This free guide from the Scottish Quality Management Centre is designed to support learners before, during and after our ISO 9001 auditor courses. It explains what the Standard is trying to achieve, how its requirements connect to everyday work, and what auditors should look for when gathering evidence.
Think of it as your map through the requirements — not another set of paperwork to maintain. Our approach is simple: learn quality simply, then put it to work.
Issue 1 — November 2026. This first edition is ready to support SQMC's current Internal Auditor course. It includes the complete main guide and working on-page navigation; the detailed clause explainers and Auditor Toolkit pages are being developed. Check back in December for the expanded version of this guide.
A Quality Management System (QMS) is the organised way a business or other organisation makes sure it can consistently deliver what it has promised. It connects people, processes, responsibilities, resources and checks so that products and services meet requirements and customers can rely on the results.
For a manufacturer, that might mean getting the specification right, controlling production, checking the finished product and dealing properly with defects. For a service provider, it might mean understanding the customer's needs, allocating competent people, delivering the service as agreed and learning from feedback.
A useful QMS is not a set of folders labelled “Quality”. It is how the organisation works, supported by sensible controls and reliable information.
ISO 9001 is the internationally recognised requirements standard for Quality Management Systems. Organisations of different sizes and sectors can use it to improve consistency, meet customer and applicable legal requirements, manage risks and opportunities, and improve customer satisfaction.
ISO 9001:2026 is the sixth edition. Among its notable developments are clearer treatment of risks and opportunities, greater emphasis on quality culture and ethical behaviour, and more explicit expectations for managing change. The process approach, customer focus and continual improvement remain central.
SQMC view: Quality is not about producing impressive procedures. It's about understanding what good looks like, making it happen consistently, recognising when it hasn't happened and improving the way work gets done.
ISO 9001 is built on seven principles that explain the thinking behind the requirements. They're worth remembering because they help auditors look beyond a clause number and understand what an effective QMS should achieve.
Auditors don't normally raise nonconformities against the principles themselves. Instead, the principles help them interpret the requirements in Clauses 4–10 and test whether the system is achieving its intended results.
A process takes inputs, carries out activities and produces an intended result. The output of one process often becomes an input to another. An order-handling process, for example, may pass an agreed specification to purchasing, scheduling and delivery. If the handover fails, the customer may receive the wrong result — even if each department's own paperwork looks tidy.
When auditing a process, a useful starting sequence is:
PDCA works at the whole-system level and within individual processes. Internal audit sits mainly in Check, but good audit results also help the organisation Act and plan better next time.
An ISO 9001 auditor evaluates objective evidence against defined audit criteria. In practical terms, the auditor wants to know whether the QMS meets the applicable requirements, is being followed and is working effectively.
Audit evidence can come from talking to people, watching work, examining records, following transactions, reviewing system data and comparing what different sources reveal. A confident answer is helpful, but it isn't necessarily enough on its own.
ISO 19011:2026 provides practical guidance on planning and conducting management system audits, including on-site, remote and combined methods. The method should suit the audit objectives, risks and access to reliable evidence — not simply what is most convenient. Confidentiality, impartiality and verifiable evidence still matter whichever method is used.
A good audit gives the organisation useful assurance. It also helps people understand whether processes are controlled, where weaknesses may exist and where improvement is needed. Auditors should not invent extra rules, prescribe a favourite template or confuse their own preferences with requirements.
For a deeper guide, we'll add ISO 9001 audit evidence, sampling and findings to the Auditor Toolkit.
These are carried out by the organisation itself or on its behalf. They help management understand whether its own QMS and processes meet requirements and are effective. This is the focus of SQMC's Internal Auditor training.
These are typically performed by a customer, or someone acting for a customer, to assess a supplier or other external provider. For example, a manufacturer may audit a subcontractor carrying out a critical process that influences the finished product.
These are carried out by an independent body, commonly for certification. A certification audit is different from the organisation's own internal audit, although both depend on fair evaluation of evidence against agreed criteria.
