discipline to service delivery. Requirements must be understood, changes controlled, external providers managed and nonconforming outputs identified. This is particularly relevant because many public services are delivered through contractors or partnerships. Outsourcing an activity does not outsource accountability. The local government must determine the controls needed to ensure that externally provided processes and services continue to meet requirements.

Clauses 9.1, 9.2 and 9.3 close the management loop through monitoring, internal audit and management review. Clause 9.1.2 addresses customer satisfaction; ISO 18091 places this in the context of citizens and other interested parties. Satisfaction surveys can contribute evidence, but they are not enough by themselves. Service times, complaints, recurrence of failures, infrastructure condition, regulatory compliance, access, cost and achievement of public objectives provide a fuller picture. Internal audit should test whether processes are implemented and effective, while management review should lead to decisions on improvement, resources and needed changes.

Implementation can begin on a manageable scale. The local government can define its context and interested parties, use Annex A for an initial diagnosis, select one or two high-impact services, map their processes, establish measures and responsibilities, and begin the cycle of audit, review and corrective action. Early projects should demonstrate that the system makes work clearer and services more reliable. Lessons can then be applied across other departments and levels of government.

The benefits are practical. Citizens receive more consistent services and clearer information. Employees understand responsibilities and handoffs. Leaders receive evidence on whether policies are producing intended results. Suppliers and contractors work within defined controls. Problems are recorded and their causes addressed. Objectives are linked to resources and reviewed. Transparency improves because processes, measures and decisions can be explained.

ISO 18091 can therefore help systematize government without attempting to standardize political choices or make every municipality identical. ISO 9001 itself does not require uniformity in the structure of quality management systems. Each government retains its mandate, priorities and local context. What becomes systematic is the method used to understand needs, plan services, manage risk, deliver outputs, evaluate results and improve.

The real test of good governance is not the number of procedures written or certificates displayed. It is whether the administration consistently fulfills requirements, corrects failures, learns from evidence and improves the results experienced by citizens. ISO 18091 provides a sound guideline for doing this. Used by leadership and team with purpose, it can make government more reliable, transparent and capable of sustaining improvement beyond changes in personalities and political terms.

__

About the Author:

Inderjit (IJ) Arora, Ph.D., is the Chairman of QMII. He serves as a team leader for consulting, advising, auditing, and training regarding management systems. He has conducted many courses for the United States Coast Guard and is a popular speaker at several universities and forums on management systems. Arora is a Master Mariner who holds a Ph.D., a master’s degree, an MBA, and has a 35-year record of achievement in the military, mercantile marine, and civilian industry.

IATF 16949 vs ISO 9001: What the Automotive Suppliers Need to Know Before Auditing

For suppliers operating in the automotive supply chain, quality management is not just an internal operational goal, it is a mandatory condition of doing business. While ISO 9001 serves as the world’s foundational standard for quality management systems (QMS) across industries, automotive original equipment manufacturers (OEMs) demand a far higher level of rigor. This is generally true of all sectors specific standards. Be it aviation or automotive or nuclear or any other ISO 9001 is not prescriptive or descriptive. It needs interpretation. As the interpretations for a sector of the industry become too many or prescriptive a sector specific standard is born. This is where IATF 16949 enters the frame as an automotive specific standard. Over 40 plus years QMII has built expertise in auditing, consulting and training of this standard.

Navigating the transition or managing a dual-standard audit requires a clear understanding of where ISO 9001 ends and IATF 16949 begins. Before entering an audit, suppliers must understand the structural hierarchy, specific core tools, standard clauses, and auditor requirements necessary to achieve and maintain certification. IATF 16949 Builds on ISO 9001. The system approach remains the underlying driver. A common misconception among suppliers is that IATF 16949 is a standalone quality standard that replaces ISO 9001. IATF 16949 is a sector-specific supplement layered on top of ISO 9001:2015, not a replacement. ISO 9001 provides the core quality management system baseline and IATF 16949 provides the automotive specific sector requirements.

Harmonized Structure (HS) Integration

IATF 16949 uses the exact same HS, as the ISO 9001:2015, comprising 10 core clauses. ISO 9001 provides the baseline framework, such as leadership, risk-based thinking, and continuous improvement. The IATF 16949 injects stringent automotive requirements into those identical clause structures. I am discussing the key structural clause references below:

  • Clause 4 (Context of the Organization): ISO 9001 requires identifying internal and external issues. IATF 16949 expands on this in Clause 4.3.2 by requiring customer-specific requirements, mandating that OEM customer specifications which are formally evaluated and included in the QMS scope.
  • Clause 7 (Support): ISO 9001 focuses on general competence and resources. IATF 16949 adds Clause 7.2.3 mandates internal auditor competency and clause 7.2.4 requires second-party auditor competency, enforcing qualification requirements for anyone conducting audits.
  • Clause 8 (Operation): ISO 9001 outlines general operational planning. IATF 16949 builds extensive automotive requirements directly into this section, covering product safety in clause 4.4.1.2 / 8.3.1.1 and embedded software, and supply chain management.

Key Differences Auditors Must Understand

To conduct a successful audit, internal and external auditors must look beyond general ISO 9001 processes and audit against automotive-specific methodologies. The general risk management of ISO 9001 per IATF makes it mandatory FMEA per clause 8.3.5.1 and contingency plans per clause 6.1.2.3. Basic process controls in ISO 9001 are strengthened by IATF 16949 to include requirement for core tools as APQP (advanced product quality planning), PPAP (production part approval process), MSA (measurement system analysis), SPC (statistical process control). The requirement of internal audits in ISO9001 clause 9.2 is made specific by including in clause 9.2.2.2-4, system, process and product audits. And the customer satisfaction is clarified with requirement for customer specific requirements (CSRs) and OEM scorecard in IATF.

Automotive Core Tools. IATF 16949 explicitly or implicitly mandates the use of five fundamental automotive core tools:

  1. APQP (Advanced Product Quality Planning): Governs product development from concept through mass production (Clause 8.3.2.1 – Design and development planning).
  2. PPAP (Production Part Approval Process): Formally verifies that manufacturing processes can consistently produce compliant parts at production rates (Clause 8.3.4.4 – Product approval process).
  3. FMEA (Failure Mode and Effects Analysis): Risk identification tool for design (DFMEA) and process (PFMEA) (Clause 8.3.5.1 – Design and development outputs).
  4. MSA (Measurement Systems Analysis): Evaluates variation in measurement equipment (Clause 7.1.5.1.1 – Measurement system analysis).
  5. SPC (Statistical Process Control): Monitors process stability and capability (Clause 9.1.1.1 – Monitoring and measurement of manufacturing processes).

Customer-Specific Requirements (CSRs)

Unlike general ISO 9001 audits, an IATF 16949 audit evaluates compliance with Customer-Specific Requirements (CSRs) (Clause 4.3.2 & Clause 7.5.1.1). Auditors must verify that OEM-specific portals, packaging manuals, labeling rules, and scorecard metrics are integrated into the organization’s daily processes.

