ISO 9001:2026 Explained for Auditors & Managers.

Practical guidance on Quality Management Systems (QMS)

ISO 9001:2026 explained in plain English for internal auditors, lead auditors, quality managers and people who want their Quality Management System to make a real difference.

This free guide from the Scottish Quality Management Centre is designed to support learners before, during and after our ISO 9001 auditor courses. It explains what the Standard is trying to achieve, how its requirements connect to everyday work, and what auditors should look for when gathering evidence.

Think of it as your map through the requirements — not another set of paperwork to maintain. Our approach is simple: learn quality simply, then put it to work.

Jump to ISO 9001 FAQs ↓

Contents

1. Background to QMS and ISO 9001
2. The seven quality management principles
3. The process approach and PDCA
4. The role of the QMS auditor
5. First-, second- and third-party audits
6. How to use this manual
7. How to use Annex A guidance
8. Quick clause map
9. Clause 1 — Scope
10. Clause 2 — Normative references
11. Clause 3 — Terms and definitions
12. Clause 4 — Context of the organisation
13. Clause 5 — Leadership
14. Clause 6 — Planning
15. Clause 7 — Support
16. Clause 8 — Operation
17. Clause 9 — Performance evaluation
18. Clause 10 — Improvement
19. Practical Auditor Toolkit
20. ISO 9001 FAQs

Background to QMS and ISO 9001

What is a Quality Management System?

A Quality Management System (QMS) is the organised way a business or other organisation makes sure it can consistently deliver what it has promised. It connects people, processes, responsibilities, resources and checks so that products and services meet requirements and customers can rely on the results.

For a manufacturer, that might mean getting the specification right, controlling production, checking the finished product and dealing properly with defects. For a service provider, it might mean understanding the customer's needs, allocating competent people, delivering the service as agreed and learning from feedback.

A useful QMS is not a set of folders labelled “Quality”. It is how the organisation works, supported by sensible controls and reliable information.

What is ISO 9001?

ISO 9001 is the internationally recognised requirements standard for Quality Management Systems. Organisations of different sizes and sectors can use it to improve consistency, meet customer and applicable legal requirements, manage risks and opportunities, and improve customer satisfaction.

ISO 9001:2026 is the sixth edition. Among its notable developments are clearer treatment of risks and opportunities, greater emphasis on quality culture and ethical behaviour, and more explicit expectations for managing change. The process approach, customer focus and continual improvement remain central.

Back to top ↑

The seven quality management principles

ISO 9001 is built on seven principles that explain the thinking behind the requirements. They're worth remembering because they help auditors look beyond a clause number and understand what an effective QMS should achieve.

1. Customer focus: Understand needs, deliver what was agreed and work to enhance customer satisfaction.
2. Leadership: Set a clear direction and make quality part of management decisions.
3. Engagement of people: Make sure people understand their contribution and have the ability and confidence to do the job well.
4. Process approach: Manage connected activities as processes, not isolated departments.
5. Improvement: Learn from performance, changes, problems and ideas, then make things better.
6. Evidence-based decision-making: Use relevant, trustworthy information rather than assumptions.
7. Relationship management: Work constructively with suppliers and other interested parties that affect results.

Auditors don't normally raise nonconformities against the principles themselves. Instead, the principles help them interpret the requirements in Clauses 4–10 and test whether the system is achieving its intended results.

Back to top ↑

The process approach and PDCA

Think in processes, not filing cabinets

A process takes inputs, carries out activities and produces an intended result. The output of one process often becomes an input to another. An order-handling process, for example, may pass an agreed specification to purchasing, scheduling and delivery. If the handover fails, the customer may receive the wrong result — even if each department's own paperwork looks tidy.

When auditing a process, a useful starting sequence is:

1. What result is this process meant to produce?
2. What information, materials or resources does it need?
3. Who is responsible, and where are the handovers?
4. What could prevent it from working, and what could make it better?
5. How is it controlled and measured?
6. What happens when things go wrong?

Plan–Do–Check–Act (PDCA)

• Plan: Understand the organisation, set objectives, address risks and opportunities, and decide what is needed.
• Do: Provide the support and operate the processes needed to deliver products and services.
• Check: Monitor results, evaluate customer satisfaction, carry out internal audits and conduct management reviews.
• Act: Correct problems, address causes and improve the QMS.

PDCA works at the whole-system level and within individual processes. Internal audit sits mainly in Check, but good audit results also help the organisation Act and plan better next time.

Back to top ↑

The role of the ISO 9001 auditor

An ISO 9001 auditor evaluates objective evidence against defined audit criteria. In practical terms, the auditor wants to know whether the QMS meets the applicable requirements, is being followed and is working effectively.

