Between Practice and Vision: DQS Experts on the ISO 9001 Update

Increasing the Effectiveness of the QMS

Engaging with the new ISO 9001 revision shows that the requirements placed on quality and organizations have changed – and with them, expectations for an effective management system. The voices featured in this article reflect the reality of working with ISO 9001 – and the conviction that quality needs to be understood differently today. Not as a collection of requirements, but as a system that provides direction, promotes responsibility, and enables organizations to succeed in dynamic markets. A system that delivers greater impact rather than formalism, creates more room for opportunities, puts an even stronger focus on customers and users, and takes a contemporary approach to leadership, change, and technology.

Better Management of Risks and Opportunities

One of the key changes introduced by the new ISO 9001:2026 is the introduction of opportunity-based thinking and, in this context, the separation of how risks and opportunities are addressed. This means that the perspective we proposed as part of ISO TC 176 TG 4 (Future Topics “Risk”) has prevailed: risks and opportunities are understood as two different concepts for dealing with change and are systematically decoupled from one another. The aim of this change is to encourage organizations to address their (strategic) opportunities more systematically. In practice, opportunities have received far too little attention to date.

Opportunities need to be assessed and addressed differently from risks. While risks typically involve considering events, their consequences, and their likelihood of occurrence, when looking at opportunities, we ask whether we have the capabilities, competencies, or capacity to, for example, attract new customer groups. These differences are addressed in particular in the new guidance provided in Annex A 6.1, which supplements the requirements of the standard, which remain generally formulated, with practical guidance.

Integrating both perspectives, for example when deciding on specific actions, remains useful. What is important is that this does not mean an organization suddenly needs to establish a new function called “opportunity management.” The aim is to integrate risks and opportunities more effectively into business decision-making.

Certified – Yet No Quality Culture? 

ISO 9001:2026 Calls for a Reality Check

The new ISO 9001:2026 marks a turning point that excites me as an auditor: At last, the “soft” factors that contribute to success are moving into the normative focus. The emphasis is shifting away from a purely process-oriented perspective toward lived identity and shared values.

The new requirement is strategically positioned in the leadership clauses. In Clause 5.1.1, top management is now explicitly required to actively promote a quality culture and ethical behaviour. This is supported by Clause 7.3, which ensures that all employees are aware of this culture and the underlying ethical principles. As explained in Note 2, an organization’s quality culture and ethical behaviour are reflected in its shared values, attitudes, and established practices.

For me as an auditor, this means I will no longer be satisfied with well-crafted mission statements on the wall. I will look for evidence of leadership in practice. In future audits, I will increasingly ask how decisions are made when priorities conflict – for example, when time pressure comes up against thoroughness. I will look for signs of psychological safety, where mistakes are openly communicated and seen as opportunities to learn. Are quality risks openly addressed, or does it seem preferable to sweep them under the rug?

These new requirements should not be seen as an administrative burden, but as an opportunity to create a solid foundation for genuine resilience.

From Audit Ritual to Real Management Value

How ISO 9001:2026 is reshaping internal audits – and how ISO 19011:2026 provides the right auditing practices

The real change to internal audits brought about by ISO 9001:2026 does not lie in additional audit requirements, but in a significantly different set of expectations. The largely unchanged Clause 9.2 should therefore not obscure the fact that internal audits are now expected to make a more tangible contribution to the leadership and management of the quality management system.

Audit objectives are becoming more explicit, with process performance and contribution to objectives taking center stage. Risks and opportunities influence the frequency and scope of audits. Rather than simply working through standard requirements or rigid annual audit plans, the focus is on contributing to effectiveness, achieving objectives, and driving improvement.

ISO 19011:2026 provides the methodological response: process-based audits examine processes and their interactions, directing resources where risk and the potential for valuable insights are greatest. Remote, hybrid, ad hoc, and short audits increase flexibility, while supply chain audits can take a risk-based approach ranging from individual processes to an end-to-end perspective.

This also raises the bar for auditors: process understanding, risk- and opportunity-based thinking, selecting the right methods, and communicating “on an equal footing” become critical. The opportunity is to turn a ritualized compliance exercise into a valuable contribution to management decision-making. The litmus test is no longer: “Did we check everything?” but rather: “Did our audits help us make better management decisions?”