Common Nonconformities in Automotive Audits

During certification and surveillance audits, third-party auditors frequently issue major and minor nonconformities in specific, repeat areas. Understanding these failure points allows organizations to address gaps proactively.

  1. Problem Solving (Clause 10.2.3): Organizations often submit superficial 8D corrective action plans that fail to address system-level root causes or update related PFMEAs and Control Plans (Clause 8.5.1.1).
  2. Contingency Planning (Clause 6.1.2.3): Failing to regularly test or review contingency plans for key risk events (e.g., utility outages, cyberattacks, equipment failure, supply chain disruptions).
  3. Internal Auditor Competency (Clause 7.2.3): Internal auditors lack documented evidence of competency in core tools, risk-based thinking, or customer-specific requirements.
  4. Control Plan Alignment (Clause 8.5.1.1): Discrepancies between the PFMEA, the Control Plan, and actual shop-floor work instructions.

Preparing Your Team for a Combined Audit

Organizations seeking simultaneous certification or upgrading from ISO 9001 to IATF 16949 can streamline the audit process through a structured preparation by using a four-step path. In step 1 by conducting a gap analysis & CSR mapping (clauses 4.3.2 & 6.1) as also evaluating the existing ISO 9001 processes against IATF 16949 additions and by mapping all active OEM customer specific requirements (clause 4.3.2) into the process matrix. The second step includes core tool and process alignment (clauses 8.3 & 8.5) to include verification that every PFMEA directly informs the corresponding control plan (clause 8.5.1.1) and to conduct MSA studies (clause 7.1.5.1.1) for all key gauge types listed in control plans. The step 3 is the internal process and system audits (clause 9.2) shift away from clause-by-clause checklist audits. The requirement is to perform internal manufacturing process audits (clause 9.2.2.3) and product audits (Clause 9.2.2.4) using the Turtle Diagram methodology (inputs, outputs, resources, competence, key performance indicators, and risk). Step 4 is the management review and the assessment of final readiness (clause 9.3). Holding a formal management review meeting (clause 9.3) and addressing all IATF-specific inputs, including warranty performance (clause 9.3.2.1), OEM scorecards, and action plan reviews are requirements.

Building In-House Audit Capability

The success of an IATF 16949 QMS ultimately relies on effective implementation and therefore the competence of the people auditing it. Relying solely on external consultants for internal audits can be costly and creates dependency risks. Therefore, building a team of certified lead auditors is essential. IATF 16949 clause 7.2.3 sets strict qualification requirements for internal auditors. Auditors must demonstrate, understanding of the automotive process approach for auditing, including risk-based thinking and knowledge of applicable customer-specific requirements and of applicable ISO 9001 and IATF 16949 requirements. Auditors must have competency in Core Tools (APQP, PPAP, FMEA, MSA, SPC). Establishing qualified in-house expertise transforms internal auditing from a routine compliance exercise into a driver of process performance and cost reduction.

Path to Compliance

IATF 16949:2016 lead auditor training requires completing an accredited IATF 16949:2016 training program, providing quality managers, engineers, and internal auditors with the skills needed to lead full QMS audits, evaluate complex supply chains, and ensure seamless readiness for third-party registrar audits.

Conclusion

Understanding the dynamic between ISO 9001 and IATF 16949 is critical for any automotive supplier aiming for certification and operational excellence. By mastering automotive core tools, addressing common nonconformity areas, and investing in certified IATF 16949:2016 lead auditor capability, an organization can approach certification audits with confidence.

How Will an Internal Audit Help Any Business?

An internal audit is often viewed as a compliance exercise, a scheduled activity designed to check whether an organization is following its procedures and meeting the requirements of a standard. However, a well-planned internal audit can provide much more value. It can help a business identify risks, improve processes, reduce costs, strengthen customer satisfaction, and support better management decisions.

Whether a company operates under ISO 9001, ISO 14001, ISO 45001, ISO 27001, or another management system, internal auditing can become an important business-improvement tool.

Identifying Problems Before They Become Serious

One of the greatest benefits of an internal audit is early problem detection, like they, if you have a headache for more than a day then it’s best to get it checked before it becomes something big and uncurable.

Every organization has weaknesses. Procedures may not be followed consistently, records may be incomplete, employees may misunderstand responsibilities, or processes may have gradually changed without the relevant documentation being updated.

An internal audit provides an opportunity to identify these issues before they develop into major problems.

For example, an audit may discover that equipment inspections are not being completed according to schedule. If this issue is identified early, management can take corrective action before equipment failure causes production delays, customer complaints, or safety incidents.

In this way, internal audits are preventive as well as corrective.

Improving Business Processes

Internal auditing should not simply ask, “Are we following the procedure?”

A stronger audit asks, “Is this process actually working?”

A procedure may technically meet requirements but still be inefficient. Employees may spend unnecessary time completing forms, approvals may take too long, information may be duplicated, or communication between departments may be poor.

An internal audit can identify these inefficiencies and provide evidence for process improvement.

For example, an organization may discover that a purchasing process requires three separate approvals for relatively low-risk purchases. The audit could identify unnecessary delays and encourage management to simplify the process while maintaining appropriate controls.

The result is a system that is not only compliant but also more efficient.

Reducing Costs and Waste

Businesses constantly look for ways to reduce unnecessary costs. Internal audits can contribute directly to this objective.

Auditors may identify:

  • Repeated errors and rework
  • Excessive material waste
  • Inefficient use of resources
  • Unnecessary administrative activities
  • Poor inventory controls
  • Equipment maintenance problems
  • Duplicate processes
  • Supplier-related problems

Consider a manufacturing organization experiencing a high level of product rework. An internal audit may trace the problem back to unclear work instructions or inconsistent inspection practices.

Addressing the underlying cause can reduce scrap, labor costs, production delays, and customer complaints.

Therefore, the financial value of an internal audit can be much greater than the cost of conducting the audit.

Strengthening Risk Management

Modern businesses operate in environments filled with risks. These may include operational, financial, environmental, cybersecurity, supply-chain, regulatory, and reputational risks.

Internal audits provide management with an independent examination of how effectively these risks are being controlled.

For example, an audit may determine that an organization has identified cybersecurity risks but has not adequately controlled access to sensitive information. Similarly, an environmental audit may identify inadequate controls over waste management.

The auditor does not necessarily solve the problem. Instead, the audit provides management with objective information so appropriate action can be taken.

This makes internal auditing an important component of risk-based management.

Supporting Compliance

Organizations are often required to meet laws, regulations, contractual requirements, industry standards, and internal policies.

Failure to comply can result in fines, legal problems, loss of customers, operational disruption, or damage to reputation.

Internal audits can provide an early warning system.

For organizations certified to an ISO standard, internal audits also help determine whether the management system continues to conform to applicable requirements and whether processes are effectively implemented.

Importantly, an internal audit should not be treated as preparation for “passing” an external audit. Its purpose is to determine whether the organization’s management system is genuinely effective.