Audit evidence can come from talking to people, watching work, examining records, following transactions, reviewing system data and comparing what different sources reveal. A confident answer is helpful, but it isn't necessarily enough on its own.

ISO 19011:2026 provides practical guidance on planning and conducting management system audits, including on-site, remote and combined methods. The method should suit the audit objectives, risks and access to reliable evidence — not simply what is most convenient. Confidentiality, impartiality and verifiable evidence still matter whichever method is used.

What good internal auditors do

• agree the audit objectives, scope and criteria before starting;
• understand the process and its effect on customers or other processes;
• ask open, fair questions and follow the evidence;
• sample sensibly rather than trying to inspect everything;
• identify both conformity and evidence-based nonconformities;
• write findings that are specific, balanced and useful;
• remain impartial and avoid auditing their own work where this compromises objectivity.

The auditor is not there to catch people out

A good audit gives the organisation useful assurance. It also helps people understand whether processes are controlled, where weaknesses may exist and where improvement is needed. Auditors should not invent extra rules, prescribe a favourite template or confuse their own preferences with requirements.

For a deeper guide, we'll add ISO 9001 audit evidence, sampling and findings to the Auditor Toolkit.

Back to top ↑

First-party, second-party and third-party audits

First-party audits — internal audits

These are carried out by the organisation itself or on its behalf. They help management understand whether its own QMS and processes meet requirements and are effective. This is the focus of SQMC's Internal Auditor training.

Second-party audits — supplier audits

These are typically performed by a customer, or someone acting for a customer, to assess a supplier or other external provider. For example, a manufacturer may audit a subcontractor carrying out a critical process that influences the finished product.

Third-party audits — independent audits

These are carried out by an independent body, commonly for certification. A certification audit is different from the organisation's own internal audit, although both depend on fair evaluation of evidence against agreed criteria.

Lead auditors may also be responsible for managing an audit team, its planning, communications and conclusions. The underlying habits — impartiality, sound evidence and professional conduct — are shared by all auditors.

Back to top ↑

How to use this manual

Start here for the big picture. The clause summaries below are designed to be useful during a course and when preparing or carrying out an audit. They explain intent, likely audit trails and questions to consider.

In the expanded December edition, the clause headings will lead to dedicated overview pages, and those pages will lead to detailed explainers. The Auditor Toolkit will contain practical guidance that can be used across several clauses.

Important: This manual is SQMC's explanation of ISO 9001:2026. It is not a replacement for the published standard. The applicable requirements in the standard, together with the organisation's own relevant requirements, are the audit criteria.

Back to top ↑

How to use Annex A guidance

ISO 9001:2026 includes an informative Annex A that clarifies terminology, structure and how certain requirements should be understood. It helps avoid common misunderstandings; it does not create additional requirements for auditors to enforce.

For example, the annex explains why an organisation's documents need not follow the clause structure of ISO 9001, why the words appropriate and applicable have different meanings, and how to understand the difference between considering something and taking it into account.

We will draw on Annex A throughout the full guide, but our findings will always be grounded in the auditable requirements and the organisation's own applicable criteria.

Back to top ↑

Quick clause map

The ten clauses are easier to remember when you see what each contributes. The headings below take you to the summaries on this page. The dedicated clause guides are listed alongside but will be available in the expanded edition.

Back to top ↑

Clause 1 — Scope

What is it trying to achieve?

Clause 1 explains the purpose and applicability of ISO 9001. It can be used by organisations of any size or sector seeking to supply products and services consistently, meet customer and relevant legal requirements, and enhance customer satisfaction.

This is different from Clause 4.3, where an individual organisation defines the boundaries of its own QMS.

Auditor perspective

Don't assume a small business needs a small version of quality, or that a service organisation must copy a factory's paperwork. The method should suit the organisation; applicable requirements still need to be fulfilled.

Back to top ↑

Clause 2 — Normative references

What is it trying to achieve?

Clause 2 identifies documents formally referenced as part of the requirements. For ISO 9001:2026, ISO 9000, Quality management — Fundamentals and vocabulary, is the normative reference.

That's worth noticing: unlike ISO 14001:2026, ISO 9001 does have a normative reference. ISO 9000 provides the broader quality-management language that supports correct interpretation of ISO 9001.

SQMC tip: ISO 19011:2026 offers helpful guidance on auditing management systems. ISO 9001:2026 points to it in a note to Clause 9.2, but it is not a normative reference in Clause 2 and does not add extra ISO 9001 requirements.

Back to top ↑

Clause 3 — Terms and definitions

Why does this matter to auditors?

