At a glance
ISO 9001:2026 internal audit programme changes: how Clause 9.2 updates audit planning, risk-based scheduling, and what auditors check in transition audits.
- Focus: internal audit · clause 9.2
- Read time: 10 minutes
- Updated: August 10, 2026
TLDR
Use a risk-based approach for the ISO 9001:2026 internal audit programme. Consider past audit results. Link planning to QMS performance data.
ISO 9001 2026 audit programme changes update planning and management requirements. ISO 9001 2026 now requires companies to consider previous audit results. It also requires considering company changes during audit planning.
ISO 9001:2026 makes two significant changes to the internal audit requirements in Clause 9.2: auditors must now explicitly evaluate whether the quality culture and ethical behaviour requirements of Clause 5.1.1 are being met, and the audit programme must be reviewed when significant changes occur — including changes driven by climate change considerations under Clause 4.1. This article explains what these changes mean for audit planning, how to update your internal audit programme, and what competence requirements apply to auditors evaluating the new requirements.
What Changed in Clause 9.2
Clause 9.2 of ISO 9001:2026 retains the core structure from the 2015 edition — organizations must plan, establish, implement, and maintain an audit programme that covers all QMS processes and requirements. The changes are in the scope and triggers for the audit programme.
New Scope Requirement: The audit programme must now explicitly include evaluation of the Clause 5.1.1 quality culture and ethical behaviour requirements. This is not implied — it is a stated requirement. Auditors must assess whether top management is demonstrating the behaviours described in Clause 5.1.1, not just whether the documented procedures exist.
New Trigger Requirement: Review and update the audit programme when significant changes occur. This includes changes to the company's context under Clause 4.1. Clause 4.1 now explicitly lists climate change as a potential external issue. Companies in climate-sensitive industries may need to update programmes when climate risks change.
[CALLOUT:key insight]
The Practical Impact: Most organizations' internal audit programmes focus on documented procedures and process conformance. ISO 9001:2026 requires them to also audit leadership behaviour and organizational culture — which requires different audit techniques and auditor competence.
[/CALLOUT]
ISO 9001:2026 Internal Audit Programme: Key Changes
Stay Current
ISO expects the next edition in September 2026. Get source-checked weekly briefings.
Auditing Quality Culture: What It Means in Practice
Clause 5.1.1 of ISO 9001:2026 requires top management to demonstrate leadership and commitment to the QMS by, among other things, promoting quality culture and ethical behaviour throughout the company. Auditing this requirement is very different from auditing a documented procedure.
Effective ways to audit quality culture include:
Behavioural observation — Auditors observe how managers and supervisors respond to quality issues in real time. Do they prioritize quality over schedule pressure? Do they encourage reporting of problems or discourage it?
Interview sampling — Auditors interview employees at multiple levels to assess whether quality values are understood and lived. Questions like "What happens when you find a quality problem?" and "How does your manager respond when you raise a quality concern?" reveal cultural reality more accurately than document reviews.
Nonconformity trend analysis — The pattern of nonconformities reveals cultural signals. If nonconformities are consistently closed without genuine root cause analysis, it suggests a culture of compliance theatre rather than genuine improvement.
Management review participation — Auditors assess whether top management actively participates in management review or delegates it entirely. Active participation is evidence of commitment; consistent delegation is a warning sign.
Competence Requirements for Internal Auditors
ISO 9001:2026 does not specify auditor competence requirements beyond the general requirement that auditors must be objective and impartial. However, the new scope of Clause 9.2 — including the evaluation of quality culture and ethical behaviour — implies that internal auditors need competence in:
- Behavioural interviewing techniques.
- Organizational culture assessment.
- Understanding of the Clause 5.1.1 requirements and their intent.
- Ability to distinguish between documented compliance and genuine cultural commitment.
Companies that used internal auditors mainly as document checkers will need more skills. Provide training in audit interviewing techniques. Alternatively, use external auditors with culture assessment experience for the first transition audit cycle.
Updating Your Internal Audit Programme
A compliant ISO 9001:2026 internal audit programme must address:
| Programme Element | 2015 Requirement | 2026 Addition |
|---|---|---|
| Scope | All QMS processes and requirements | + Clause 5.1.1 quality culture and ethical behaviour |
| Frequency | Risk-based, considering importance and previous results | + Review trigger when significant context changes occur |
| Auditor competence | Objectivity and impartiality | + Competence to evaluate cultural and behavioural requirements |
| Audit criteria | QMS requirements and planned arrangements | + Clause 5.1.1 behavioural indicators |
| Reporting | Results to relevant management | Unchanged |
Practical Steps for the Transition
Step 1: Update the audit programme document — Add Clause 5.1.1 as an explicit audit topic. Define the audit criteria for quality culture and ethical behaviour — what evidence will auditors look for?