Preparing for External Audits

A strong internal audit program can significantly improve an organization’s readiness for certification, surveillance, recertification, regulatory, or customer audits.

External auditors are likely to examine evidence showing how processes are controlled and whether the organization is meeting applicable requirements.

If internal audits are performed regularly, problems can be identified and corrected before an external auditor discovers them.

For example, an internal audit may identify an incomplete training record, an overdue calibration, or an ineffective corrective action. Management can address the issue before it becomes an external-audit finding.

The objective should not be to hide problems from external auditors. Instead, internal audits should help the organization discover and resolve its own problems first.

Improving Employee Awareness

Internal audits also create opportunities for employee engagement and learning.

During an audit, employees may be asked questions about their responsibilities, procedures, objectives, risks, and controls. This can reveal whether employees truly understand the management system or are simply completing tasks because they have been instructed to do so.

An auditor might discover that employees understand what they do but do not understand why they do it.

That distinction is important.

Employees who understand the purpose behind a process are generally better positioned to recognize problems, make appropriate decisions, and suggest improvements.

Internal auditing can therefore contribute to a stronger culture of quality, accountability, and continuous improvement.

Providing Management With Objective Information

Managers often make decisions based on reports, meetings, performance indicators, and employee feedback. While these sources are valuable, they may not always reveal what is happening within a process.

Internal auditors provide another perspective.

A good auditor collects objective evidence through interviews, observation, document review, and sampling. The resulting findings can help management understand the actual condition of a process.

For example, management may believe that customer complaints are being addressed effectively. An internal audit might reveal that complaints are being closed quickly but that root causes are not being properly investigated.

That information can lead to better management decisions.

Encouraging Continual Improvement

Continual improvement is a fundamental principle of many management systems, but improvement cannot occur effectively without knowing where improvement is needed.

Internal audits provide that information.

An audit can identify trends and recurring weaknesses. If the same type of finding appears repeatedly, management should consider whether the organization is addressing symptoms rather than underlying causes.

For example, repeated findings involving incomplete records may indicate a deeper problem with training, process design, workload, responsibilities, or management oversight.

Instead of repeatedly correcting individual records, the organization can investigate the systemic cause.

This is where internal auditing moves from simple compliance checking to genuine business improvement.

Increasing Customer Confidence

Customers want to know that a business can consistently deliver products or services that meet requirements.

A reliable internal audit program helps strengthen the systems supporting that consistency.

By identifying process weaknesses, controlling risks, improving corrective actions, and monitoring performance, internal auditing can contribute to improved product and service quality.

This can ultimately lead to fewer complaints, fewer returns, better delivery performance, and stronger customer relationships.

Conclusion

An internal audit should not be viewed as an exercise designed to find fault with employees. Its real purpose is to provide an objective assessment of how well the organization is operating and where it can improve.

A valuable internal audit identifies weaknesses before they become major problems, improves processes, reduces waste, supports compliance, strengthens risk management, prepares the organization for external audits, and provides management with reliable information for decision-making.

The most effective organizations do not ask, “How can we pass the audit?”

They ask, “What can this audit teach us about our business?”

When internal audits are approached in this way, they become much more than a requirement of an ISO management system. They become a practical management tool that helps businesses operate more efficiently, control risk, improve performance, and achieve sustainable growth.

Ultimately, the value of an internal audit is not measured by how many findings an auditor raises. It is measured by how effectively the organization uses those findings to become better.

__

About the Author:

Anjalika Singh is the President of QMII (Quality Management International, Inc.), a global management systems consulting firm headquartered in Ashburn, Virginia. Over the course of her career, she has developed a sharp intuitive sense combined with strong operational and training management skills, making her a key asset in QMII’s consulting and training initiatives. Her work focuses on practical lead-auditor training and helping organizations adopt ISO and industry-specific management systems in a way that delivers real business value. Anjalika also serves as President and CEO of iCertifications, LLC, where she leads efforts to make accredited ISO certification services accessible to small and medium-sized businesses.

ISO 9001 Certification: A Business Leader’s Roadmap

ISO 9001 certification is more than a certificate displayed on a wall. For business leaders, it represents an opportunity to build a disciplined management system that consistently delivers quality, satisfies customers, manages risks, and supports continuous improvement. Yet organizations sometimes approach ISO 9001 as a compliance exercise rather than as a continual improvement tool. The difference in approach can determine whether certification becomes a valuable strategic asset or simply another administrative burden.

For leaders considering ISO 9001 lead auditor certification, the journey should begin with understanding what the standard is designed to accomplish and how it can support organizational objectives.

Understanding ISO 9001

ISO 9001 is an internationally recognized standard for quality management systems (QMS). It provides a framework for organizations to establish processes that consistently meet customer requirements, applicable regulatory requirements, and the organization’s own objectives.

Importantly, ISO 9001 does not prescribe exactly how a business must operate. A manufacturing company, consulting firm, software provider, construction company, or service organization can all implement the standard. The organization determines the processes, controls, resources, and methods appropriate to its size, complexity, products, services, and risks.

For business leaders, this flexibility is important. Certification should not mean copying another organization’s procedures. The management system should reflect how the organization operates.

Step 1: Establish Leadership Commitment

Successful ISO 9001 implementation starts with the Top Management/ Leadership.

Senior leadership must understand why the organization wants certification and what business outcomes it expects. Possible objectives include improving customer satisfaction, reducing defects, standardizing processes, strengthening supplier management, improving operational efficiency, entering new markets, or satisfying customer requirements.

Leadership should communicate that quality is an organizational responsibility rather than the sole responsibility of a quality manager.

A strong leadership commitment includes providing appropriate resources, establishing quality objectives, assigning responsibilities, participating in management reviews, and ensuring that employees understand the importance of effective processes.

If employees believe ISO 9001 is simply “the quality department’s project,” implementation is likely to struggle.

Step 2: Define the Business Context and Scope

The organization should next determine the context in which it operates. Leaders need to consider internal and external issues that can affect the organization’s ability to achieve its intended quality outcomes. These may include market conditions, technology, competition, customer expectations, regulatory requirements, organizational capabilities, supply-chain issues, and changes in the business environment.

The organization must also determine the scope of its quality management system. The scope should clearly identify the products, services, locations, and organizational activities covered by the QMS. It should be realistic and accurately represent the organization’s operations. A clearly defined scope prevents confusion later in the certification process.

Step 3: Identify and Manage Risks and Opportunities

Modern quality management is not simply about detecting problems after they occur. ISO 9001 encourages organizations to think about risks and opportunities before problems affect customers or business performance.

Leaders should ask questions such as:

  • What could prevent us from meeting customer requirements?
  • Which processes are most critical to our success?
  • Where are errors most likely to occur?
  • Which suppliers create significant operational risk?
  • What opportunities could improve efficiency or customer satisfaction?
  • What changes could affect our ability to deliver consistent products or services?

