Docs
Audits & Certification

ISO 9001:2026 and the Internal Audit: What Changes for Question Catalogs and Audit Programmes

Published on August 24, 2026 · Updated on September 16, 2026

By Andreas Bauer Auditor, SAP consultant and developer of qportal

Updated 16 September 2026. ISO 9001:2026 was published today [1][2]. This article was checked against a copy of ISO/DIS 9001:2025(en) [11] — Draft International Standard stage, committee ballot closed 2025-11-19, not the published IS text or the German DIN translation (~November 2026, [9]). One correction applies to the section on evidence of effectiveness below. Everything said here about audit practice remains professional assessment and is marked as such.

The good news first: for the internal audit the revision changes almost nothing. For clause 9, BSI reports that the core requirements are unchanged and that the focus shifts only towards using data effectively for trends and improvement [10]. If you run a sound audit programme under 9.2 today, you will keep running it.

The work sits elsewhere — and it is barely discussed anywhere: your audit question catalog is bound to clause numbers, and some of those numbers change.

The mapping problem

The structural change that matters most to auditors is the split of clause 6.1. In the 2015 edition risks and opportunities sit together in one clause; in the new edition, actions to address risks (6.1.2) and actions to address opportunities (6.1.3) separate [9].

For a question catalog this means:

  • Questions currently hanging under 6.1 have to be distributed across two target clauses.
  • Questions on opportunities do not exist in many catalogs at all, because the 2015 edition effectively treated them as an appendix to risk. This is new content, not a move.
  • Questions on 5.1.1 and 7.3 need additions on quality culture and ethical behaviour [9][10].
  • Questions on 4.1/4.2 need the climate change aspect, unless it was already added from Amd 1:2024 [1][9].

That is manageable — but only if the catalog exists as a structure. If it lives in a Word document or a spreadsheet where the clause number sits as text in a column, it is manual work with no way to verify completeness. The article spreadsheets or software in quality management covers exactly that difference.

The versioning problem

This is where most migrations get messy.

After the transition, new audits assess against ISO 9001:2026. Findings from past audits, however, were raised against ISO 9001:2015 and carry its clause assignment. Both sets coexist, sometimes for years — open actions from a 2025 audit continue while the 2027 audit assesses against the new structure.

Overwriting the question catalog destroys traceability retroactively: a finding referencing “6.1” suddenly points at a clause that no longer exists in that form.

Assessment — what holds up instead:

  1. Keep the criteria catalog as a versioned structure, not as a document. ISO 9001:2015 and ISO 9001:2026 are two coexisting criteria trees, not two states of the same tree.
  2. Bind every finding to the criteria version it was raised against. It then stays correctly assigned after the transition.
  3. Store an old-to-new mapping so trend analysis works across the transition date. Without it, every multi-year statistic breaks in the migration year.
  4. Tie each audit to one edition explicitly. A programme assessing against both editions in the same year needs that stated per audit, not per programme.

This is exactly why qportal models standard clauses as a hierarchical, versionable catalog of audit criteria rather than a free-text field. A second edition of a standard is an additional criteria tree that audits use from a cut-off date — the history stays untouched. The old-to-new mapping (point 3 above) is not a promise — it is a changeover workbench: it models exactly the 6.1 case above — an old clause gets a “Split” mapping to 6.1.2 and 6.1.3, with its own completeness status per edition pair.

Evidence of effectiveness — corrected

DIN Media had rated the changed role of documented information as the most far-reaching innovation of the revision: it was said to serve more strongly as evidence of implementation and effectiveness [9]. Checking against ISO/DIS 9001:2025(en) [11] does not confirm that — the requirement text in 7.5 is unchanged from 2015; the framing is an interpretation, not a new clause (details in the section “Documented information” of the clause comparison article).

For the internal audit this changes the reasoning, not the recommendation: the effectiveness check is already required in 10.2 of the 2015 edition — unchanged in 2026 too — and remains the weakest point of many quality systems. In practice the chain regularly ends at “action implemented”, and the question of whether the problem has recurred since goes unanswered. What belongs there is described in the article on the CAPA process and the article on handling findings.

Assessment: if you want to improve a single metric before the transition, take this one — the share of corrective actions with a documented, scheduled and actually performed effectiveness check.

Auditing quality culture without the mysticism

The new requirement for top management to promote a quality culture and ethical behaviour [9][10] leaves internal auditors with an evidence problem. Culture cannot be demonstrated by producing a document.