Words such as requirement, conformity and corrective action are easy to use casually. In an audit they have specific meanings, and getting them mixed up can lead to poor findings.

• Requirement: Something that must, is expected to, or has been agreed to be met.
• Process: Connected activities that use inputs to achieve an intended result.
• Conformity: A requirement has been fulfilled.
• Nonconformity: A requirement has not been fulfilled.
• Corrective action: Action directed at the cause of a nonconformity, to prevent it happening again.
• Documented information: Information that needs to be managed and controlled, including working documents and evidence of results.
• Effectiveness: Whether planned actions were actually carried out and intended results achieved.

Clause 3 contains selected management-system definitions, while ISO 9000 remains the wider source for quality-management terminology.

Back to top ↑

Clause 4 — Context of the organisation

What is Clause 4 trying to achieve?

Clause 4 establishes the foundation. Before a QMS can work well, the organisation needs to understand its circumstances, the people and organisations that matter to it, what the system covers and which processes are needed to deliver results.

Subclause guide

• 4.1: Understanding the organisation and its context — internal and external issues, including whether climate change is relevant.
• 4.2: Interested parties — whose relevant requirements matter, and which are addressed through the QMS.
• 4.3: Determining the QMS scope — boundaries, products, services and justified non-applicability.
• 4.4: The QMS and its processes — inputs, outputs, interactions, responsibilities, controls and performance.

Why context matters

A QMS should fit the real business. A training provider working with associate tutors, for example, needs to understand competence, course requirements, scheduling, outsourced delivery and the effect of customer feedback. A manufacturer may be more concerned with material availability, machine capability, traceability and product specifications.

Climate change is specifically considered in Clause 4.1, but the requirement is to determine whether it is relevant — not to assume that it creates the same issue for every organisation.

What auditors typically look for

• context and interested parties reflected in actual decisions, not just a generic table;
• a clear QMS scope, with any non-applicability properly justified;
• processes identified, connected, resourced, monitored and improved;
• evidence that issues and relevant requirements are reviewed as circumstances change.

Useful audit questions

What has changed in the organisation or its market? Which requirements have the biggest effect on your customers? Could you walk me through an order or service from initial enquiry to completion? How do you know the handovers work?

For more depth: ISO 9001 Clause 4 — Context explained.

Back to top ↑

Clause 5 — Leadership

What is Clause 5 trying to achieve?

Clause 5 makes quality a leadership responsibility rather than something handed to the Quality Manager and forgotten. Senior management sets direction, promotes customer focus, provides support and is accountable for whether the QMS works.

Subclause guide

• 5.1: Leadership and commitment — including the 2026 emphasis on quality culture and ethical behaviour.
• 5.1.2: Customer focus — understanding and meeting requirements and enhancing satisfaction.
• 5.2: Quality policy — a useful direction for the organisation and its objectives.
• 5.3: Roles, responsibilities and authorities — who is accountable for what.

Why leadership matters

Quality culture becomes visible in ordinary decisions. If people feel pushed to hide defects to meet a deadline, a framed policy on the wall will not put that right. If leaders encourage honest reporting, understand problems and make sensible decisions about resources, the system has a much stronger chance of succeeding.

What auditors typically look for

• management decisions that demonstrate customer focus and quality priorities;
• people understanding the policy and their own responsibilities;
• quality objectives connected to business direction;
• leaders supporting openness, ethical decisions and improvement;
• management review and process performance influencing real action.

Useful audit questions

How do leaders know what customers need? What happens when quality and delivery targets conflict? How is a concern raised without blame? Can you show a recent management decision that improved a process?

For more depth: ISO 9001 Clause 5 — Leadership explained.

Back to top ↑

Clause 6 — Planning

What is Clause 6 trying to achieve?

Planning turns understanding and leadership into purposeful action. The organisation needs to consider what could stop it delivering good results, what opportunities could improve them, which objectives matter and how changes will be controlled.

Subclause guide

• 6.1.1: Determining risks and opportunities — understanding what needs to be addressed.
• 6.1.2: Actions to address risks — identifying, analysing, evaluating and managing unwanted effects.
• 6.1.3: Actions to address opportunities — assessing and pursuing potential benefits.
• 6.2: Quality objectives — meaningful, measurable aims and plans to achieve them.
• 6.3: Planning of changes — deciding how change will be implemented, communicated and reviewed.

What's different in the 2026 edition?

Actions for risks and opportunities now receive distinct treatment. That helps auditors test both sides: how the organisation protects its ability to deliver conforming products and services, and how it acts on promising improvements. The revision also makes the planning, communication, monitoring and review of QMS changes more explicit.