Risk-based thinking should become part of everyday decision-making rather than a standalone exercise performed only for an audit.

Step 4: Map and Standardize Key Processes

A quality management system is fundamentally a system of processes. Organizations should identify their major processes and understand how they interact. Depending on the business, these may include sales, contract review, purchasing, design and development, production, service delivery, inspection, testing, customer support, human resources, maintenance, and supplier management.

Process mapping can reveal duplication, unclear responsibilities, bottlenecks, missing controls, and opportunities for improvement.

The goal is not to create excessive paperwork. The goal is to make important processes predictable and effective.

Step 5: Build Competence and Employee Awareness

Even the best designed QMS will fail if employees do not understand their responsibilities.

ISO 9001 places significant importance on competence and awareness. Organizations should determine the competencies required for people performing work that affects quality, provide appropriate training or other actions, and evaluate whether competence has been achieved.

Training should be practical.

Employees should understand not only what procedure they are expected to follow but also why it matters. For example, a purchasing employee should understand how supplier selection affects product quality, delivery performance, customer satisfaction, and organizational risk.

This creates ownership rather than simple procedural compliance.

Step 6: Establish Performance Measures

Business leaders cannot effectively manage what they do not measure.

Organizations should establish meaningful quality objectives and appropriate performance indicators. Depending on the organization, these might include customer complaints, on-time delivery, defect rates, rework, process efficiency, supplier performance, warranty claims, service response times, or customer satisfaction.

The key is to avoid measuring everything simply because data is available.

Good metrics help leaders answer important questions:

Are our processes working? Are customers satisfied? Are objectives being achieved? Where should management focus its attention?

Performance information should be reviewed regularly and used to make decisions.

Step 7: Implement Internal Audits

Internal audits are one of the most valuable tools in the ISO 9001 system.

An internal audit should not be treated as a rehearsal for the certification audit. Its purpose is to determine whether the QMS conforms to requirements and whether it is effectively implemented and maintained.

Effective auditors look beyond documentation. They follow processes, interview employees, examine records, observe activities, and evaluate objective evidence.

A strong internal audit program can identify weaknesses before they become customer complaints or external audit findings.

Leaders should encourage employees to view internal audits as improvement opportunities rather than investigations designed to assign blame.

Step 8: Use Corrective Action for Real Improvement

Problems will occur in every organization. ISO 9001 does not require perfection; it requires organizations to respond appropriately when nonconformities occur.

The critical question is whether the organization addresses the underlying cause.

For example, if an employee repeatedly completes a form incorrectly, simply retraining that employee may not solve the problem. The organization should investigate why the error occurred. Was the form confusing? Was the procedure unclear? Was the employee adequately trained? Was the process poorly designed? Was there insufficient supervision?

Effective corrective action addresses causes rather than symptoms.

Step 9: Conduct Management Review

Management review gives senior leaders an opportunity to evaluate whether the QMS remains suitable, adequate, effective, and aligned with organizational direction.

Management should review relevant performance information, audit results, customer feedback, process performance, nonconformities, corrective actions, risks and opportunities, supplier performance, and changes that could affect the QMS.

The output should be decisions and actions, not merely meeting minutes.

Leadership should use management review to determine where resources, priorities, or processes need to change.

Step 10: Prepare for the Certification Audit

Once the QMS has been implemented and has generated sufficient evidence of operation, the organization can engage an accredited certification body for the certification process. Certification generally involves an initial assessment conducted in stages. The certification auditors evaluate whether the management system meets ISO 9001 requirements and whether it is effectively implemented.

Organizations should not attempt to hide weaknesses from auditors. A mature QMS recognizes that problems are opportunities to improve. Preparation should include reviewing internal audit results, closing appropriate corrective actions, confirming employee awareness, ensuring required documented information is controlled, and verifying that processes are actually being followed.

The Business Leader’s Role After Certification

Certification is not the destination. One of the most common mistakes organizations make is treating certification as the end of the project. Once the certificate is issued, attention may decline and the QMS can gradually become disconnected from daily operations.

Business leaders should instead treat ISO 9001 as an ongoing management framework. The organization should continue monitoring performance, conducting internal audits, addressing customer feedback, managing risks, improving processes, reviewing objectives, and preparing for surveillance audits.

The real value of ISO 9001 becomes apparent when the QMS becomes part of how the organization is managed, not something maintained only because an auditor is coming.

Conclusion

ISO 9001 certification provides business leaders with a structured approach to improving quality, consistency, customer satisfaction, and organizational performance. However, the certificate itself is not the objective. The objective is to create a management system that helps the organization understand its processes, manage risks, make informed decisions, and continually improve.

The roadmap is straightforward: establish leadership commitment, understand the business context, identify risks and opportunities, manage processes, develop competent employees, measure performance, conduct effective internal audits, implement meaningful corrective actions, perform management reviews, and undergo certification with confidence.

When leadership treats ISO 9001 as a business management tool rather than a compliance exercise, certification can become much more than an external recognition of conformity. It can provide the foundation for a more disciplined, customer-focused, resilient, and continuously improving organization.

—

About the Author:

Anjalika Singh is the President of QMII (Quality Management International, Inc.), a global management systems consulting firm headquartered in Ashburn, Virginia. Over the course of her career, she has developed a sharp intuitive sense combined with strong operational and training management skills, making her a key asset in QMII’s consulting and training initiatives. Her work focuses on practical lead-auditor training and helping organizations adopt ISO and industry-specific management systems in a way that delivers real business value. Anjalika also serves as President and CEO of iCertifications, LLC, where she leads efforts to make accredited ISO certification services accessible to small and medium-sized businesses.

What to Expect from an ISO 9001 Consultant: A Plain-English Buyer’s Guide

Hiring an ISO 9001 consultant should not be treated as purchasing a collection of procedures or hiring someone to just get the certificate. A capable consultant should help your organization develop a management system that improves how work is controlled, how risks are managed, how customers are served, and how leadership makes decisions. It is of course a generic compilation of thoughts to assist all organizations who work with consultants to refine, retune and improve their management systems. With the ISO 9001 almost on the eve of being updated in September 2026, this is a pertinent question: how to select consultants. QMII has forty plus years of experience. I have been in the lead role at QMII for two decades now and share some of my thoughts to enable managements make good decisions on this.

The certificate matters, but it should be the result of an effective management system and not the sole purpose of the engagement.

Organization’s As-Is System.

QMII has worked with organizations and management systems for four decades. During that time, we have learned that successful consulting is not about imposing a generic ISO template. It is about understanding how an organization operates, identifying what already works, strengthening what does not, and helping its people develop a system they can use and improve long after the consultant has left. I think beginning with the “as-is” of the system is the best start. Basing a system design on a template or a fictional system is never a good idea.

For organizations considering ISO 9001 lead auditor certification or trying to obtain more value from an existing system, this guide explains what a competent consultant should provide, what the client should contribute, and what warning signs to watch for.