Lead auditors may also be responsible for managing an audit team, its planning, communications and conclusions. The underlying habits — impartiality, sound evidence and professional conduct — are shared by all auditors.
Start here for the big picture. The clause summaries below are designed to be useful during a course and when preparing or carrying out an audit. They explain intent, likely audit trails and questions to consider.
In the expanded December edition, the clause headings will lead to dedicated overview pages, and those pages will lead to detailed explainers. The Auditor Toolkit will contain practical guidance that can be used across several clauses.
Important: This manual is SQMC's explanation of ISO 9001:2026. It is not a replacement for the published standard. The applicable requirements in the standard, together with the organisation's own relevant requirements, are the audit criteria.
ISO 9001:2026 includes an informative Annex A that clarifies terminology, structure and how certain requirements should be understood. It helps avoid common misunderstandings; it does not create additional requirements for auditors to enforce.
For example, the annex explains why an organisation's documents need not follow the clause structure of ISO 9001, why the words appropriate and applicable have different meanings, and how to understand the difference between considering something and taking it into account.
We will draw on Annex A throughout the full guide, but our findings will always be grounded in the auditable requirements and the organisation's own applicable criteria.
The ten clauses are easier to remember when you see what each contributes. The headings below take you to the summaries on this page. The dedicated clause guides are listed alongside but will be available in the expanded edition.
| Clause | Plain-English purpose |
|---|---|
| 1–3 | Purpose, formal references and terminology |
| 4 — Context | Know the organisation and its processes |
| 5 — Leadership | Set direction, responsibility and customer focus |
| 6 — Planning | Address risks and opportunities, set objectives, manage change |
| 7 — Support | Provide people, resources, knowledge and information |
| 8 — Operation | Plan, deliver and control products and services |
| 9 — Performance evaluation | Check results through data, audits and review |
| 10 — Improvement | Learn, correct and improve |
Clause 1 explains the purpose and applicability of ISO 9001. It can be used by organisations of any size or sector seeking to supply products and services consistently, meet customer and relevant legal requirements, and enhance customer satisfaction.
This is different from Clause 4.3, where an individual organisation defines the boundaries of its own QMS.
Don't assume a small business needs a small version of quality, or that a service organisation must copy a factory's paperwork. The method should suit the organisation; applicable requirements still need to be fulfilled.
Clause 2 identifies documents formally referenced as part of the requirements. For ISO 9001:2026, ISO 9000, Quality management — Fundamentals and vocabulary, is the normative reference.
That's worth noticing: unlike ISO 14001:2026, ISO 9001 does have a normative reference. ISO 9000 provides the broader quality-management language that supports correct interpretation of ISO 9001.
SQMC tip: ISO 19011:2026 offers helpful guidance on auditing management systems. ISO 9001:2026 points to it in a note to Clause 9.2, but it is not a normative reference in Clause 2 and does not add extra ISO 9001 requirements.
Words such as requirement, conformity and corrective action are easy to use casually. In an audit they have specific meanings, and getting them mixed up can lead to poor findings.
Clause 3 contains selected management-system definitions, while ISO 9000 remains the wider source for quality-management terminology.
Clause 4 establishes the foundation. Before a QMS can work well, the organisation needs to understand its circumstances, the people and organisations that matter to it, what the system covers and which processes are needed to deliver results.
A QMS should fit the real business. A training provider working with associate tutors, for example, needs to understand competence, course requirements, scheduling, outsourced delivery and the effect of customer feedback. A manufacturer may be more concerned with material availability, machine capability, traceability and product specifications.
Climate change is specifically considered in Clause 4.1, but the requirement is to determine whether it is relevant — not to assume that it creates the same issue for every organisation.
What has changed in the organisation or its market? Which requirements have the biggest effect on your customers? Could you walk me through an order or service from initial enquiry to completion? How do you know the handovers work?
For more depth: ISO 9001 Clause 4 — Context explained.
Clause 5 makes quality a leadership responsibility rather than something handed to the Quality Manager and forgotten. Senior management sets direction, promotes customer focus, provides support and is accountable for whether the QMS works.
