At one time getting certified to a standard, for example ISO 9001 was an event. Over the years it has become a prerequisite to being successful in business. That has brought in many consultants, many with quick ready-made solutions built around templates. I at QMII have been leading the QMII Team by them working using our methodology developed over forty plus years, of avoiding a template and starting by respecting the existing management system by capturing the “as-is” of the system and then developing the management system further to meet objectives. With forty plus years in consulting, auditing and training in the process-based management system approach I wonder why some companies fail their certification. I think a company may arrive at its first ISO 9001 certification audit with an impressive manual, signed policies and carefully arranged records, yet struggle to demonstrate that its management system works. The difficulty becomes visible when the auditor follows an actual customer order, asks how a changed requirement reached production, or examines what management did about a recurring complaint. The documents describe control; however, the evidence tells a different story.
The practical purpose of a quality management system is to help the organization consistently meet requirements and improve customer satisfaction. Certification provides independent assurance about that system. When the certificate becomes the primary objective, preparation can drift toward appearances. The more useful question is whether people can show how their processes deliver the intended results, recognize problems and improve. The system must show effectiveness.
This article uses ISO 9001:2026 and follows its Harmonized Structure (HS) through clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and continual improvement. The structure helps connect business needs to controls, results and learning; it does not require a company to organize its departments or procedures in clause order. The 2026 edition strengthens attention to quality culture, ethical behavior, strategy and the distinction between risks and opportunities. These changes sharpen the questions organizations should ask before their first certification audit. [1, 3]
Understand what failing the first audit means:
An initial certification audit normally has two stages. Stage 1 evaluates the organization’s preparedness for Stage 2, including its system documentation, scope and understanding of requirements. Stage 2 evaluates implementation and effectiveness. Treating Stage 1 as a paperwork formality can leave serious readiness concerns unresolved. [2]
A finding does not automatically mean that the company has failed. Major nonconformities require verified correction and corrective action before certification; for minor nonconformities, the certification body must review and accept the organization’s correction and corrective action plan. Certification follows a separate decision process. Here, “failure” means avoidable delay or inability to demonstrate conformity, not simply receiving any finding. Organizations must remember a Non-Conformity (NC) drives correction and corrective action (CA). [2]
Do not schedule the audit solely to satisfy a sales promise. Allow the system to operate sufficiently to produce credible evidence, evaluate performance and address weaknesses. ISO 9001 (as also other standards) does not prescribe a universal three-month operating period. The necessary evidence depends on the processes, their frequency and the certification arrangements.
Clause 4: The system does not reflect the actual business:
A generic context analysis may mention competition, technology and staffing without explaining their effects on quality (environment, security, health, safety and security, asset management, cyber security, food safety and the numerous other disciplines). Under clauses 4.1 and 4.2, context and relevant interested-party requirements should inform the system. A dependence on one specialist, a customer’s demanding approval conditions or an unreliable material source should influence planning and control. Completing a SWOT worksheet alone does not establish that connection.
Scope under clause 4.3 is another source of difficulty. An organization cannot declare a requirement inapplicable merely because it is inconvenient or performed externally. Consider a business that defines product specifications and commissions a contractor to complete the design. Outsourcing does not, by itself, remove design responsibility or justify treating clause 8.3 as inapplicable. The justification must reflect the organization’s actual responsibilities and its ability to provide conforming products and services.
Clause 4.4 requires attention to processes and their interactions. Departmental procedures may each look satisfactory while the handovers between sales, engineering, purchasing and delivery remain unreliable. Follow one real job across those boundaries. Establish what each process receives, what it delivers, who is accountable and how its effectiveness is evaluated. This is more revealing than checking whether every department has a procedure.
ISO 9001:2026 retains the climate considerations introduced in 2024, including a determination of whether climate change is a relevant issue under clause 4.1 and highlights potentially relevant interested-party requirements under 4.2. Determine which relevant interested-party requirements the QMS will address rather than merely listing stakeholders. For example, disruption to temperature-sensitive deliveries may matter to the QMS. A reasoned determination is needed; an environmental management system or carbon-reduction objective is not automatically required. [1, 3]
Clause 5: Leadership has delegated ownership of the system:
A quality manager can coordinate implementation, but top management retains accountability for the QMS’s effectiveness under clause 5.1.1. An auditor may ask a senior leader why a quality objective was selected, what is preventing its achievement and what resources have been committed. Referring every question to the quality department reveals a potential disconnect between management and the system.