Build on What Already Exists

The consultant should begin by understanding the organization. Please don’t throw the baby with the bath water. Start with the “as-is” of the system. A good consultant does not arrive with a finished quality manual and begin changing the company to fit it. The consultant first learns how the organization works. This includes understanding, what the organization provides (products and services), who its customers and other relevant interested parties (ISO 9001 clause 4.1 and 4.2) are. Then look at how customer requirements are determined and fulfilled and connect these to which processes create value (ISO 9001 clause 4.4). A good consultant should systematically look at what can prevent those processes from achieving their intended results (ISO 9001 risks clause 6.1 and maintaining customer focus clause 5.1.2). No consultant can forget which regulatory, statutory, contractual, and industry requirements apply to the organization and its deliverables. Study how performance is currently measured and what leadership wants the management system to accomplish (policy 5.2 flowing to measurable objectives 6.2 considering the risks 6.1 to doing the work 8.5 and releasing the product and or service 8.6).

Use the Process Approach

This approach reflects ISO 9001 Clauses 4.1 and 4.2, which require an organization to understand its context and the needs and expectations of relevant interested parties. Clause 4.4 then requires the organization to determine and manage the processes needed for its quality management system.

These requirements cannot be addressed properly with a generic questionnaire alone. The consultant must talk with leadership, process owners, supervisors, and employees. They should observe work where it occurs and then follows the flow of actual orders, information, materials, decisions, and records. At QMII, we regard this discovery process as essential. Four decades of experience have reinforced a simple lesson, before recommending a solution, we must understand the client’s organization, its culture, its risks, and its intended results.

Emphasize the “as-is” of the system as a consultant. It is more and committed work as a consultant to start with what they already do as compared to a template.  The consultant should be willing to build on what the organization already Has. Most established organizations already have a management system, whether they call it one or not. I often use a practical rule of thumb: if an organization has operated successfully for eighteen months, much of its management system, perhaps 85 percent is already present, even if it has not been formally defined in ISO language.

After all they receive customer inquiries, review contracts, purchase materials, train employees, produce goods or deliver services, inspect work, resolve problems, and monitor financial and operational performance. These activities may not be organized around ISO terminology, but the underlying processes already exist.

A capable consultant identifies and builds upon these existing practices. The objective is not to replace sound business methods with ISO methods. The objective is to ensure that the organization’s processes are adequately defined, controlled, measured, and improved. This may require, clarifying responsibilities and authorities, improving the interaction between departments as also establishing missing controls, simplifying duplicated or ineffective controls and identifying meaningful performance measures. There may be a need to strengthening corrective action, addressing risks before failures occur and lead risks as input to create OFI (opportunities for improvement) and finally retaining documented information where it adds value or provides necessary evidence. The system from a reactive where NC (non-conformity) drives correction and corrective action must be changed to a proactive system where data drives risk and trends. The consultant should help the organization close genuine gaps without creating unnecessary bureaucracy.

ISO 9001 does not require a procedure for every activity. It requires the organization to maintain and retain documented information to the extent necessary to support process operation and provide confidence that work is being performed as planned (clause 4.4 of ISO 9001). An experienced consultant understands this distinction.

The consultant should use a process-based methodology. ISO 9001 is based on the process approach. Consequently, the consultant’s methodology should also be process based. A process is more than a department or a procedure. It is a set of related activities that converts inputs into intended outputs. Each process should have a purpose, responsible ownership, appropriate resources, operating controls, performance criteria, and methods for addressing risk and improvement. For example, sales should not be examined only as an organizational department. The consultant should consider the full customer-related process which should include how are customer needs identified, how are quotations prepared, how are requirements reviewed before commitments are made and how are changes communicated? Then there should be clarity on how are operational departments informed, how is customer feedback is obtained and how does the organization determine whether the process is effective?

This thinking connects several ISO 9001 requirements instead of treating each clause separately. It can link the process requirements of Clause 4.4 with operational planning under Clause 8.1, the review of customer requirements under Clause 8.2, performance evaluation under Clause 9.1, and improvement under Clause 10.

QMII’s methodology has been developed and refined through four decades of consulting, training, auditing, and practical management-system experience. Our consultants look beyond individual clauses to understand how processes interact and whether the system is achieving its intended results.

Engage Leadership

Then in selecting consultants consider how the consultant will engage the leadership. ISO 9001 cannot be implemented successfully as a quality department project. Clause 5.1 places clear responsibility on top management for the effectiveness of the quality management system. Leadership is expected to establish direction, integrate quality requirements into business processes, provide resources, promote the process approach and risk-based thinking, and support continual improvement.

A competent consultant should therefore work directly with senior leadership. This does not mean occupying executives with the wording of every procedure. It means helping them understand and fulfill their responsibilities. The consultant should help leadership answer practical questions such as what results do we expect from this management system, what quality objectives support the organization’s business strategy, which risks could prevent us from fulfilling customer requirements and do the process owners have sufficient authority and resources? Without information leading to risks and trends the top management (TM) cannot make objective decisions. The consultant should bring to their understanding if the organization is receiving useful performance information, are management reviews resulting in decisions and action and is the system helping improvement or merely preparing us for audits?

The consultant should also be willing to challenge leadership respectfully. If managers want ISO 9001 certification but are unwilling to provide time, resources, accountability, or visible support, the consultant should explain the consequences honestly. Commitment cannot be delegated to the consultant.

Transfer Knowledge and Build Independence

Another important duty of the consultant is to transfer knowledge (ISO 9001 clause 7.1.6). A consultant’s responsibility to transfer knowledge also supports the intent of ISO 9001 Clause 7.1.6 concerning organizational knowledge. One of the most important tests of a consulting engagement is what happens after the consultant leaves. The organization should understand and own its management system. Employees should know how their work contributes to quality. Process owners should be able to monitor and improve their processes. Internal auditors should be capable of evaluating effectiveness, and leadership should be able to use management review as a genuine decision-making process.

The consultant should therefore act as an adviser, facilitator, coach, and educator and not as the permanent owner of the system. Consultants who intentionally make clients dependent on continuing support are not serving the client’s long-term interests. Prospective clients should therefore examine how the consultant intends to transfer knowledge and build internal capability. That is unethical and organizations should therefore be wise in selecting consultants. Knowledge transfer may include awareness sessions for employees (often called familiarization and or orientation), leadership briefings, process-owner workshops, risk-based thinking exercises, internal auditor training, corrective-action and root-cause training, guidance for management review and perhaps coaching during implementation and readiness activities. Training should be relevant to the participant’s role. Senior leaders, internal auditors, process owners, and frontline employees do not all need the same level or type of instruction.

QMII is both a consulting, auditing and a training organization. This enables us to combine subject-matter expertise with a strong emphasis on developing the client’s internal capability. Our measure of success is not client dependence; it is the client’s ability to sustain and improve the system.

