TLDR
ISO 9001:2026 makes two significant changes to the internal audit requirements in Clause 9.2: auditors must now explicitly evaluate whether the quality culture and ethical behaviour requirements of Clause 5.1.1 are being met, and the audit programme must be reviewed when significant changes occur — including changes driven by climate change considerations under Clause 4.1. This article explains what these changes mean for audit planning, how to update your internal audit programme, and what competence requirements apply to auditors evaluating the new requirements.
What Changed in Clause 9.2
Clause 9.2 of ISO 9001:2026 retains the core structure from the 2015 edition — organizations must plan, establish, implement, and maintain an audit programme that covers all QMS processes and requirements. The changes are in the scope and triggers for the audit programme.
New Scope Requirement: The audit programme must now explicitly include evaluation of the Clause 5.1.1 quality culture and ethical behaviour requirements. This is not implied — it is a stated requirement. Auditors must assess whether top management is demonstrating the behaviours described in Clause 5.1.1, not just whether the documented procedures exist.
New Trigger Requirement: The audit programme must be reviewed and updated when significant changes occur, including changes to the context of the organization under Clause 4.1. Since Clause 4.1 now explicitly includes climate change as a potential external issue, organizations in climate-sensitive industries may need to update their audit programmes when climate-related risks change significantly.
[CALLOUT:key insight]
The Practical Impact: Most organizations' internal audit programmes focus on documented procedures and process conformance. ISO 9001:2026 requires them to also audit leadership behaviour and organizational culture — which requires different audit techniques and auditor competence.
[/CALLOUT]
Auditing Quality Culture: What It Means in Practice
Stay Current
ISO 9001:2026 publishes September 16, 2026. Get weekly briefings.
Clause 5.1.1 of ISO 9001:2026 requires top management to demonstrate leadership and commitment to the QMS by, among other things, promoting quality culture and ethical behaviour throughout the organization. Auditing this requirement is fundamentally different from auditing a documented procedure.
Effective techniques for auditing quality culture include:
Behavioural observation — Auditors observe how managers and supervisors respond to quality issues in real time. Do they prioritize quality over schedule pressure? Do they encourage reporting of problems or discourage it?
Interview sampling — Auditors interview employees at multiple levels to assess whether quality values are understood and lived. Questions like "What happens when you find a quality problem?" and "How does your manager respond when you raise a quality concern?" reveal cultural reality more accurately than document reviews.
Nonconformity trend analysis — The pattern of nonconformities reveals cultural signals. If nonconformities are consistently closed without genuine root cause analysis, it suggests a culture of compliance theatre rather than genuine improvement.
Management review participation — Auditors assess whether top management actively participates in management review or delegates it entirely. Active participation is evidence of commitment; consistent delegation is a warning sign.
Competence Requirements for Internal Auditors
ISO 9001:2026 does not specify auditor competence requirements beyond the general requirement that auditors must be objective and impartial. However, the new scope of Clause 9.2 — including the evaluation of quality culture and ethical behaviour — implies that internal auditors need competence in:
- Behavioural interviewing techniques
- Organizational culture assessment
- Understanding of the Clause 5.1.1 requirements and their intent
- Ability to distinguish between documented compliance and genuine cultural commitment
Organizations that have been using internal auditors primarily as document checkers will need to develop additional competence. This may involve training in audit interviewing techniques, or bringing in external auditors with experience in culture assessment for the first transition audit cycle.
Updating Your Internal Audit Programme
A compliant ISO 9001:2026 internal audit programme must address:
| Programme Element | 2015 Requirement | 2026 Addition |
|---|---|---|
| Scope | All QMS processes and requirements | + Clause 5.1.1 quality culture and ethical behaviour |
| Frequency | Risk-based, considering importance and previous results | + Review trigger when significant context changes occur |
| Auditor competence | Objectivity and impartiality | + Competence to evaluate cultural and behavioural requirements |
| Audit criteria | QMS requirements and planned arrangements | + Clause 5.1.1 behavioural indicators |
| Reporting | Results to relevant management | Unchanged |
Practical Steps for the Transition
Step 1: Update the audit programme document — Add Clause 5.1.1 as an explicit audit topic. Define the audit criteria for quality culture and ethical behaviour — what evidence will auditors look for?
