Resources · Quality management

ISO 9001 transition checker

Six questions, answered from ISO’s own list of what changed, giving you a checklist to take to your certification body. No score, no deadline, no invented work.

This checker asks six short questions and gives you a list of questions to put to your certification body. It covers only the six changes ISO names in its own Foreword to ISO 9001:2026. It does not tell you whether you are compliant, it does not set a deadline, and it does not invent work.

Six questions, not thirty. If a transition tool asks you about twenty clauses, ask it which ones ISO actually listed as changed.

1. Which edition of ISO 9001 does your current certificate name?
2. Your procedures and forms use words like nonconformity, corrective action and documented information. Where those words are defined in your own system, do the definitions say where they came from?

Traces to Change 1. ISO states that clause 3 "now includes a limited number of terms and definitions" and that "ISO 9000 remains the normative reference for all quality management terms and definitions".

Clause 3 is free to read in full on ISO’s Online Browsing Platform, all twenty terms, without paying or signing in.

3. Think of the last time someone doing the work raised a problem at an inconvenient moment, late in a shift or close to a deadline. Can you pull up what was recorded and what happened next?

Traces to Change 2. ISO states that quality culture and ethical behaviour are "now addressed within the requirements, particularly in relation to leadership, awareness and the environment for the operation of processes". This question covers the leadership and environment halves of that sentence.

ISO does not, in anything published openly, require a document called a quality culture policy. If someone has told you it does, ask them for the clause number.

4. Your induction and refresher records show that people were made aware of the quality policy and their own contribution. Do those records name anything else people were taken through?

Traces to Change 2. Change 2, the awareness half of ISO’s sentence.

5. Wherever you record risks and opportunities today, can you show the actions taken on an opportunity separately from the actions taken on a risk, each with its own decision and its own outcome?

Traces to Change 3. ISO states that risks and opportunities are "more clearly distinguished, with separate consideration of actions to address each". ISO’s own Introduction cross-refers to "risk-based thinking (see A.6.1.2)" and "opportunity-based thinking (see A.6.1.3)".

Nothing published openly requires a risk register, an opportunity register or any named software. The trail can live wherever you already keep it.

6. Pick one change you made to your management system in the last year. Can your records say what changed, when it took effect, who authorised it, and what the review afterwards concluded?

Traces to Change 4. ISO states that requirements on changes to the quality management system "have been reinforced to support the achievement of intended results". The phrase intended results is what puts the weight on the review afterwards.

A system that stores only the current version of a procedure answers the first of those four questions and none of the others.

What this tool deliberately does not ask about

We do not ask about internal audit, management review or organisational knowledge, which are clauses 9.2, 9.3 and 7.1.6. Those changes were reported in commentary written against the draft, no certification body corroborates them against the published text, and BSI, which has read the final draft, states that the core performance evaluation requirements are unchanged. We also ask nothing about artificial intelligence, cybersecurity or sustainability, because none of them appears in ISO’s list of changes. Six questions is what the Foreword supports, so six is what we ask.

Every question, and every answer it can give

The checker above does not hide anything. Each question and each of its outcomes is set out below, with the ISO change it traces to, so you can read the whole thing without answering a single question.

2. Your procedures and forms use words like nonconformity, corrective action and documented information. Where those words are defined in your own system, do the definitions say where they came from?

Traces to Change 1. ISO states that clause 3 "now includes a limited number of terms and definitions" and that "ISO 9000 remains the normative reference for all quality management terms and definitions".

  • Yes, our definitions cite a source. Take a sample of your defined terms and ask your certification body whether it expects terminology to be referenced to ISO 9000, to clause 3 of the sixth edition, or to both, now that twenty terms are carried in ISO 9001 itself. (Change 1)
  • Partly, some do and some do not. Worth being able to show which of your defined terms carry a source and which stand on their own, and asking your certification body whether it expects one consistent reference across the system. (Change 1)
  • Not yet, they are written in our own words. Worth listing the terms your system defines in its own words, so you can ask your certification body how it reads those against clause 3 and against ISO 9000, which remains the normative reference. (Change 1)

Clause 3 is free to read in full on ISO’s Online Browsing Platform, all twenty terms, without paying or signing in.

3. Think of the last time someone doing the work raised a problem at an inconvenient moment, late in a shift or close to a deadline. Can you pull up what was recorded and what happened next?