Prepare for Certification, Without Becoming the Auditor

The consultant should prepare the organization for certification without becoming the auditor. A consultant may help an organization prepare for certification, but the consultant should not promise or guarantee certification. Certification decisions belong to an independent, accredited certification body. The consultant should explain the certification process, help the organization select a suitable certification body, and prepare the organization for the Stage 1 and Stage 2 audits. However, the certification body must remain independent of the consulting work. Before the certification audit, the consultant should help confirm that the quality management system has been implemented, processes are operating under planned conditions and required documented information is available. Then there is the need for employees to understand their responsibilities, for quality objectives being monitored, internal audits should have been completed, and management review has taken place. Then there are the NCs (Nonconformities) which should have been corrected. Basically, that there is evidence that the system is producing results.

A readiness review should not be a rehearsal in which employees memorize answers. It should determine whether the system is genuinely ready to be evaluated. The best preparation for an external audit is an effective system used routinely, not a last-minute cleanup exercise. The consultant should focus on results, not just documents. This results-oriented emphasis is also consistent with ISO 19011:2026, published in May 2026, which places increased attention on risk, technology, digitization, and evolving audit practices. ISO 9001:2026 which should be available in September 2026 also emphasizes this.

Focus on Results, Not Documents

Remember that a management system may be fully documented and still fail to deliver. A skilled consultant looks beyond whether a procedure exists. The more important questions are is the process achieving its intended result, are customer requirements consistently fulfilled, are errors and delays decreasing, are employees competent to perform their work and are risks being addressed? This should be followed by addressing if recurring problems are being eliminated, are decisions based on reliable evidence, is customer satisfaction improving and is the organization learning from experience?

This results-based approach is consistent with ISO 9001 Clause 9.1, which requires organizations to determine what should be monitored and measured, and Clause 10, which focuses on nonconformity, corrective action, and continual improvement. The consultant selected should help establish measures that support decisions, not measurements collected only because they look impressive on a dashboard.

Match the Consultants to the Industry

Further the consultant should tailor the system to your industry. This is true for ISO 9001 and particularly true for industry specific standards. ISO 9001 can be applied across many industries, but implementation should never ignore industry context. An aerospace supplier, maritime organization, engineering company, training provider, nuclear supply-chain organization, and general manufacturer may all use ISO 9001, but their risks, contractual requirements, operational controls, and stakeholder expectations will differ substantially. Therefore, ask prospective consultants whether they understand the industry and operating environment, the applicable legal and regulatory requirements, customer-specific requirements, the industry terminology, product or service risks and the relevant sector-specific standards. This all affects the practical realities faced by the employees. The system is for the employees and not for auditors.

QMII’s subject-matter expertise extends beyond the text of ISO 9001. Our experience includes maritime safety and the ISM Code, aerospace standards such as AS9100 and IA9100, nuclear quality assurance, environmental and occupational health and safety management systems, supply-chain security, and auditor development. This breadth allows us to recognize where ISO 9001 must operate as part of a larger business and regulatory framework.

Warning Signs When Selecting a Consultant

The organization should consciously include study of promises of guaranteed certification, offers of a complete generic documentation package before understanding the organization, when consultants focus almost entirely on procedures and forms and treats ISO 9001 as the responsibility of the quality manager. Further when the consultant cannot explain requirements in plain English, has little relevant industry or auditing experience, discourages direct contact with employees or leadership, creates unnecessary documentation and or prepares people to say the right things to an auditor and specially makes the organization dependent on continued consulting support. Another warning sign is when the consultant shows little interest in business performance or customer satisfaction.

Questions to Ask Before Signing

A consultant’s credentials matter, but so do judgment, communication skills, integrity, practical experience, and the ability to gain the confidence of people at every level of the organization. Therefore, consider the questions to ask before signing a consulting agreement:

  1. How will you learn about our organization and its processes?
  2. What experience do you have in our industry?
  3. Who will perform the consulting work?
  4. What will you expect from our leadership team?
  5. How will you avoid unnecessary documentation?
  6. How will you help our employees understand and own the system?
  7. What training is included?
  8. How will progress and effectiveness be measured?
  9. How will you prepare us for internal and certification audits?
  10. What support will be available after certification?
  11. Can you provide relevant references or examples?
  12. How will the completed system support our business objectives?

The proposal should clearly define scope, responsibilities, deliverables, estimated timing, training, expenses, and assumptions. The least expensive proposal may not provide the best value, particularly if it results in a burdensome system that later must be redesigned. Remember the summary of ISO 9001 clause 8.4.1 on selecting vendors. Selecting a consultant solely on the lowest price can be costly if the resulting system is bureaucratic, ineffective, or must later be redesigned.

What QMII Brings to the Engagement

From QMII experience of 40 years and with satisfied clients I can say consultants should bring to the engagement value. For forty years, QMII has helped organizations understand, implement, audit, and improve management systems. That history has enabled us to perfect a practical methodology grounded in the process approach, systems thinking, risk-based thinking, and continual improvement. Amongst many qualities, I would say good consultants should at least bring these three qualities to every engagement.

First, bring subject-matter expertise. Consultants and instructors understand both management-system requirements and the operational environments in which those requirements must be applied. Second, the consultant must bring a proven methodology. For this begin by understanding the organization, map and evaluate its processes, identify meaningful gaps, work with its people to develop appropriate controls, and transfer the knowledge needed to sustain the system. Third, bring commitment to the client’s success. Do not measure success merely by the award of a certificate. Good consultants like QMII want the client to have a management system that employees understand, leadership uses, customers trust, and the organization continually improves.

The Final Test of a Successful Engagement

The final test of a successful ISO 9001 consulting engagement should leave an organization with more than a certificate and a set of documents. It should leave the organization with better-understood processes, clearer responsibilities, more engaged leadership, stronger control of operational risks, more capable employees and internal auditors, better information for decision-making, a more effective corrective action, greater confidence in meeting customer requirements and a s sustainable foundation for continual improvement. The real question is not simply, “Did we achieve ISO 9001 certification?” The better question is, “Has our management system made us a more capable, consistent, and successful organization?”

That is what a client should expect from an ISO 9001 consultant—and it is the standard to which QMII has committed itself for four decades.

—

About the Author:

Inderjit (IJ) Arora, Ph.D., is the Chairman of QMII. He serves as a team leader for consulting, advising, auditing, and training regarding management systems. He has conducted many courses for the United States Coast Guard and is a popular speaker at several universities and forums on management systems. Arora is a Master Mariner who holds a Ph.D., a master’s degree, an MBA, and has a 35-year record of achievement in the military, mercantile marine, and civilian industry.

ISO 9001 Gap Analysis: How to Do It Before Your First Certification Audit

What Is a Gap Analysis and Why It Matters Before Certification

When first looking to conform to ISO 9001, seeking certification or perhaps looking to upgrade your system to a new revision of the standard an ISO 9001 gap analysis comes up in conversations. This article outlines what a gap analysis is, what goes into it and why it matters.

Defined plainly, it is a structured comparison of your current Management System (MS) against ISO 9001 requirements, clause by clause. Think of it as a practice exam before the main exam that gives you insights into where your weaknesses are so you can improve on them. It is not a full audit of your system. More a diagnostic check. In a gap analysis no nonconformities are “issued,” just gaps identified.

