Quality management

STANDARD SUMMARY

The starting point

Build a quality management system around how work actually reaches your customers. ISO 9001 concerns the organisation’s ability to deliver consistently, understand customer requirements and improve its processes.

This guide explains the current edition, practical implementation priorities and evidence worth preparing. The examples are editorial recommendations; the licensed standard and your agreed certification scope remain the criteria for an audit.

Who it is for. Organisations delivering products or services, including professional practices, technology companies, manufacturers, public bodies and growing teams.

Start with the customer promise

ISO 9001 is a requirements standard for a quality management system, or QMS. Certification assesses the defined management system; it is not an approval of every individual product or a promise that mistakes cannot occur.

A practical starting point is to describe your customer promise in ordinary language. What must be delivered, by when, to what acceptance criteria, and with which legal or contractual constraints? Follow that promise through enquiry, quotation, design where relevant, purchasing, delivery, support and complaint handling. A process map becomes useful when it shows who decides, where information changes hands and how a failure is detected.

Make quality an operational responsibility

The 2026 edition emphasises leadership and quality culture. Treat quality as part of decisions about staffing, suppliers, delivery dates and product changes, rather than an annual document exercise.

Our suggested approach is to assign a named owner to each important process and let that person explain its purpose, measures and dependencies. Leadership reviews should make decisions: for example, whether recurring rework requires a changed specification, better capacity planning or investment in a control. Record the decision, owner, resources and review date. A quality policy adds value when teams can connect it to these choices.

Trace a job from requirement to delivery

Choose a small but meaningful sample of completed work. Include one routine job, one changed requirement, one exception and one complaint. Ask whether the requirement was understood, whether changes were authorised and whether the final result met its acceptance criteria.

For a professional service, useful evidence might be an agreed scope, a conflict or eligibility check where relevant, review notes and client acceptance. For software, it might be a requirement, acceptance test, approval and release record. These are illustrative evidence trails, not prescribed document names. Use records your teams already create before adding another form.

Connect risks and opportunities to decisions

Keep the discussion specific to process performance. A risk entry such as “supplier failure” is too broad to guide action. A more useful entry identifies the dependency, likely failure, effect on the customer and how quickly the team would notice.

Consider opportunities separately: a clearer handover, an automated validation or a redesigned onboarding step may improve outcomes without responding to a past incident. For each selected action, define what success will look like. Avoid treating every risk as something that can be eliminated or every idea as a mandatory project. Proportionate decisions and follow-through matter more than a colourful register.

Use measures that expose performance

Suggested measures include first-time acceptance, avoidable rework, delivery reliability, complaint recurrence and the time needed to resolve a recurring issue. Define the denominator and data source so that a percentage has a consistent meaning.

An improving average can conceal a poor experience for a small customer group. Review exceptions and trends alongside aggregate figures. Use internal audits to test how work operates and management review to decide what should change. When a problem is closed, check later work to see whether the improvement lasted.

Plan the move to the 2026 edition

Existing 2015 certificate holders should obtain the new standard, confirm their certification body’s transition arrangements and map changes against their actual processes. The withdrawal of a standard edition and the expiry of a client’s transition allowance are separate matters.

We suggest a concise transition register with four columns: change to assess, affected process, evidence needed and owner. Schedule the review early enough to test changes before the transition audit. Do not assume that changing the date on a manual completes the transition, or that a previous surveillance visit automatically counted as a transition assessment. Keep the certification body’s written confirmation with the project record.

IMPLEMENTATION ADVICE

Evidence to prepare

• A scope that names the products or services, organisational boundaries and locations covered.
• An example of customer requirements becoming controlled delivery and acceptance criteria.
• Process ownership, proportionate performance measures and evidence of decisions using them.
• Supplier selection and review records linked to the importance of the purchased service or product.
• Internal audit findings, management review decisions and checked corrective actions.
• A 2026 transition plan agreed against the certification body’s current requirements.

Common pitfalls

• Building a manual that does not describe the way work is performed.
• Measuring activity, such as training attendance, without checking the intended outcome.
• Closing a complaint without addressing a recurring process failure.
• Using a certificate to imply that activities outside its scope are covered.

FICTIONAL WORKED EXAMPLE

Fictional example: tracing a changed customer requirement

A fictional service business agrees a changed delivery specification after accepting a customer order. This educational scenario is not client work.

This is an evidence-tracing example. A missing file is not automatically a nonconformity, and a satisfactory sample cannot prove every order conforms.

Related guidance and practical next steps