Step 2: Develop audit questions for Clause 5.1.1 — Create a standard set of interview questions that auditors can use to assess quality culture. These should be open-ended and behavioural: "Tell me about a time when a quality issue conflicted with a delivery deadline. How was it resolved?"
Step 3: Train internal auditors — Ensure auditors understand the intent of Clause 5.1.1 and have the skills to conduct behavioural interviews. Consider a one-day training session on culture auditing techniques.
Step 4: Review the audit programme trigger process — Add a formal review step to the audit programme management process: when significant changes occur to the context of the organization (including climate-related changes), the audit programme must be reviewed and updated as necessary.
Step 5: Document the audit programme review — Maintain records of audit programme reviews, including the trigger for the review, what was assessed, and what changes were made. This documentation will be requested during transition audits.
[CALLOUT:best practice]
Quick Win: Add a standing agenda item to your management review: "Audit programme review — are there any significant context changes that require the audit programme to be updated?" This creates the documented evidence that the trigger requirement is being met.
[/CALLOUT]
What Auditors Will Look For in Transition Audits
During ISO 9001:2026 transition audits, certification body auditors will examine:
- Audit programme documentation — Does it explicitly include Clause 5.1.1 as an audit topic?
- Audit records — Do internal audit reports include findings related to quality culture and leadership behaviour?
- Auditor competence records — Is there evidence that internal auditors have been trained or assessed for competence in evaluating Clause 5.1.1?
- Programme review records — Is there evidence that the audit programme is reviewed when significant changes occur?
- Linkage to Clause 4.1 — If the organization has identified climate change as a relevant external issue, is this reflected in the audit programme?
Key Resources
- ISO 9001:2026 Transition GuideISO 9001:2026 Transition Guide/article/how-to-transition-iso-9001-2015-to-2026 — Full transition planning guide
- ISO 9001:2026 Quality Culture and Ethical Behaviour: Clause 5.1.1ISO 9001:2026 Quality Culture and Ethical Behaviour: Clause 5.1.1/article/iso-9001-2026-quality-culture-ethical-behaviour-clause-5-1-1 — Detailed guide to the new leadership requirements
- ISO 9001:2026 Climate Change Clause 4.1ISO 9001:2026 Climate Change Clause 4.1/article/iso-9001-2026-climate-change-clause-4-1 — Understanding the context of the organization
- ISO 9001:2026 Management Review: Clause 9.3ISO 9001:2026 Management Review: Clause 9.3/article/iso-9001-2026-management-review-clause-9-3 — Management review requirements
- Gap Analysis Template (Free PDF)Gap Analysis Template (Free PDF)/resources/gap-analysis-template — Assess your current audit programme
- Transition Checklist (Free PDF)Transition Checklist (Free PDF)/resources/transition-checklist — Step-by-step transition preparation
Frequently Asked Questions
Do internal auditors need to be certified to audit Clause 5.1.1?
No. ISO 9001:2026 does not require internal auditors to hold any specific certification. However, they must be competent — which means they must have the knowledge and skills to effectively evaluate the quality culture and ethical behaviour requirements. Organizations should document how they have determined that their internal auditors are competent to audit these requirements.
Can the same person audit Clause 5.1.1 who audits other clauses?
Yes, provided they are competent to do so and are not auditing their own work. The objectivity and impartiality requirements of Clause 9.2.2 apply equally to Clause 5.1.1 audits. In practice, this means that senior managers should not audit the quality culture of their own departments.
How often should Clause 5.1.1 be audited?
The audit programme must be risk-based. For most organizations, auditing Clause 5.1.1 once per year as part of the regular internal audit cycle is sufficient. Organizations with known culture challenges or recent leadership changes may benefit from more frequent audits.
What if internal auditors find evidence of poor quality culture?
Poor quality culture is a finding that should be reported to top management and addressed through the corrective action process. If the finding is significant — for example, evidence that management is actively discouraging the reporting of quality problems — it may constitute a major nonconformity against Clause 5.1.1.