Not knowing where your weaknesses in the management system lie can impact your operations by letting risks go unnoticed and unaddressed. Further it may result in certification delays especially if any non-conformities identified are major. In a few cases the major non-conformities may require a secondary onsite visit, that is an additional cost. If your business contracts and contingent upon certification being achieved, then an ISO 9001 gap analysis helps. It doesn’t guarantee a clean audit, but it de-risks it significantly.

It is a small cost to incur to avoid a failed external audit and certification delay. Other intangible costs are also incurred such as a hit to team morale and loss of faith in the system approach.

The 10-Clause Framework: Walking Through ISO 9001 Section by Section

With the harmonization to a uniform structure ISO 9001 and its 10 clauses are not aligned to the Plan-Do-Check-Act cycle. This allows for easier implementation and integration with other management systems. As a note, clauses 1-3 (scope, normative references, terms) are non-auditable but set context for the standard and its why.

Perhaps the best approach to the gap analysis is to use the clause structure of the standard as a starting point. The challenge often lies in assessing processes and connecting internal requirements to the language of ISO. Clauses 4 through 10 are the real “meat” of the standard.

  • Clause 4 — Context of the organization – Evidence for this clause is often found with the leadership and requires their involvement and engagement.
  • Clause 5 — Leadership – The clauses under 5 require leadership awareness of what the system needs from them as also the assignment of a clear vision via the policy and clear responsibilities and authorities.
  • Clause 6 — Planning – This clause requires the organization to assess the risks to meeting its goals (including customer satisfaction and continual improvement) and identify controls that will enable mitigation of these risks.
  • Clause 7 — Support (resources, competence, documented info) – While perhaps the easiest clause of the standard, documentation control is often the biggest weakness in systems and in audits.
  • Clause 8 — Operation – Clause 8 is the “meat” of any organizations operations and will perhaps take the longest time during the gap analysis.
  • Clause 9 — Performance evaluation – Here is where the organizations determine what they are going to monitor and how they monitor it.
  • Clause 10 — Improvement – Check whether your system has avenues for identifying and acting on improvement opportunities including identifying and taking action on non-conformities.

A simple was to look at each requirement is to ask, “What does this clause require? Do we have evidence? Is it followed consistently?”. If you struggle to identify a suitable checklist for the gap you can simply use the clause structure as a gap analysis checklist itself. Reach out to [email protected] should you want a checklist you can use.

 

Context of the organization: what most SMBs overlook in clause 4

SMBs often treat 4.1 (internal/external issues) as a one-time exercise, and not a living document. For micro business with only a few employees there may be no need to document the context. I say no need as the ISO 9001 standard does not require the context to be documented. It is best practice though as the company grows in locations, personnel and/or operations. Contextual issues are really business 101. An organization must determine what is going to impact them and what actions they should be planning to mitigate any negative impact while building on the positive ones. Penning them down helps keep track of them and review them later.

While leadership may know who the interested parties are what their needs are often internal parties get overlooked such as employees, and certain external parties such as suppliers and insurers. Interested parties are often thought of as customers and perhaps rightly so as they are probably the largest for a business. When reviewing the scope statement make sure it covers what you are seeking to get certified. While generally the limit of the actual site/process boundaries is common don’t use it as a means to exclude areas/processes that must be included.

Clause 4.4 is often a weakness in systems QMII has worked on. The clause requires the organization to determine the sequence and interaction of the processes. SMBs often have documented procedures but no process interaction map. QMII often captures this as a core process for its clients.

Pro tip: tie context review to a real business planning input (e.g., strategic planning meeting) so it doesn’t feel like a paperwork exercise

How to Score Your Gaps: A Simple Red/Amber/Green Method

A simple was to score your gap analysis is using the RAG logic:

  • Red = requirement not met at all, no evidence
  • Amber = partially met, inconsistent, or undocumented but practiced
  • Green = fully met with objective evidence

While it is easy to score the entire clause, QMII recommends scoring each requirement at the sub-clause level, for accuracy. In addition to the requirement in one column, additional columns may include current state evidence, RAG, actions needed to conform, action owner and target date.

Remember it is a system and you are identifying risks. As such even though an area/requirement may be conforming and green your ISO 9001 gap analysis should identify process risks such as when reliant on one person or no document exists, only tribal knowledge. This gives the leadership visibility on the risk and they can make a decision to accept it or not.

Pro Tip on prioritization: fix all Reds first, especially in clauses tied to product/service conformity (clause 8) since those tend to trigger major NCs

Common Gaps Found in US Manufacturing Plants (and How to Close Them Fast)

Below is a list of common gaps found across systems that QMII has helped implement and get through first time certification:

  • Calibration records incomplete or gauges past due date – Create/update the calibration log and set up a recall/alert system for upcoming due dates.
  • Supplier evaluation not risk-based (approved vendor list exists but no criteria/re-evaluation cycle) – For each supplier determine the evaluation, selection and re-evaluation criteria. Apply them to existing suppliers.
  • Nonconformance and corrective action process exists but isn’t tied back to root cause analysis (people fix symptoms, not causes) – preferably get a few personnel training in problem solving/root cause analysis (RCA) and these will then champion this RCA process.
  • Training records not linked to competency requirements for specific roles – Determine the competency requirements for each role, determine the records needed to prove competency is met, identify where and who will retain the records.
  • Management review meetings happen but don’t cover all required inputs/outputs from clause 9.3 – Review the existing review template against the requirements of Clause 9.3. In addition to the inputs remember to document the decision and actions of leadership.
  • Document control: multiple “current” versions floating on shop floor vs. controlled system – Ask personnel to identify all out-of-date documents either on the desktop or in print and to control them. The primary repository whether in print or electronic should be used each time a document is needed.
  • No core process mapped – map the sequence and interaction of processes.

Each of these while easily fixed are often looked over when a gap analysis is done by someone with little experience of the standard.

Clause 8 operations: where most manufacturers find the most gaps

Below is a list of common items identified during ISO 9001 gap analysis done by QMII:

  • Design and development controls (8.3) often skipped by manufacturers who think they don’t “design” anything, but engineering changes count
  • Control of externally provided processes/products (8.4) inadequate
  • Production and service provision (8.5), where work instructions as documented do not relfect actual practice
  • Control of nonconforming outputs (8.7), disposition process (use-as-is, rework, scrap) not always documented with authority sign-off and often missing a designated area for storage

Pro Tip: walk the actual production floor with the clause 8 checklist in hand rather than reviewing documents at a desk — gaps surface fastest this way

Gap Analysis vs Internal Audit: What’s the Difference and When to Use Each

Below is a handy reference on the difference between an ISO 9001 gap analysis and an internal audit.