Quality culture becomes visible in ordinary decisions. If people feel pushed to hide defects to meet a deadline, a framed policy on the wall will not put that right. If leaders encourage honest reporting, understand problems and make sensible decisions about resources, the system has a much stronger chance of succeeding.
How do leaders know what customers need? What happens when quality and delivery targets conflict? How is a concern raised without blame? Can you show a recent management decision that improved a process?
For more depth: ISO 9001 Clause 5 — Leadership explained.
Planning turns understanding and leadership into purposeful action. The organisation needs to consider what could stop it delivering good results, what opportunities could improve them, which objectives matter and how changes will be controlled.
Actions for risks and opportunities now receive distinct treatment. That helps auditors test both sides: how the organisation protects its ability to deliver conforming products and services, and how it acts on promising improvements. The revision also makes the planning, communication, monitoring and review of QMS changes more explicit.
A risk register or scoring matrix might be useful, but ISO 9001 does not require every organisation to adopt a particular template. What matters is whether suitable actions have been planned, put into relevant processes and evaluated.
What might prevent this process from meeting its intended result? What have you done about it, and did it work? What opportunities have you acted upon? When something changes, how do you protect quality while the change is introduced?
For more depth: ISO 9001 Clause 6 — Planning explained.
Clause 7 provides the foundations needed for everything else to happen: enough people, suitable resources, reliable information, the right knowledge and competence, and clear communication.
Well-designed processes can still fail when employees are stretched, equipment is unsuitable, knowledge is lost, or outdated instructions remain in use. The 2026 edition also connects the working environment and awareness more clearly to quality culture and ethical behaviour.
Don't confuse competence with attendance at a training course. Auditors should consider whether people can achieve the intended results. Equally, not every measuring instrument needs calibration to the same degree; the requirements depend on its purpose and whether measurement traceability is necessary.
How do you know someone is competent to carry out this work? What happens if the experienced person is absent? Are these instructions the current version? How do you know this measurement can be trusted?
For more depth: ISO 9001 Clause 7 — Support explained.
Clause 8 is where the QMS meets the customer. It covers the journey from understanding requirements to designing, purchasing, making or delivering, checking and releasing products and services — and controlling outputs when they do not meet requirements.
An organisation can have excellent objectives and attractive policies, but if it accepts an order it cannot fulfil, sends the wrong specification to a supplier or releases an unchecked product, the customer experiences the result. Clause 8 is where processes must work in reality.
For a training business, an audit trail might begin with an enquiry, follow the quotation and booking, confirm tutor competence and materials, observe delivery arrangements and examine feedback and certification. For a manufacturer, it might follow a customer order through design, purchasing, production, inspection and dispatch.
Not every organisation designs products or services. Where a requirement is genuinely not applicable, that decision must be justified in the QMS scope rather than assumed because the business is small or service-based.
Can we follow one actual order from enquiry to delivery? Who checked that the customer's requirements could be met? What does acceptance look like? How are suppliers selected and checked? What happens if a problem is found after delivery?
For more depth: ISO 9001 Clause 8 — Operation explained.
Clause 9 asks the organisation to check whether the QMS is achieving what it is meant to achieve. That means using information about processes, product and service conformity, customer satisfaction and other results — then auditing and reviewing the system.
Measuring everything is no better than measuring nothing if the results aren't useful. A sensible QMS chooses information that helps it judge performance and make decisions: for example, delivery reliability, repeat defects, customer complaints, supplier performance, audit findings or service rework.
The internal audit programme should consider the importance of processes, previous audit results and changes affecting the organisation. It need not follow the same routine every year simply because it always has.
Auditor tip: ISO 19011:2026 develops the guidance on managing audit programmes and choosing appropriate audit methods, including remote auditing. This can help an auditor plan sensibly, but the actual ISO 9001 internal audit requirements remain in Clause 9.2.
Which measures best show whether this process is working? What are customers telling you? Why did you select this audit frequency? What has management changed as a result of performance data or audits?
For more depth: ISO 9001 Clause 9 — Performance evaluation explained.
