What a Transition Audit Really Tests
Most organisations with a working ISO 9001:2015 system are closer to the 2026 edition than they think. This is a technical revision with a low overall impact. The structure is familiar, most requirements keep their intent, and a mature quality management system does not need to be rewritten. For background on the revision itself, see our overview of what is changing in ISO 9001:2026.
On this page
That is the good news, and it is also where organisations get caught. A small number of the changes are real, and they get audited properly. Some organisations respond by doing too little, updating a clause reference table and calling it finished. Others do far too much, buying climate strategies, new policies and thick procedures that nobody asked for. Neither approach passes the test an auditor actually applies.
The test is simple. Can you show, through real examples from your own business, that the changed requirements are working? After more than 500 external certification audits, I can tell you that a transition audit is rarely lost on paperwork. It is lost when the people in the room cannot connect the new requirements to anything that actually happened.
This article explains where findings tend to land, what conformance looks like in practice, what you do not need to create, and how to prepare your evidence. Your certification body sets the detail of how its own transition audits run, so confirm the arrangements with it early. If you are not certified yet, our article on whether to certify to ISO 9001:2015 now or wait is the better place to start.
How the Audit Is Usually Run
The transition normally happens at a scheduled surveillance audit or at recertification, or at a special audit arranged for the purpose. Whichever route applies, expect three things.
- The normal audit still happens. Transition coverage sits on top of the usual scope. It does not replace it.
- Every changed requirement gets covered. The auditor will look at the new and expanded items, plus anything that has changed in your business since the last audit.
- Top management will be involved. Several of the changes sit with leadership, so expect your audit plan to show time with top management and with the processes where the changes live.
If you run multiple sites, the transition is usually confirmed at the central function and with top management, because that is where most of the changes sit. Sampled sites are then audited against the 2026 edition as usual. Visiting every site purely for the transition is not normally necessary.
Exemplar Global Certified Training ProviderRTP No. 310970
Where Findings Tend to Land
These are the areas where I would expect nonconformities, roughly in order of how often they cause trouble.
Clause 6.3: Change That Was Planned but Never Followed Through
This is the most important clause to get right. The original considerations remain: the purpose of the change and its potential consequences, the integrity of the QMS, the availability of resources, and the allocation of responsibilities. The 2026 edition adds communication of changes, monitoring and evaluation of their effectiveness, and how the results will be reviewed.
Most organisations plan a change reasonably well. The gap sits at the end. Consider a distributor that moves to a new courier. The project plan is sound, the dispatch team is briefed and customers are told. But nobody decides how success will be measured, late deliveries creep up over the following months, complaints follow, and nobody ever sits down to review how the change went.
That is a finding against 6.3, normally a minor one. The change was planned, but the monitoring and review were not. Our guide to ISO 9001 clause 6.3 explains the requirement, and for a closer look at how auditors trace it, read how to audit planning of changes in ISO 9001.
Clause 6.1.3: Opportunities With No Way of Judging the Benefit
Clause 6.1 is now split. Clause 6.1.1 covers determining risks and opportunities, 6.1.2 covers actions to address risks, and 6.1.3 is a new clause covering actions to address opportunities. Those actions must be planned, integrated into the QMS and evaluated for effectiveness. Our article on how auditors test risk based thinking under clause 6.1 shows the kind of questions to expect.
The usual weakness is a list of opportunities with nothing behind it. An organisation records that it will trial a new market or automate a manual step, but cannot say how it will know whether the effort paid off. If the only record of effectiveness is a general statement in management review minutes, expect at least an observation, and a nonconformity if nothing was evaluated at all.
Before the audit, take each opportunity and write one line on how you will judge the benefit.
Clause 9.2.2: Internal Audits With No Objectives
Audit objectives must now be defined along with the criteria and scope for each audit. This is a small change and an easy one to miss. An audit programme that lists scope and criteria but no objectives is a nonconformity against 9.2.2 a), and the fix takes minutes. Add the objective to your audit plan template and use it from your next audit onward. Our guide to what clause 9.2 requires covers the rest of the clause.
Clause 9.3.2: Missing Management Review Inputs
Management review has a new input: changes in the needs and expectations of interested parties relevant to the QMS. The effectiveness of actions on risks and on opportunities are also now separated. If your agenda has not been updated, your minutes will show the gap.
Rework the agenda so that each input appears on its own line, and make sure the minutes show what was actually discussed. Our article on effective management review gives a structure you can adapt.
Internal Audit and Management Review Have Not Yet Covered the Changes
This one catches organisations that book their transition audit too early. If neither your internal audit nor your management review has looked at the 2026 changes, expect a finding, and your auditor's recommendation may depend on closing it. In limited cases the outcome may be softer where conformity with the changed requirements has clearly been shown through other evidence, but do not plan around that.
The practical answer is sequencing. Complete a gap review, implement the changes, run the internal audit, hold the management review, then have the transition audit.
You do not need to audit every process against the 2026 edition, and your internal auditors do not need a new external certificate to do it. Audits that cover the changed requirements, with defined objectives, criteria and scope, are enough.
The auditing guidelines have also been revised. If your internal audit programme draws on ISO 19011, read what changed from the 2018 edition and why ISO 19011:2026 has no transition period.
