How to Audit Planning of Changes in ISO 9001

Planning of changes is one of those ISO 9001 requirements that looks straightforward on paper but consistently trips up organisations during audits. Clause 6.3 is short. It sits quietly between quality objectives and the support clauses. But when you actually audit it, you quickly discover how much can go wrong when organisations change things without thinking them through. This article walks you through how to audit planning of changes in ISO 9001 effectively, what evidence to gather, what questions to ask, and where nonconformities typically hide.

What Clause 6.3 Actually Requires

Before you can audit a clause effectively, you need to understand what it actually demands. Clause 6.3 of ISO 9001:2015 states that when the organisation determines the need to change the QMS, those changes must be carried out in a planned manner. It then lists four specific considerations the organisation must address:

• The purpose of the change and its potential consequences
• The integrity of the QMS
• The availability of resources
• The allocation or reallocation of responsibilities and authorities

That is it. The clause does not prescribe a specific process, a particular form, or a mandatory approval workflow. What it requires is that changes to the QMS are considered and managed rather than just happening ad hoc.

This is where many auditors make their first mistake. They go looking for a change management procedure and, if they find one, tick the box. The real audit question is not whether a procedure exists. It is whether the organisation actually thinks through changes before implementing them, and whether there is evidence of that thinking.

What Counts as a Change to the QMS

One of the most useful things you can do before starting this section of an audit is get clarity on what the organisation considers a QMS change. This is broader than many people realise.

Changes to the QMS can include:

• Revisions to documented procedures, work instructions, or quality plans
• Changes to process flows or process ownership
• Introduction of new software, equipment, or technology that affects how quality is managed
• Restructuring of departments or reallocation of roles with QMS responsibilities
• Changes to the scope of the QMS itself
• Modifications to how customer requirements are captured or reviewed
• Changes to outsourced functions that affect product or service quality

Clause 6.3 is specifically about changes to the QMS, not changes to products or services (those are addressed under Clause 8.5.6). It is also separate from operational changes managed under Clause 8.1. Keep that distinction in mind as you plan your audit. Confusing these clauses is a common source of audit scope drift.

How to Plan This Section of the Audit

Good audit preparation makes the difference between a productive Clause 6.3 review and one that wanders without direction. Here is how to approach it.

Start With the Document Control History

Pull up the document register or document control log before the audit. Look for documents that have been revised in the past 12 to 18 months. Each revision is a potential QMS change. Your job is to trace whether those revisions went through any form of planned consideration or whether they were simply updated and reissued without any visible thought about consequences, resources, or responsibilities.

Ask for a List of Significant Changes

In your opening meeting or pre-audit communication, ask the organisation to prepare a summary of significant changes made to the QMS in the audit period. This does two things. It tells you what the organisation itself considers significant, which is useful context. And it gives you a starting list to sample from during the audit.

Do not rely solely on what they provide. Use it as a starting point, then look for changes they may have missed or not considered as QMS changes at all.

Review Organisational Changes

If there have been restructures, role changes, or departures of key quality personnel, these are prime areas to examine. A common Clause 6.3 failure occurs when someone with a defined QMS role leaves the organisation and their responsibilities are quietly absorbed by someone else with no formal reallocation, no assessment of that person's competence for the new duties, and no update to documented information.

Evidence to Gather During the Audit

Clause 6.3 does not explicitly require documented information. However, in practice, it is very difficult to demonstrate that changes were planned without some form of record. Most auditors look for evidence in the following areas.

Change Request or Change Approval Records

Many organisations use a change request form, an email approval chain, or a change log to record QMS changes. If the organisation has this, review a sample. For each change, check whether the four considerations from Clause 6.3 are addressed, even informally. You are not looking for a perfect template. You are looking for evidence that someone thought about consequences, resources, and responsibilities before the change went live.