Quality Culture and Ethical Behaviour

ISO 9001:2026 – Ethics Take Center Stage

The starting point is well known: A perfectly documented quality management system (QMS), with or without certification, is essentially ineffective if the people in the organization do not live by it. Following the revision, two key concepts are therefore moving into focus: quality culture and ethical behaviour. These are anchored primarily in Clause 5.1 (Leadership and Commitment) and Clause 7.3 (Awareness), where top management will be required to actively promote a quality culture and lead by example when it comes to ethical behaviour. And all employees must be aware of this culture and actively support it.

This is by no means about turning organizations into moral institutions. Rather, it is about classic values such as integrity, reliability, and responsible action. Decisions must be transparent and justifiable, commitments must be honored, and above all: responsibility does not end at the boundaries of the organization. The quality policy to be formulated must therefore reflect the increasingly dynamic context of the organization even more clearly – and in a way that can be demonstrated. The organization’s strategic direction must be demonstrably grounded in this context.

Culture Is What Leadership Tolerates

Quality is therefore becoming even more fundamentally a leadership issue, and a quality management system that is truly lived is above all a matter of culture. What leadership tolerates becomes part of the culture, as leadership experts Gruenert and Whitaker have put it in essence. It just may not be the culture you want.

None of this is fundamentally new, nor is it rocket science. What is new, however, is that this important aspect, which has often been overlooked or ignored by many, is now being explicitly required by the standard for the first time – and will therefore also be subject to auditing. The traditional checklist logic is thus moving toward questions of “attitude” and behaviour. In future, leaders will need to demonstrate as a matter of course how they actively shape, embody, and promote their own (!) set of values.

From Intent to Action

In practice, this could mean putting quality culture firmly on the management agenda, embedding the organization’s values in training, team meetings, and internal and external communication, making leadership role models visible through transparent decisions and comprehensible allocation of resources, or systematically incorporating effectiveness measures such as employee feedback or stakeholder input into management reviews.

The new ISO 9001 is by no means “more ethical,” but it has become more grounded in reality – and more demanding in this respect. Sustainable quality emerges where values, objectives, processes, leadership, culture, and responsible behaviour overlap as much as possible. Quality culture and ethical behaviour are therefore not additional burdens, but a long-overdue broadening of the perspective – with people at the center.

Integrating New Technologies into the QMS with Quality Assurance

The new revision of the standard once again demonstrates that it continues to give organizations considerable flexibility in how they implement its requirements. While this can be a challenge on the one hand, I still see the scope for individual interpretation as one of the standard’s greatest strengths on the other.

For example, while artificial intelligence (AI) is not explicitly mentioned, I believe it nevertheless needs to be considered as soon as this technology is used within an organization. I view AI as a resource – for example, in the form of virtual employees or supporting IT systems. Accordingly, the requirements of the standard apply that call for resources to be implemented systematically and in line with organizational needs within the company’s process structures.

For us as auditors, it is therefore essential to engage with the topic of AI. Only by doing so can we provide our clients with forward-looking input as part of an audit, going beyond a purely conformity-based assessment. From a quality management perspective, this means, for example, assessing the impact on the expected outcomes of the respective process and, with regard to documented information, considering aspects such as confidentiality, availability, and integrity in the context of artificial intelligence.

It therefore remains exciting to see how organizations will integrate new technologies into their own processes while ensuring quality. As always, there are many different ways to approach this. Ultimately, how organizations make use of the flexibility provided by the standard will determine whether they are able to fully seize this opportunity.

ISO 9001:2026: From the Guiding Principle to Everyday Practice

I see the greatest challenge in transitioning to ISO 9001:2026 not in adapting documents, but in ensuring that the new requirements are actually effective within the management system.

An organization does not need to reinvent its entire operation. Instead, it should take a critical look at the following questions: Where are risks and opportunities genuinely part of decision-making today? How does quality culture manifest itself in day-to-day actions? And how clearly can the link between quality management and strategic direction be demonstrated?

For me, the key is the common thread that runs through the entire organization and its quality management system: from strategic direction and the organization’s context through risks and opportunities to processes and the day-to-day actions of employees. When this connection is clear and traceable, individual requirements come together to form an effective management system.