A risk register or scoring matrix might be useful, but ISO 9001 does not require every organisation to adopt a particular template. What matters is whether suitable actions have been planned, put into relevant processes and evaluated.

What auditors typically look for

• risks and opportunities linked to context, processes and customers;
• proportionate actions that actually influence how work is done;
• quality objectives with owners, resources, timescales and performance evidence;
• planned changes reviewed for consequences, responsibilities and effectiveness.

Useful audit questions

What might prevent this process from meeting its intended result? What have you done about it, and did it work? What opportunities have you acted upon? When something changes, how do you protect quality while the change is introduced?

For more depth: ISO 9001 Clause 6 — Planning explained.

Back to top ↑

Clause 7 — Support

What is Clause 7 trying to achieve?

Clause 7 provides the foundations needed for everything else to happen: enough people, suitable resources, reliable information, the right knowledge and competence, and clear communication.

Subclause guide

• 7.1: Resources — people, infrastructure and a suitable working environment.
• 7.1.5: Monitoring and measuring resources — reliable checks and, where required, traceable measurement results.
• 7.1.6: Organisational knowledge — retaining, sharing and updating important know-how.
• 7.2: Competence — the ability to do work that affects QMS performance.
• 7.3: Awareness — including relevant quality objectives, culture and ethical behaviour.
• 7.4: Communication — what is communicated, by whom, when and how.
• 7.5: Documented information — keeping the right information available, usable and controlled.

Why support matters

Well-designed processes can still fail when employees are stretched, equipment is unsuitable, knowledge is lost, or outdated instructions remain in use. The 2026 edition also connects the working environment and awareness more clearly to quality culture and ethical behaviour.

Don't confuse competence with attendance at a training course. Auditors should consider whether people can achieve the intended results. Equally, not every measuring instrument needs calibration to the same degree; the requirements depend on its purpose and whether measurement traceability is necessary.

What auditors typically look for

• resources and infrastructure suitable for the required output;
• competence evidence supported by observation of work;
• critical knowledge available beyond one person's memory;
• documents and records current, accessible and protected;
• communication and awareness demonstrated in practice.

Useful audit questions

How do you know someone is competent to carry out this work? What happens if the experienced person is absent? Are these instructions the current version? How do you know this measurement can be trusted?

For more depth: ISO 9001 Clause 7 — Support explained.

Back to top ↑

Clause 8 — Operation

What is Clause 8 trying to achieve?

Clause 8 is where the QMS meets the customer. It covers the journey from understanding requirements to designing, purchasing, making or delivering, checking and releasing products and services — and controlling outputs when they do not meet requirements.

Subclause guide

• 8.1: Operational planning and control — deciding what is required and how work will be controlled.
• 8.2: Requirements for products and services — communication, understanding requirements, review and change.
• 8.2.3: Review of customer requirements — checking the organisation can deliver before making a commitment.
• 8.3: Design and development — planning, inputs, outputs and changes.
• 8.3.4: Design and development controls — reviews, verification and validation.
• 8.4: Control of external providers — managing purchased and outsourced provision.
• 8.4.2: Type and extent of external-provider control — control proportionate to the effect on conformity.
• 8.5: Production and service provision — doing the work under suitable controls.
• 8.5.1: Controlled production and service delivery — instructions, competence, monitoring and safeguards.
• 8.5.6: Control of operational changes — preventing unintended effects during delivery.
• 8.6: Release of products and services — checking acceptance requirements before release.
• 8.7: Control of nonconforming outputs — preventing unintended use or delivery when requirements are not met.

Why operation matters

An organisation can have excellent objectives and attractive policies, but if it accepts an order it cannot fulfil, sends the wrong specification to a supplier or releases an unchecked product, the customer experiences the result. Clause 8 is where processes must work in reality.

For a training business, an audit trail might begin with an enquiry, follow the quotation and booking, confirm tutor competence and materials, observe delivery arrangements and examine feedback and certification. For a manufacturer, it might follow a customer order through design, purchasing, production, inspection and dispatch.

Not every organisation designs products or services. Where a requirement is genuinely not applicable, that decision must be justified in the QMS scope rather than assumed because the business is small or service-based.

What auditors typically look for

• customer and legal requirements understood before commitments are made;
• planned controls and clear acceptance criteria for relevant activities;
• design and outsourced processes properly controlled where applicable;
• competent people, suitable equipment, appropriate instructions and checks;
• traceability, preservation, customer property and post-delivery controls where needed;
• reliable release decisions and controls for nonconforming outputs.