Management Review Minutes

Management review is a natural place where planned QMS changes are discussed and approved. Check whether management review minutes reference proposed or completed changes and whether there is any discussion of resource implications or responsibility assignments. If significant changes happened but management review minutes show no awareness of them, that is a concern worth probing.

Training Records Following Changes

If a process changed, were the people who perform that process informed and trained? Training records following a documented change are indirect evidence that the organisation considered the human side of the change. A revised procedure with no corresponding training record is a flag. It suggests the change happened without adequate consideration of implementation.

Document Revision History

Look at the revision history fields within documents themselves. A document that has been revised multiple times in quick succession, with no clear rationale recorded, may indicate reactive rather than planned changes.

Audit Questions That Get Useful Answers

The quality of your questions determines the quality of your evidence. Here are some that consistently yield useful information when auditing Clause 6.3.

• Can you walk me through how a change to a key process would be managed from the point where someone identifies the need to change it?
• Who has the authority to approve changes to documented procedures?
• When was the last significant change made to the QMS? What prompted it, and how was it managed?
• When a process changes, how do you make sure the people doing the work are aware of and trained on the new approach?
• If a key person with QMS responsibilities left tomorrow, what would happen to their responsibilities?
• Have there been any changes to your outsourced providers or subcontractors in the past year that affected how quality is managed?

That last question is particularly useful. Organisations often manage operational supplier changes under Clause 8.4 but do not consider the QMS implications of those changes under Clause 6.3. For instance, if an organisation outsources a previously internal inspection function, that is a significant change to how the QMS operates. It should be planned, with consideration of how quality assurance responsibilities are now allocated and what resources are needed to manage the outsourced function.

Common Nonconformities Against Clause 6.3

After conducting hundreds of audits, certain patterns emerge. These are the most common ways organisations fail Clause 6.3.

Changes Made Without Any Visible Planning

The most straightforward nonconformity is finding a significant QMS change with no evidence of planning. For example, the organisation restructured its quality team six months ago, reassigning the internal audit function to a different person, but there is no record of that reallocation being formally considered or approved. The new person has not been assessed for competence. No training was provided. The change just happened.

This is a clear Clause 6.3 nonconformity, and it often links to a Clause 7.2 competence issue as well.

Consequences Not Considered

An organisation updates a core procedure but does not consider the downstream effects. For example, changing the inspection frequency for a critical process without assessing how that affects product conformity risk, customer requirements, or the organisation's ability to detect nonconforming outputs. The change is documented, but the potential consequences were never assessed.

Resources Not Confirmed Before Implementation

A new process is introduced that requires specific equipment or software, but the organisation implements the change before confirming that the resources are actually available and fit for purpose. This is particularly common in smaller organisations where decisions are made quickly and the QMS documentation lags behind operational reality.

Responsibilities Not Formally Reallocated

When roles change, the QMS documentation often does not keep up. You find a procedure that still names a person who left the organisation 12 months ago. The work is being done by someone else, but no one formally updated the responsibilities or assessed whether the new person is competent to carry them out. This is a recurring finding and one that is easy to substantiate with objective evidence.

Linking Clause 6.3 to Other Clauses

Clause 6.3 does not operate in isolation. When you find a Clause 6.3 issue, it often connects to other parts of the QMS. Being able to trace those connections makes your findings more robust and more useful to the organisation.

A Clause 6.3 failure around competence links directly to Clause 7.2. A failure around documented information not being updated links to Clause 7.5. A failure around management not being involved in approving significant changes may link to Clause 5.1 leadership and commitment. Understanding these connections helps you write findings that explain the systemic nature of the problem rather than treating each issue as isolated.

If you are building your skills in this area, the article on how to audit risk based thinking under ISO 9001 Clause 6.1 provides useful context for how planning requirements across Clause 6 connect to each other.

A Real World Scenario

Here is an example of how this plays out in practice.

During an internal audit of a mid-sized manufacturing company, the auditor noticed that the document register showed a significant revision to the production planning procedure eight months earlier. The revision changed how job cards were issued and who was responsible for signing off on material releases.