Traces to Change 2. ISO states that quality culture and ethical behaviour are "now addressed within the requirements, particularly in relation to leadership, awareness and the environment for the operation of processes". This question covers the leadership and environment halves of that sentence.

  • Yes, we could find that record today. Bring one or two of those records to your next conversation with your certification body and ask how it expects culture and ethical behaviour to be evidenced, given ISO names leadership and the environment for the operation of processes as two of the three places they land. (Change 2)
  • Partly, some are recorded and some are handled in conversation. Worth knowing which of those moments leave a record and which do not, because the ones that leave a record are the ones you can show. Ask your certification body what it expects to see where culture is concerned. (Change 2)
  • Not yet, that sort of thing is resolved informally. Worth being able to show at least one worked example, start to finish, of a problem raised by the person doing the work and the decision that followed. Ask your certification body whether examples of that kind are what it has in mind. (Change 2)

ISO does not, in anything published openly, require a document called a quality culture policy. If someone has told you it does, ask them for the clause number.

4. Your induction and refresher records show that people were made aware of the quality policy and their own contribution. Do those records name anything else people were taken through?

Traces to Change 2. Change 2, the awareness half of ISO’s sentence.

  • Yes, they list the topics covered. Take a sample induction record and ask your certification body whether the topics it names are the kind of thing it expects to see, now that ISO lists awareness as one of the three places quality culture and ethical behaviour are addressed. (Change 2)
  • Partly, the record exists but the content is not itemised. Worth being able to show what an induction actually covers, not only that one took place. Ask your certification body whether it expects awareness records to name their content. (Change 2)
  • Not yet, we record attendance rather than content. Worth having the content of your awareness sessions written down somewhere that can be produced alongside the attendance list. Ask your certification body how it reads awareness records against the sixth edition. (Change 2)
5. Wherever you record risks and opportunities today, can you show the actions taken on an opportunity separately from the actions taken on a risk, each with its own decision and its own outcome?

Traces to Change 3. ISO states that risks and opportunities are "more clearly distinguished, with separate consideration of actions to address each". ISO’s own Introduction cross-refers to "risk-based thinking (see A.6.1.2)" and "opportunity-based thinking (see A.6.1.3)".

  • Yes, they are recorded and actioned separately. Take one risk and one opportunity, each with its decision and its outcome, and ask your certification body whether that is the separation it expects to see under the restructured clause 6.1. (Change 3)
  • Partly, they share a record but can be told apart. Worth being able to produce the opportunities on their own, with what was decided and what came of it, rather than only as entries in a combined list. Ask your certification body how it expects the separation to be evidenced. (Change 3)
  • Not yet, they sit in one combined list. Worth being able to answer three questions about any opportunity you have identified: what you decided, what you did, and whether it worked. Ask your certification body what separate consideration means in practice for your kind of organisation. (Change 3)

Nothing published openly requires a risk register, an opportunity register or any named software. The trail can live wherever you already keep it.

6. Pick one change you made to your management system in the last year. Can your records say what changed, when it took effect, who authorised it, and what the review afterwards concluded?

Traces to Change 4. ISO states that requirements on changes to the quality management system "have been reinforced to support the achievement of intended results". The phrase intended results is what puts the weight on the review afterwards.

  • Yes, all four. Take that change record to your certification body and ask whether the post change review it contains is the kind of evidence it expects, given ISO ties reinforced change requirements to the achievement of intended results. (Change 4)
  • Partly, the first three but not the review. Worth being able to show what a change was intended to achieve and what happened afterwards, for at least one change. Ask your certification body how it expects achievement of intended results to be evidenced. (Change 4)
  • Not readily, our system holds the current version rather than the history. Worth knowing whether your document control can reproduce what a procedure said on a given past date, because a transition is itself a sequence of changes. Ask your certification body what it expects a change record to contain. (Change 4)

A system that stores only the current version of a procedure answers the first of those four questions and none of the others.

Context, with nothing to do

  • Annex A has been revised and expanded. ISO states it provides "enhanced clarification of the structure, terminology and intent of the requirements as informative text, without introducing additional requirements". It is guidance, so nobody is audited against it, and it will shape how the clauses it explains are interpreted. (Change 5)
  • Annex B has been removed. It listed other ISO/TC 176 standards, and those references now sit in Annex A and on the ISO/TC 176 website. There is nothing in your system that this changes. (Change 6)

Sources

Related terms

Related terms

More in Quality management · Full glossary