  • Gap analysis = readiness check, usually done once before initial certification or major transition
  • Internal audit = ongoing, cyclical, required by clause 9.2 as part of maintaining certification. While the standard does not specify a frequency, mature organization do internal audits at least twice a year and sometimes more often.
  • Gap analysis can be broad-brush; internal audits require formal audit plans, trained iso 9001 lead auditor, and documented findings/CAPAs
  • Use gap analysis when: preparing for first certification, after a major QMS overhaul, after failed audit findings elsewhere or a major customer quality issue.
  • Use internal audit when: maintaining ongoing compliance, meeting the annual audit program requirement, preparing for surveillance audits

Key point: A gap analysis finding should feed into your first internal audit program, not replace it.

How to build a gap closure action plan with owners and deadlines

While the gap analysis is a good starting point failing to take actions timely can leave you too close to the project deadline with important issues unaddressed. Keep in mind that while the ISO project is important, the show must go on. As such personnel in an organization are being pulled in all directions to meet operational needs of getting the products and/or service out the door.

It is therefore imperative to get leadership involvement from the start of the project. For other personnel in the organization to know how important this is to leadership. To agree to deadlines mutually and identify verification methods to know actions items have been closed out effectively. Assign realistic deadlines based on complexity of the issue identified. For example, process redesign may take longer than a documentation fix.

For good measure the verifier must be someone other than the person who “fixed” it should confirm closure. Tie closure plan directly to the certification body’s audit date so there’s a hard deadline forcing prioritization.

Pro Tip: Recommend a weekly stand-up or tracker review cadence leading up to the audit date

FAQs

How long does a gap analysis take?

Typically, 2 days for a single-site SMB, depending on number of processes and whether it’s desk review only or includes floor walks. Larger or multi-site operations can take 1 week or more depending on the size of the sample chosen for the gap.

Who should conduct a gap analysis — internal team or external consultant?

  • Internal team: cheaper, deeper operational knowledge, but risk of blind spots/bias toward “we already do this”
  • External consultant: objective, benchmarked against many other clients, but costs money and takes time to onboard to your processes
  • Hybrid approach often works best: consultant-led framework, internal team fills in evidence

Can a gap analysis replace an internal audit?

No. A gap analysis is a one-time readiness check; internal audit is a mandatory recurring clause 9.2 requirement. Certification bodies will ask for internal audit records, not gap analysis reports, as objective evidence

What does a gap analysis report look like?

Typically, a spreadsheet or short report that includes clause-by-clause RAG score (or another methodology), evidence notes, gap descriptions, recommended actions, and an overall readiness percentage. Some consultants supplement it with an executive summary for leadership

How close do you need to be before scheduling a certification audit?

Rule of thumb: all Red-rated items closed, Amber items with an active action plan and target dates, before booking Stage 1.

—

About the Author:

Julius DeSilva is CEO of QMII (Quality Management International, Inc.), with more than 25 years of experience in quality management systems, maritime safety and security, and information security. A former seagoing officer and Exemplar Global Certified Lead Auditor (ISO 9001, ISO 27001, ISO 50001, RC14001), he has trained over 1,500 professionals as lead auditors and led consulting and auditing engagements across manufacturing, government, maritime, and aerospace sectors. He holds an MBA from the Darden School of Business, University of Virginia, and is an Associate Fellow of the Nautical Institute.

Procedure, Work Instruction, or Flowchart?

-by Dr. IJ Arora

The choice between writing a procedure or a work instruction is an essential decision when designing a management system. Clause 4.4.1 of ISO 9001:2015 (as well as all the ISO management system standards using the harmonized structure) requires the establishment and implementation of a management system. This management system will have procedures and work instructions and further down the hierarchy, checklists and forms.

Processes can be actualized in many forms. Today, mapped processes make it easy to visualize the functioning of the process. This is an important distinction in quality management systems based on ISO 9001—or for that matter any sector-specific standard like those dedicated to management within maritime, aerospace, etc. Many organizations struggle with when to write a procedure, when to write a work instruction, and how and when a flowchart should be used.

I think the core difference between a procedure and a work instruction is that a procedure answers the question, “What happens and who does it?” A procedure defines the process, its purpose, its sequence (clause 4.4.1b), and who is responsible for the work, perhaps as process owners (clause 4.4.1e). It answers what is to be done, when it must be done, who is responsible, and why it matters. The flowchart then helps visualize the inputs and outputs that flow between the steps.

What is a procedure and how it is used?

A procedure does not tell someone how to do a task; it simply describes the steps or stages necessary to accomplish it. I think of the procedure as the blueprint of the workflow. Therefore, I would recommend using the procedure when multiple people or departments are involved, when there is decision-making or sequencing, when the process crosses functional boundaries, and when documenting the process supports consistency, audits, or training. The procedure is also best when regulatory bodies expect clearly defined processes.

What is a work instruction and how is it used?

On the other hand, a work instruction shows stakeholders how exactly a task is to be accomplished. A work instruction “goes into the weeds” to the extent required by the workforce (depending on their confidence, competence, knowledge, and so on). It describes specific methods, often at a deep level of detail. It answers questions such as:

  • “How do I perform this task?”
  • “What tools, equipment, settings, forms, and/or software steps are required?”
  • “What are the acceptance criteria?”
  • “What do I check and how do I measure performance?”

Remember, work instructions are intended to be simple, direct documents for use by the workforce. Use them when:

  • A task requires technical, step-by-step details
  • Training new personnel
  • Incorrect execution can create quality or safety risks
  • Standardization is essential
  • Variation in execution must be eliminated

What is a flowchart and how is it used?

Flowcharts can technically be used to support both procedures and work instructions, but I generally recommend their use in conjunction with procedures. This helps make the procedure visual by mapping the 50,000-foot view of a process. A flowchart is ideal when the process has multiple decision points, parallel paths, several departments interacting, and inputs/outputs that must be made clear. The flowchart helps avoid the confusion that can come when procedures are described in long paragraphs. Flowcharts make complex processes easy to understand immediately. I therefore believe in flowcharting a procedure when the process needs high-level clarity, the sequence matters, when an organization wants to show interactions between departments, when it supports risk-based thinking, and when you want to simplify training for new personnel.

Flowcharts work best for document control, non-conformances, and corrective action processes, purchasing and supplier management, production scheduling, quality inspection, and testing flows and change management processes (as seen in clauses 5.3e, 6.3., 8.2.4, 8.3.6, and 8.5.6). Flowcharts do not replace work instructions; they complement them.

Final thoughts

To sum up how these tools work together, the practical document hierarchy an organization could consider starting with policy (and why that policy exists), move into documenting the procedure (preferably supported by a flowchart) to convey what happens and in what order, and then crafting work instructions to clarify how to carry out specific tasks. Finally, document everything through records and forms to provide evidence that the work was performed.

All this should connect as a system where a flowchart procedure should describe the process, a work instruction explains each critical task, and the documented information provides traceability. Performance monitoring (clause 9) can be documented via procedures, work instructions, and flowcharts.

 

Note – The above article was recently featured in an Exemplar Global publication ‘The Auditor’.