Step 2: Develop audit questions for Clause 5.1.1 — Create a standard set of interview questions that auditors can use to assess quality culture. These should be open-ended and behavioural: "Tell me about a time when a quality issue conflicted with a delivery deadline. How was it resolved?"
Step 3: Train internal auditors — Ensure auditors understand the intent of Clause 5.1.1 and have the skills to conduct behavioural interviews. Consider a one-day training session on culture auditing techniques.
Step 4: Review the audit programme trigger process — Add a formal review step to the audit programme management process: when significant changes occur to the context of the organization (including climate-related changes), the audit programme must be reviewed and updated as necessary.
Step 5: Document the audit programme review — Maintain records of audit programme reviews, including the trigger for the review, what was assessed, and what changes were made. This documentation will be requested during transition audits.
[CALLOUT:best practice]
Quick Win: Add a standing agenda item to your management review: "Audit programme review — are there any significant context changes that require the audit programme to be updated?" This creates the documented evidence that the trigger requirement is being met.
[/CALLOUT]
What Auditors Will Look For in Transition Audits
During ISO 9001:2026 transition audits, certification body auditors will review:
- Audit programme documentation — Does it explicitly include Clause 5.1.1 as an audit topic?
- Audit records — Do internal audit reports include findings related to quality culture and leadership behaviour?
- Auditor competence records — Is there evidence that internal auditors have been trained or assessed for competence in evaluating Clause 5.1.1?
- Programme review records — Is there evidence that the audit programme is reviewed when significant changes occur?
- Linkage to Clause 4.1 — If the organization has identified climate change as a relevant external issue, is this reflected in the audit programme?
Key Resources
- ISO 9001:2026 Transition GuideISO 9001:2026 Transition Guide/article/how-to-transition-iso-9001-2015-to-2026 — Full transition planning guide.
- ISO 9001:2026 Quality Culture and Ethical Behaviour: Clause 5.1.1ISO 9001:2026 Quality Culture and Ethical Behaviour: Clause 5.1.1/article/iso-9001-2026-quality-culture-ethical-behaviour-clause-5-1-1 — Detailed guide to the new leadership requirements.
- ISO 9001:2026 Climate Change Clause 4.1ISO 9001:2026 Climate Change Clause 4.1/article/iso-9001-2026-climate-change-clause-4-1-what-organizations-must-do — Understanding the context of the organization.
- ISO 9001:2026 Management Review: Clause 9.3ISO 9001:2026 Management Review: Clause 9.3/article/iso-9001-2026-management-review-clause-9-3-what-changes — Management review requirements.
- Gap Analysis Template (Free PDF)Gap Analysis Template (Free PDF)/resources/gap-analysis-template — Assess your current audit programme.
- Transition Checklist (Free PDF)Transition Checklist (Free PDF)/resources/transition-checklist — Step-by-step transition preparation.
Frequently Asked Questions
What are the ISO 9001 2026 audit programme changes?
ISO 9001 2026 Clause 9.2 changes require explicit consideration of previous audit results. They also require considering company changes when setting audit frequency and focus. This makes the internal audit programme more risk-based and dynamic.
Do internal auditors need to be certified to audit Clause 5.1.1?
No. ISO 9001:2026 does not require internal auditors to hold any specific certification. However, they must be competent — which means they must have the knowledge and skills to effectively evaluate the quality culture and ethical behaviour requirements. Organizations should document how they have determined that their internal auditors are competent to audit these requirements.
Can the same person audit Clause 5.1.1 who audits other clauses?
Yes, if they are competent and do not audit their own work. The objectivity and impartiality requirements of Clause 9.2.2 apply equally to Clause 5.1.1 audits. In practice, senior managers should not audit the quality culture of their own departments.
How often should Clause 5.1.1 be audited?
The audit programme must be risk-based and evidence-driven. For most companies, auditing Clause 5.1.1 once per year is sufficient. Include it in the regular internal audit cycle. Companies with known culture challenges may benefit from more frequent audits. Recent leadership changes are another trigger for extra audits.
What if internal auditors find evidence of poor quality culture?
Poor quality culture is a finding that should be reported to top management and addressed through the corrective action process. If the finding is significant — for example, evidence that management is actively discouraging the reporting of quality problems — it may constitute a major nonconformity against Clause 5.1.1.