This also changes the perspective taken during an audit: We do not only look at whether a requirement has been formally met, but increasingly at whether this common thread is evident throughout the organization and how requirements are implemented and made effective within the specific context. For organizations, this provides a valuable opportunity to use the transition not merely as an obligation, but as a means of purposefully further developing their quality management.

ISO 9001:2026: Evolution Rather Than Reinvention

The revision of ISO 9001 sets meaningful priorities: quality policy and quality objectives are more closely linked to strategic direction. Risks and opportunities are more clearly distinguished. Changes must be planned, monitored, communicated, and evaluated.

The requirement to promote a quality culture and ethical behaviour is particularly demanding. The objective is sound, but its implementation is challenging. Ethical behaviour cannot be created through procedures or audited with a checklist. It is reflected in leadership actions, transparent decision-making, and how conflicting objectives are handled. From the author’s perspective, this is where the real challenge lies: Organizations need to make ethical behaviour tangible without turning it into a bureaucratic box-ticking exercise or opening the door to a debate about personal morality. Auditors, in turn, need to assess whether leadership is creating appropriate conditions without imposing personal values as a benchmark.

Climate change is also explicitly addressed. Organizations must assess its relevance to their context. This does not, however, turn ISO 9001 into either an environmental or a sustainability standard.

Product-related legal, contractual, and customer-specific sustainability requirements are already addressed through the existing requirements, particularly Clause 8.2.

The conclusion: ISO 9001 should not be burdened with expectations that fall outside its scope. It strengthens leadership and quality culture while remaining clearly auditable. Its purpose remains effective quality management.

Driving Continuous Development

There is no need to reinvent the wheel: the revision of ISO 9001 is not a major overhaul. However, the changes introduced are intended to enable organisations to consistently drive forward their development processes, the PDCA cycle and, consequently, continual improvement. New topics include quality culture and ethical behaviour.

As with the previous edition of the standard, organisations continue to have considerable flexibility in how they implement the requirements. This is both a challenge and one of the standard’s greatest opportunities: the scope it allows for individual interpretation. Although artificial intelligence is not explicitly mentioned, it must be considered wherever it is used within an organisation. I see AI as a resource – for example, in the form of virtual employees or supporting IT systems. The standard’s requirements for the systematic, needs-based provision of resources therefore also apply to their integration into process structures.

Managing organisational culture, ethical behaviour and new technologies requires leadership. Leadership means leading by example: employees take their cues from the behaviours demonstrated by those at the top. When it comes to AI and ethics in particular, the key is to demonstrate the right behaviours, set an example and provide guidance – including the ability to identify opportunities and risks.

For us as auditors, engaging with these topics is essential. Only then can we provide meaningful guidance during audits alongside assessing conformity – for example, by evaluating the impact on expected process outcomes and examining documented information in terms of confidentiality, availability and integrity in the context of AI. The time available before certificates need to be transitioned to the revised standard should therefore be put to good use. Organisations should review their own management systems to identify where AI is being used, where ethical behaviour comes into play, and whether quality culture is genuinely embedded in everyday practice.

Over the coming weeks, we will be adding further statements from auditors, standards experts, and practitioners to this page. Would you like to stay informed? Sign up for our free “Business Insights” newsletter.

What DQS can do for you

Since 1985, DQS has stood for reliable and independent certification of management systems. As Germany’s first certification body, we provide organizations worldwide with guidance, security, and confidence – through value-adding audits and internationally recognized certificates.

Our strength lies in technical expertise, in-depth knowledge of standards and regulations, and a clear understanding of industry-specific requirements. This enables you to demonstrate the effectiveness of your management system and systematically drive its further development – based on facts, transparent, and future-oriented.

Certification with DQS stands for trust – both internally and externally. Our audits are not about simply working through checklists, but about structured dialogue on an equal footing. We have been accredited for ISO 9001 by the German Accreditation Body (DAkkS) since 1991.

Trust and expertise

Our texts and brochures are written exclusively by our standards experts or long-standing auditors. If you have any questions about the text content or our services to our author, we look forward to hearing from you.

Note: For reasons of better readability, we use the generic masculine. However, the directive includes persons of all gender identities where necessary for the statement.