Between Practice and Vision: DQS Experts on the ISO 9001 Update

Better Management of Risks and Opportunities

One of the key changes introduced by the new ISO 9001:2026 is the introduction of opportunity-based thinking and, in this context, the separation of how risks and opportunities are addressed. This means that the perspective we proposed as part of ISO TC 176 TG 4 (Future Topics “Risk”) has prevailed: risks and opportunities are understood as two different concepts for dealing with change and are systematically decoupled from one another. The aim of this change is to encourage organizations to address their (strategic) opportunities more systematically. In practice, opportunities have received far too little attention to date.

Opportunities need to be assessed and addressed differently from risks. While risks typically involve considering events, their consequences, and their likelihood of occurrence, when looking at opportunities, we ask whether we have the capabilities, competencies, or capacity to, for example, attract new customer groups. These differences are addressed in particular in the new guidance provided in Annex A 6.1, which supplements the requirements of the standard, which remain generally formulated, with practical guidance.

Integrating both perspectives, for example when deciding on specific actions, remains useful. What is important is that this does not mean an organization suddenly needs to establish a new function called “opportunity management.” The aim is to integrate risks and opportunities more effectively into business decision-making.

Certified – Yet No Quality Culture? ISO 9001:2026 Calls for a Reality Check

The new ISO 9001:2026 marks a turning point that excites me as an auditor: At last, the “soft” factors that contribute to success are moving into the normative focus. The emphasis is shifting away from a purely process-oriented perspective toward lived identity and shared values.

The new requirement is strategically positioned in the leadership clauses. In Clause 5.1.1, top management is now explicitly required to actively promote a quality culture and ethical behaviour. This is supported by Clause 7.3, which ensures that all employees are aware of this culture and the underlying ethical principles. As explained in Note 2, an organization’s quality culture and ethical behaviour are reflected in its shared values, attitudes, and established practices.

For me as an auditor, this means I will no longer be satisfied with well-crafted mission statements on the wall. I will look for evidence of leadership in practice. In future audits, I will increasingly ask how decisions are made when priorities conflict – for example, when time pressure comes up against thoroughness. I will look for signs of psychological safety, where mistakes are openly communicated and seen as opportunities to learn. Are quality risks openly addressed, or does it seem preferable to sweep them under the rug?

These new requirements should not be seen as an administrative burden, but as an opportunity to create a solid foundation for genuine resilience.

From Audit Ritual to Real Management Value

How ISO 9001:2026 is reshaping internal audits – and how ISO 19011:2026 provides the right auditing practices

The real change to internal audits brought about by ISO 9001:2026 does not lie in additional audit requirements, but in a significantly different set of expectations. The largely unchanged Clause 9.2 should therefore not obscure the fact that internal audits are now expected to make a more tangible contribution to the leadership and management of the quality management system.

Audit objectives are becoming more explicit, with process performance and contribution to objectives taking center stage. Risks and opportunities influence the frequency and scope of audits. Rather than simply working through standard requirements or rigid annual audit plans, the focus is on contributing to effectiveness, achieving objectives, and driving improvement.

ISO 19011:2026 provides the methodological response: process-based audits examine processes and their interactions, directing resources where risk and the potential for valuable insights are greatest. Remote, hybrid, ad hoc, and short audits increase flexibility, while supply chain audits can take a risk-based approach ranging from individual processes to an end-to-end perspective.

This also raises the bar for auditors: process understanding, risk- and opportunity-based thinking, selecting the right methods, and communicating “on an equal footing” become critical. The opportunity is to turn a ritualized compliance exercise into a valuable contribution to management decision-making. The litmus test is no longer: “Did we check everything?” but rather: “Did our audits help us make better management decisions?”

ISO 9001:2026 – Ethics Take Center Stage

The starting point is well known: A perfectly documented quality management system (QMS), with or without certification, is essentially ineffective if the people in the organization do not live by it. Following the revision, two key concepts are therefore moving into focus: quality culture and ethical behaviour. These are anchored primarily in Clause 5.1 (Leadership and Commitment) and Clause 7.3 (Awareness), where top management will be required to actively promote a quality culture and lead by example when it comes to ethical behaviour. And all employees must be aware of this culture and actively support it.

This is by no means about turning organizations into moral institutions. Rather, it is about classic values such as integrity, reliability, and responsible action. Decisions must be transparent and justifiable, commitments must be honored, and above all: responsibility does not end at the boundaries of the organization. The quality policy to be formulated must therefore reflect the increasingly dynamic context of the organization even more clearly – and in a way that can be demonstrated. The organization’s strategic direction must be demonstrably grounded in this context.

Culture Is What Leadership Tolerates

Quality is therefore becoming even more fundamentally a leadership issue, and a quality management system that is truly lived is above all a matter of culture. What leadership tolerates becomes part of the culture, as leadership experts Gruenert and Whitaker have put it in essence. It just may not be the culture you want.

None of this is fundamentally new, nor is it rocket science. What is new, however, is that this important aspect, which has often been overlooked or ignored by many, is now being explicitly required by the standard for the first time – and will therefore also be subject to auditing. The traditional checklist logic is thus moving toward questions of “attitude” and behavior. In future, leaders will need to demonstrate as a matter of course how they actively shape, embody, and promote their own (!) set of values.

From Intent to Action

In practice, this could mean putting quality culture firmly on the management agenda, embedding the organization’s values in training, team meetings, and internal and external communication, making leadership role models visible through transparent decisions and comprehensible allocation of resources, or systematically incorporating effectiveness measures such as employee feedback or stakeholder input into management reviews.

The new ISO 9001 is by no means “more ethical,” but it has become more grounded in reality – and more demanding in this respect. Sustainable quality emerges where values, objectives, processes, leadership, culture, and responsible behavior overlap as much as possible. Quality culture and ethical behaviour are therefore not additional burdens, but a long-overdue broadening of the perspective – with people at the center.

Increasing the Effectiveness of the QMS

Engaging with the new ISO 9001 revision shows that the requirements placed on quality and organizations have changed – and with them, expectations for an effective management system. The voices featured in this article reflect the reality of working with ISO 9001 – and the conviction that quality needs to be understood differently today. Not as a collection of requirements, but as a system that provides direction, promotes responsibility, and enables organizations to succeed in dynamic markets. A system that delivers greater impact rather than formalism, creates more room for opportunities, puts an even stronger focus on customers and users, and takes a contemporary approach to leadership, change, and technology.

Over the coming weeks, we will be adding further statements from auditors, standards experts, and practitioners to this page. Would you like to stay informed? Sign up for our free “Business Insights” newsletter.

What DQS can do for you

Since 1985, DQS has stood for reliable and independent certification of management systems. As Germany’s first certification body, we provide organizations worldwide with guidance, security, and confidence – through value-adding audits and internationally recognized certificates.

Our strength lies in technical expertise, in-depth knowledge of standards and regulations, and a clear understanding of industry-specific requirements. This enables you to demonstrate the effectiveness of your management system and systematically drive its further development – based on facts, transparent, and future-oriented.

Certification with DQS stands for trust – both internally and externally. Our audits are not about simply working through checklists, but about structured dialogue on an equal footing. We have been accredited for ISO 9001 by the German Accreditation Body (DAkkS) since 1991.

Trust and expertise

Our texts and brochures are written exclusively by our standards experts or long-standing auditors. If you have any questions about the text content or our services to our author, we look forward to hearing from you.

Note: For reasons of better readability, we use the generic masculine. However, the directive includes persons of all gender identities where necessary for the statement.