Useful audit questions

Can we follow one actual order from enquiry to delivery? Who checked that the customer's requirements could be met? What does acceptance look like? How are suppliers selected and checked? What happens if a problem is found after delivery?

For more depth: ISO 9001 Clause 8 — Operation explained.

Back to top ↑

Clause 9 — Performance evaluation

What is Clause 9 trying to achieve?

Clause 9 asks the organisation to check whether the QMS is achieving what it is meant to achieve. That means using information about processes, product and service conformity, customer satisfaction and other results — then auditing and reviewing the system.

Subclause guide

• 9.1: Monitoring, measurement, analysis and evaluation — selecting information that shows how the QMS is performing.
• 9.1.2: Customer satisfaction — gathering and reviewing information on customers' views.
• 9.2: Internal audit — planned, objective audits that give management useful information.
• 9.3: Management review — senior management reviewing suitability, effectiveness, resources and improvement needs.

Why performance evaluation matters

Measuring everything is no better than measuring nothing if the results aren't useful. A sensible QMS chooses information that helps it judge performance and make decisions: for example, delivery reliability, repeat defects, customer complaints, supplier performance, audit findings or service rework.

The internal audit programme should consider the importance of processes, previous audit results and changes affecting the organisation. It need not follow the same routine every year simply because it always has.

Auditor tip: ISO 19011:2026 develops the guidance on managing audit programmes and choosing appropriate audit methods, including remote auditing. This can help an auditor plan sensibly, but the actual ISO 9001 internal audit requirements remain in Clause 9.2.

What auditors typically look for

• meaningful monitoring, analysis and evaluation rather than data collected without purpose;
• customer satisfaction information from appropriate sources, not necessarily surveys alone;
• an audit programme with suitable frequency, scope, criteria and impartial auditors;
• audit results reaching relevant managers and leading to timely action;
• management review decisions with traceable actions and resources.

Useful audit questions

Which measures best show whether this process is working? What are customers telling you? Why did you select this audit frequency? What has management changed as a result of performance data or audits?

For more depth: ISO 9001 Clause 9 — Performance evaluation explained.

Back to top ↑

Clause 10 — Improvement

What is Clause 10 trying to achieve?

Clause 10 is about learning, correcting weaknesses and improving the QMS. Problems should not be hidden or repeatedly patched over; the organisation should understand what went wrong and decide what will prevent a repeat.

Subclause guide

• 10.1: Continual improvement — using evidence and review to improve processes, products and services.
• 10.2: Nonconformity and corrective action — dealing with problems, their causes and their consequences.

Correction is not the same as corrective action

If an organisation sends a customer the wrong item, sending the correct item is a correction. Understanding why the error happened, then changing the picking or checking process to prevent recurrence, may be corrective action. Both have their place.

The 2026 edition ends at 10.2. Continual improvement sits at 10.1; don't rely on old 2015 clause numbers when preparing an audit plan.

What auditors typically look for

• problems and customer complaints investigated and appropriately controlled;
• causes and similar potential failures considered where necessary;
• action proportionate to the consequences;
• evidence that corrective action worked;
• lessons feeding into risks, opportunities, processes and management review.

Useful audit questions

What was done immediately? How was the cause investigated? Could the same thing happen elsewhere? How did you check the action worked? What did the organisation learn?

For more depth: ISO 9001 Clause 10 — Improvement explained.

Back to top ↑

Practical Auditor Toolkit

The expanded library will include four practical resources to support actual QMS audits, not just understanding the Standard:

• Audit evidence, sampling and findings — finding reliable evidence and writing clear conclusions.
• Audit programme template — planning internal audits around the processes and risks that matter.
• Process approach and audit trails — following work across departments and handovers.
• ISO 9001:2026 changes for auditors — a focused explanation of the main differences from the previous edition.

A small audit exercise you can use right now

Choose one completed job, order or service. Ask to see its original requirements, the checks made before accepting it, who carried out the work, any purchasing or other handovers, the evidence of verification and the outcome for the customer. Follow the trail and ask: did the process deliver what it was meant to deliver?

That's often more revealing than trying to ask someone 40 disconnected questions from a clause checklist.

Back to top ↑

Friendly SQMC reminder!

The Scottish Quality Management Centre encourages auditors to be practical, fair and evidence-based. A strong QMS audit is not about catching people out. It is about helping the organisation understand whether its processes are working, whether customer requirements are being met, and where improvement is needed.

Use this manual alongside SQMC course activities, the Auditor Toolkit and your organisation's own QMS arrangements. The best auditors keep learning, keep asking better questions, and keep linking evidence back to what matters: good, consistent results for customers.

ISO 9001:2026 for Auditors — FAQs

Back to top ↑