Clause 10 is about learning, correcting weaknesses and improving the QMS. Problems should not be hidden or repeatedly patched over; the organisation should understand what went wrong and decide what will prevent a repeat.
If an organisation sends a customer the wrong item, sending the correct item is a correction. Understanding why the error happened, then changing the picking or checking process to prevent recurrence, may be corrective action. Both have their place.
The 2026 edition ends at 10.2. Continual improvement sits at 10.1; don't rely on old 2015 clause numbers when preparing an audit plan.
What was done immediately? How was the cause investigated? Could the same thing happen elsewhere? How did you check the action worked? What did the organisation learn?
For more depth: ISO 9001 Clause 10 — Improvement explained.
The expanded library will include four practical resources to support actual QMS audits, not just understanding the Standard:
Choose one completed job, order or service. Ask to see its original requirements, the checks made before accepting it, who carried out the work, any purchasing or other handovers, the evidence of verification and the outcome for the customer. Follow the trail and ask: did the process deliver what it was meant to deliver?
That's often more revealing than trying to ask someone 40 disconnected questions from a clause checklist.
The Scottish Quality Management Centre encourages auditors to be practical, fair and evidence-based. A strong QMS audit is not about catching people out. It is about helping the organisation understand whether its processes are working, whether customer requirements are being met, and where improvement is needed.
Use this manual alongside SQMC course activities, the Auditor Toolkit and your organisation's own QMS arrangements. The best auditors keep learning, keep asking better questions, and keep linking evidence back to what matters: good, consistent results for customers.
SQMC's ISO 9001 Internal Auditor course helps you move from understanding the Standard to auditing it with confidence. Over two practical days, you'll learn how to plan QMS audits, gather evidence, ask better questions, write nonconformities and report findings clearly.
Learn from anywhere in our live, Virtual Classroom, attend one of our Scottish training centres, or arrange private in-company training for your team.
Find out more and get qualified!It is the sixth edition of the internationally recognised requirements standard for Quality Management Systems. It supports organisations in delivering consistent products and services, meeting applicable requirements and enhancing customer satisfaction.
Internal and lead auditors, QMS managers, QHSE professionals and anyone who needs to understand how ISO 9001 requirements work in practice. It is a reference resource rather than a substitute for foundation or auditor training.
Important developments include clearer separation of risks and opportunities, explicit attention to quality culture and ethical behaviour, stronger management-of-change expectations, and revised explanatory guidance in Annex A. Many familiar QMS principles remain in place.
ISO 9000 explains fundamental concepts and terminology. ISO 9001 sets out the QMS requirements against which conformity can be audited. ISO 9000 is the normative reference identified by ISO 9001:2026.
No. ISO 9001 requires particular documented information and whatever additional information is needed for an effective QMS, but it doesn't prescribe one universal quality-manual format or require documentation arranged by clause number.
No particular risk-register template is mandatory. The organisation must determine, analyse, evaluate and address relevant risks and opportunities and evaluate the effectiveness of its actions. A register may be helpful, but it is only one possible method.
Not necessarily. Applicability depends on the products and services and the organisation's QMS scope. Any decision that a requirement does not apply must be justified and must not undermine product or service conformity or customer satisfaction.
Objective evidence that relevant requirements are met and that processes work as intended. Useful evidence may include conversations, observations, records, process data, real orders, customer feedback and the results of monitoring or corrective action.
No. ISO 19011:2026 is guidance on audit principles, managing audit programmes and conducting audits, including remote methods. ISO 9001:2026 refers to it for guidance in a note to Clause 9.2, but the auditable internal audit requirements are those in ISO 9001 Clause 9.2 and the organisation's other applicable criteria.
Not on its own. Annex A is informative and clarifies the meaning of requirements; it does not add extra obligations. An audit finding should identify an applicable requirement that has not been fulfilled, supported by objective evidence.
No. This is SQMC's plain-English interpretation for learning and practical reference. The published ISO 9001:2026 standard remains the authoritative source of its requirements.
This page is part of SQMC's ISO 9001:2026 guidance library for auditors, managers and QHSE professionals.