Assessment — defensible entry points instead of climate surveys:

  • Handling of inconvenient reports. Are there findings that concern the management level itself? A system without such entries is either perfect or not reporting.
  • Seriousness of the effectiveness check. Are actions ever rated ineffective and re-opened, or is every check positive?
  • Behaviour under conflicting objectives. Is there a documented case where a quality decision prevailed over a deadline?
  • Management involvement. Does top management contribute substantively to management reviews, or sign off the result?
  • Response times. How long do findings sit unattended? That number says more about priorities than any mission statement.

These points are evidence-based, because they derive from data you already hold — provided the data is structured rather than spread across five spreadsheets. The audit question catalog under ISO 19011 shows the questioning technique behind them.

The 2027 audit programme

Professional recommendation: the 2027 programme should contain three things, even though the transition period is not published [1][8]:

  1. A gap audit slot in the first quarter, once the text is available from 16 September 2026 [1][2] and the German edition from November 2026 [9].
  2. A marker per audit stating which edition is being assessed.
  3. A buffer ahead of the recertification date, because the certification body’s transition audit is tied to the still-pending arrangement from the Global Accreditation Cooperation Incorporated [8].

The systematics of risk-based programme planning under 9.2 are covered in the audit programme planning guide; for the external side see external audit process and preparation.

Conclusion

For the internal audit, ISO 9001:2026 is a structural migration rather than a substantive one. The questions stay largely the same, but they hang off partly different clauses, and the history has to survive the switch.

Organizations that keep their criteria catalog as a versioned structure will do this in days. Organizations that maintain it as a document will spend weeks — and usually lose comparability across the transition date. That is the real reason to settle this question now rather than in spring 2027.

The full clause comparison is in ISO 9001:2026: every change in detail; the continuously updated position on dates and the transition period is on the ISO 9001:2026 overview page.

Sources

Primary sources — standards and accreditation bodies

  1. ISO: ISO 9001 — Quality management systems. Requirements. Stage 60.00 (International Standard under publication), edition 6, publication date 2026-09, ISO/TC 176/SC 2. https://www.iso.org/standard/88464.html (accessed 2026-08-24)
  2. ISO/TC 176/SC 2: ISO 9001 revision update. News item, 7 Aug 2026. https://committee.iso.org/sites/tc176sc2/home/news/content-left-area/news-and-updates/news-1.html (accessed 2026-08-24)
  3. ISO: ISO 9000:2026 — Quality management. Fundamentals and vocabulary. Edition 5, published 2026-05. https://www.iso.org/standard/9000 (accessed 2026-08-24)
  4. ISO: ISO 9001:2026 — Quality management systems – Requirements. Trusted across the world. Factsheet, ISO 2026. https://www.iso.org/files/live/sites/isoorg/files/standards/popular_standards/iso_9000_quality_management/ISO9001-2026_Factsheet.pdf (accessed 2026-08-24)
  5. ISO: ISO 9001 — Turn quality into business performance. Official topic page for the 2026 edition. https://www.iso.org/9001-2026 (accessed 2026-08-24)
  6. IATF Global Oversight: IATF Stakeholder Communiqué, REF 005: IATF 16949 2nd edition update information. July 2026. https://www.iatfglobaloversight.org/wp/wp-content/uploads/2026/07/Stakeholder-Communique-SC-2026-005_IATF-16949-2nd-Edition-status.pdf (accessed 2026-08-24)
  7. International Accreditation Forum: notice on the cessation of operations as of 1 Jan 2026 and the transfer to the Global Accreditation Cooperation Incorporated. Legacy site. https://iaf.nu/en/home/ (accessed 2026-08-24)
  8. Global Accreditation Cooperation Incorporated (Global ACI): organisational information, operations began 1 Jan 2026. https://global-aci.org/en/home/ (accessed 2026-08-24)

Secondary accounts of ISO/FDIS 9001 by national standards bodies

The FDIS is not publicly available. Clause-level statements in this text therefore rely on the accounts published by the national standards bodies that take part in the standardization process:

  1. DIN Media (DIN group): Revision der ISO 9001 — Veröffentlichung 2026. https://www.dinmedia.de/de/themenseiten/managementsysteme/qualitaetsmanagement/revision-der-iso9001 (accessed 2026-08-24)
  2. BSI (British Standards Institution): ISO 9001:2026 — Key Changes and Guidance. https://www.bsigroup.com/en-US/products-and-services/standards-services/iso-9001-2026-key-changes-and-guidance/ (accessed 2026-08-24)
  3. ISO/DIS 9001:2025(en), Quality management systems — Requirements. ISO/TC 176/SC 2, committee ballot 2025-08-27 to 2025-11-19. Not publicly available; checked against a copy on 2026-09-16 — not the published IS edition, see the status note above.

Consultancy, certification-body and content-marketing pages with no involvement in the standardization process are not cited. Where this text goes beyond the documented evidence, it is marked as an assessment.