Leadership is demonstrated through decisions. If sales repeatedly accept delivery dates that operations cannot meet, management must address how commitments are made. A signed quality policy does little to offset incentives that reward shipment regardless of conformity. The 2026 emphasis on quality culture and ethical behavior in clause 5.1 makes this especially pertinent. Would an employee feel able to report a defect honestly, or would pressure to meet a target encourage concealment? Under clause 5.2, the quality policy should connect to the organization’s context and strategic direction. [3] Customer focus under clause 5.1.2 should influence the decisions that create promises and the controls that ensure those promises can be fulfilled.
Under clause 5.3, responsibilities and authorities should be assigned, communicated and understood. A person responsible for product acceptance needs the authority to withhold release when requirements are unmet. Prepare leaders to explain actual decisions and results. Coaching them to recite policy language adds little assurance.
Clause 6: Planning produces registers rather than action:
A risk register may be complete while the organization continues to rely on uncontrolled assumptions. Clause 6.1 links risks and opportunities to planned action, integration into processes and evaluation of effectiveness. If reliance on a single supplier threatens delivery, recording a high-risk score is only the beginning. The organization might qualify an alternative, adjust stock arrangements or strengthen contingency planning, then assess whether the action reduced exposure.
ISO 9001 does not prescribe a risk register, a particular scoring matrix or a formal risk management methodology. The method should suit the business. The 2026 edition distinguishes actions addressing risks from actions addressing opportunities within clause 6.1. An opportunity deserves deliberate consideration: improved order-entry validation, for example, may reduce clarification delays and errors. Identify the beneficial result sought and evaluate the action taken; do not treat an opportunity as merely a low-risk score. [1] A longer register is not necessarily better planning.
Quality objectives under clause 6.2 need meaningful measures and plans for achievement. “Improve quality” gives little direction. Reducing order-entry errors from an established baseline, with an owner, resources, completion date and evaluation method, provides something management can act on. Missing an objective does not automatically establish a nonconformity; the auditor must consider the relevant requirement, planning, monitoring and response.
Changes require similar discipline under clause 6.3. Introducing new software, relocating work or replacing an experienced employee can alter the system. Consider the purpose, consequences, resources, responsibilities and integrity of the QMS, then plan implementation and evaluate the result. Communicate changes to the people affected. The 2026 revision strengthens change management; approving a change is not the same as demonstrating that it achieved its purpose. [4] A carefully prepared original system can become unreliable through poorly managed change.
Clause 7: Training and documentation are mistaken for capability:
Attendance records show that someone attended training. Clause 7.2 requires the organization to determine necessary competence; ensure people are competent and evaluate the effectiveness of actions taken to acquire competence. For an inspector, appropriate evidence might include observed performance, successful assessment and authorization for specified work. A course certificate alone may not establish the ability to make reliable acceptance decisions.
Awareness under clause 7.3 is also practical. Employees should understand how their work contributes to effectiveness and what can happen when requirements are not met. Ask a dispatch employee what happens when labeling instructions are unclear. Knowing where to seek clarification and when to stop is more useful than memorizing an ISO clause number. The 2026 awareness provisions also address quality culture and ethical behavior. Discuss real choices, such as recording an inspection honestly when a delivery deadline is at risk. [3]
Documented information under clause 7.5 must support work and be controlled. A shared electronic system is acceptable; printing every record is unnecessary. The important questions concern approval, access, revision, protection, retention and retrieval. A beautifully maintained master procedure offers little protection when an obsolete instruction remains in use at the workstation. The amount of documentation should reflect what is required to operate and demonstrate control, not the size of a purchased template package.
Resources also include organizational knowledge under clause 7.1.6 and suitable monitoring and measuring resources under 7.1.5. Do not stop at checking calibration labels. Where a measuring device is found unfit for its intended purpose, assess whether earlier results may have been affected and take appropriate action. Similarly, identify knowledge that would disappear if a key employee left. These weaknesses can undermine conformity despite complete training files.
Clause 8: Controls break down during real work:
Operational evidence is where an apparently complete system is tested most directly. Under clauses 8.2.2 and 8.2.3, the organization determines and reviews requirements before committing to supply. A purchase order acknowledgment is not necessarily evidence that technical, delivery and applicable statutory or regulatory requirements were adequately reviewed. Changes must also reach the people who need them under clause 8.2.4.
Consider a customer who changes a material specification after order acceptance. Sales records the change, but purchasing uses the original specification and receiving accepts the material against that outdated order. Each department can produce a record, yet the system has failed to carry the requirement through. This illustrates why an auditor follows transactions across functions instead of examining forms in isolation.