The auditor asked the quality manager how that change had been managed. The quality manager explained that the change came from a directive from the operations manager, who wanted to speed up the production flow. The procedure was updated and reissued. When asked whether the change had been formally assessed for its impact on the QMS, including whether the people now responsible for sign-off understood what was required of them, the quality manager paused. There was no change request. No formal approval. No training record for the production supervisors who now held the sign-off responsibility. The change had simply been made.

The auditor also found that two nonconforming outputs had been released to customers in the months following the change, both traced back to incorrect sign-off on material releases. The Clause 6.3 nonconformity was clear, and it linked directly to Clause 8.7 and the corrective action process.

This kind of audit trail, connecting a planning failure to an operational outcome, is exactly what makes internal audits valuable. For more on how to structure that kind of evidence, the article on how to audit Clause 8.7 nonconforming outputs in ISO 9001 is worth reading alongside this one.

Writing the Finding

If you identify a Clause 6.3 nonconformity, write it with enough specificity that the organisation can act on it. A vague finding like changes are not being planned in accordance with Clause 6.3 does not give the organisation enough to work with.

A stronger finding would read something like:

The revision to the production planning procedure (Document QP-014, Rev 3, dated March 2024) was implemented without evidence that the potential consequences of the change were assessed, that resources were confirmed as available, or that responsibilities were formally reallocated to affected personnel. No change request, approval record, or training record for the revised sign-off process was available. This is a nonconformity against ISO 9001:2015 Clause 6.3, which requires changes to the QMS to be carried out in a planned manner with consideration of purpose, consequences, integrity, resources, and responsibilities.

That finding is specific, evidence-based, and directly referenced to the clause. It gives the organisation a clear starting point for root cause analysis and corrective action. For guidance on structuring findings well, the article on how to write nonconformities that hold up covers the principles in detail.

Tips for Internal Auditors Specifically

If you are conducting internal audits rather than certification audits, you have an advantage. You have access to more context and more people. Use it.

Talk to people outside the quality team. Ask production supervisors, department managers, and frontline staff whether anything has changed in how they do their work in the past year. Their answers often reveal changes that the quality team is not even aware of, or changes that happened informally without going through any QMS process.

Also look at meeting minutes from operational team meetings, project kick-off records, or any internal communications that reference process changes. These are often where changes are first discussed, and they can show you whether the QMS planning requirements were considered at the point where the change was being decided.

If you are working toward your internal auditor credentials, understanding how to audit planning requirements like Clause 6.3 is a core skill. The ISO 9001 internal audit step by step guide covers the broader audit process and is a useful companion to this article.

What Good Looks Like

It is worth being clear about what a well-managed Clause 6.3 process looks like in practice, so you can recognise it when you see it.

An organisation doing this well will have a simple, consistent process for identifying and approving QMS changes. It does not need to be elaborate. It might be a shared document, a standing agenda item in management meetings, or a simple form. What matters is that before a change goes live, someone has recorded the purpose of the change, considered whether it could affect other parts of the QMS, confirmed that the resources are in place, and made sure that responsibilities are clear.

The evidence of that thinking is what you are looking for. When you find it, say so in your report. Acknowledging what the organisation does well is part of fair and balanced audit reporting.

Building Your Competence in This Area

Auditing planning clauses like Clause 6.3 requires a combination of technical knowledge and interviewing skill. You need to understand the clause well enough to recognise when it is being met and when it is not. You also need to ask questions in a way that surfaces real information rather than rehearsed answers.

At Audit Workshop, the ISO 9001 Internal Auditor and Lead Auditor courses cover exactly this kind of clause-by-clause audit approach, with practical exercises built around real audit scenarios. If you want to develop the skills to audit not just Clause 6.3 but the entire QMS with confidence, the training is designed by practitioners who have conducted hundreds of real audits, not just people who have read the standard.