External-provider control under clause 8.4 requires more than an approved supplier list. The type and extent of control should reflect the effect of externally provided processes, products and services on conformity. Define what providers must deliver, how their performance is monitored and what triggers action. A provider’s ISO 9001 certificate can support evaluation; it does not eliminate the need for appropriate controls.
For production and service provision under clause 8.5, compare stated controls with practice on different shifts and at relevant locations. Where resulting outputs cannot be verified by subsequent monitoring or measurement, process validation becomes important under 8.5.1. Final inspection cannot compensate for every weakness in the process that creates the output.
Release under clause 8.6 should be supported by evidence that acceptance criteria have been met and by traceability to the authorizing person. Nonconforming outputs under 8.7 require control to prevent unintended use or delivery. An urgent shipment should not bypass these arrangements simply because a manager wants the order dispatched. After a correction, conformity must be verified; making the item look acceptable is insufficient.
Clause 9: Internal assurance is too superficial:
An internal audit that asks only whether documents exist can leave major weaknesses undiscovered. Clause 9.2 calls for information about both conformity and effective implementation and maintenance. Auditors need competence and arrangements that ensure objectivity and impartiality. A consultant’s implementation work does not automatically establish an impartial internal audit of that same work.
A useful audit follows evidence from requirement to result. Select an actual order, examine a changed requirement, test supplier controls and verify release. Include appropriate samples across the scope, considering process importance, changes and previous results. A clean audit report is valuable only if the sampling and evaluation justify its conclusions. The absence of findings is not itself proof of audit quality.
Performance evaluation under clause 9.1 should also go beyond producing dashboards. A company may report excellent on-time delivery while routinely changing promised dates after accepting orders. Clarify what the measure means and whether it reflects the customer’s experience. Customer satisfaction monitoring under 9.1.2 is broader than complaints alone; silence does not establish satisfaction.
Management review under clause 9.3 must use relevant inputs and produce decisions and actions. A brief meeting with the required headings, but no examination of trends or resource needs, may provide little evidence of effective review. Equally, a separate ceremonial “ISO meeting” is unnecessary if established management arrangements address the required inputs and outputs and retain the necessary evidence. Review should help management decide what to change and then follow through.
Clause 10: Problems are corrected without preventing recurrence:
Replacing a rejected component is a correction. Corrective action under clause 10.2 addresses the cause so that recurrence can be prevented. “Operator error” may describe an event without explaining why the system allowed it. Consider unclear criteria, unsuitable tools, conflicting instructions, workload, supervision and changes in the process before concluding that retraining is the answer.
The response should consider whether similar nonconformities exist or could occur elsewhere. If one workstation used an obsolete drawing, examine how drawings are controlled across the relevant operation. Replacing that single copy may resolve the immediate defect while leaving the underlying cause untouched.
Effectiveness needs evidence. Define what would show that the action worked, such as correct revision use across a meaningful sample of subsequent jobs. Closing an action because a procedure was revised verifies completion, not necessarily effectiveness. The depth of action should be proportionate to the effects of the nonconformity, and results should feed improvement under clause 10.1.
Make readiness a management decision:
Before committing to Stage 2, management should ask process owners to demonstrate a complete job, an important change and a resolved problem. Can they retrieve the relevant evidence, explain the controls and show the results? Have internal audits tested implementation? Has management review led to decisions? Have significant weaknesses been addressed and the effectiveness of corrective actions evaluated?
These are practical readiness tests, not additional ISO requirements. They bring the system back to its purpose. A first certification audit should examine an organization’s established way of managing its work. When people understand their responsibilities, controls operate in practice and management learns from evidence, certification becomes a credible recognition of that capability. The real achievement is a system that continues to work after the auditor leaves.
Conclusion:
The leadership in any organization should invest in their system demanding desired outputs. The audits should enable leadership to make better decisions and ensure planned resourcing. The QMS (quality management system) must help the organization consistently meet requirements and improve customer satisfaction, not just become certifiable. Purpose of a MS. Is not only to be auditable but to achieve the objectives. Certification provides independent assurance about that system. Making the certificate the primary objective is in a way a leadership failure. Leadership must motivate the employees to show their processes deliver the intended results, recognize problems and improve. The system must be effective. Certificates will follow and are important but not the primary aim of the MS.
__
About the Author
Inderjit (IJ) Arora, Ph.D., is the Chairman of QMII. He serves as a team leader for consulting, advising, auditing, and training regarding management systems. He has conducted many courses for the United States Coast Guard and is a popular speaker at several universities and forums on management systems. Arora is a Master Mariner who holds a Ph.D., a master’s degree, an MBA, and has a 35-year record of achievement in the military, mercantile marine, and civilian industry.