Clause 5.1.1 i) and 7.3 e): Quality Culture That Only Exists on Paper
Top management must now promote a quality culture and ethical behaviour, and people must be aware of them. Most organisations worry about what document to produce. Auditors worry about what actually happens.
Imagine a production team that completes its inspection records in one sitting before the shift ends, so that the order can leave on time. The figures look suspiciously tidy, and the supervisor knows about it. No culture statement will save that situation. The primary finding belongs against the release requirements in 8.6, because the records cannot be trusted as evidence that acceptance criteria were met, with leadership tolerance sitting in the root cause.
A framed values poster does nothing to fix that. Honest behaviour under delivery pressure does.
What Conformance Looks Like
Good transition evidence is usually ordinary. Here is what it looks like across the areas organisations find hardest to picture.
Quality Culture in a Small Business
A small fabrication workshop has no code of conduct. Last year the owner held back a late order because a weld test failed, even though the customer was chasing it, and the nonconformance record and emails are on file. Workers on the floor say they stop and report problems, and the nonconformance log shows regular reports from the shop floor.
That is conformance. Leadership behaviour, awareness and records all tell the same story, and no policy is needed to prove it. Quality objectives and awareness are still tested in the usual way, so make sure your people can explain what leadership commitment looks like where they work.
Contingency Communication Without a Continuity Plan
Clause 8.2.1 now requires the organisation to provide, when relevant, information related to contingency actions, including those related to disruptions to products or services. This is a customer communication requirement. It is not a requirement for a business continuity plan.
A printing company loses its scheduling software for a day and a half. Account managers contact every customer with a job due that week and keep a log of the calls. With no formal plan in place, the requirement has still been met, because customers were told promptly and a record exists.
A Single Risk and Opportunity Register
One combined register is perfectly acceptable, provided that risks and opportunities are clearly distinguished, each has actions, and effectiveness is evaluated. The method is your choice. The standard does not ask for separate registers or for ISO 31000.
A Reasoned Decision on Climate Change
Clause 4.1 requires you to determine whether climate change is a relevant issue, and relevant interested parties can have related requirements. This has applied since the 2024 amendment, so it is not a new requirement to be audited from scratch.
The question is how climate change affects your ability to achieve the intended results of your QMS: think heat, storms, supply disruption or energy cost. If you have thought about it and concluded, with reasons, that it is not relevant, that determination can stand. Our guide to clause 4.1 covers context in more detail.
A Change Without a Change Form
Nothing in 6.3 requires a procedure or a form. The word in the clause is “consider”, and an auditor should look for evidence that the items were thought about in proportion to the change and reflected in how it was planned. A meeting note, an email thread and an updated work instruction can do that job for a small change. A large one will need more.
What You Do Not Need to Create
A lot of money gets wasted during transitions. None of the following is required by ISO 9001:2026.
- A climate strategy or sustainability report
- A code of conduct or a stand alone culture policy
- A whistle blowing scheme
- A change management procedure or change form
- A business continuity or disaster recovery plan
- Separate registers for risks and opportunities
- Formal risk management under ISO 31000
- A full internal audit of every process against the 2026 edition
- External certificates for your internal auditors
Some of these may be useful for your business, and nothing stops you from having them. But if an auditor demands one as a condition of the transition, it is fair to ask which requirement they are auditing against. Guidance documents such as ISO 9002 explain intent and options. They do not add requirements.
The Trap of Saying Nothing Has Changed
“Nothing has changed since the last audit” is one of the least convincing things you can say. Auditors will check it against your organisation chart, your customers, products, suppliers, software, and your nonconformity and complaint trends. If a new system went live during the year, it will be sampled as a change under 6.3 and traced from the original trigger through to the review.
Even if nothing else has happened, there is still one change to show: the transition itself. Moving your QMS to the 2026 edition is a change to the system, and it can be sampled in exactly the same way. Plan it, communicate it, monitor it and review it, and you have a ready example.
Choose your best example before the audit, and make sure it can be followed from beginning to end.
The Smaller Changes Worth Checking
These rarely cause drama, but they take very little time to tidy up.
- Clause 9.1.2: customer satisfaction replaces customer perception, and complaints and social media are named as sources of information.
- Clause 10.1: continual improvement is now consolidated here, so old references to 10.3 need updating.
- Clause 10.2: customer complaints now appear in a Note as a source of nonconformities.
- Clause 8.1: “externally provided” replaces “outsourced”.
- Documented information: the wording changes to “available” and “available as evidence”. The intent is unchanged, and you do not need to reword your whole system.
- Integrated systems: an OH&S hazard register does not replace your QMS risks and opportunities. Each needs to relate to the intended results of its own system.
For a wider view of what auditors commonly raise, see common ISO 9001 nonconformities and how to avoid them and our focused look at clause 6 nonconformities.
If you also hold ISO 14001, you have a parallel transition to plan. Start with our ISO 14001:2026 transition guide, then read what changed from 2015 and the new clause 6.3 in ISO 14001:2026.
Exemplar Global Certified Training ProviderRTP No. 310970Your Pre Audit Checklist
Work through this list before your transition audit. Each line should point to something you can actually show.
- Context (4.1 and 4.2): your determination on climate change, with reasons, and any related interested party requirements.
- Leadership (5.1.1): real examples of top management promoting quality culture, ethical behaviour, and risk and opportunity based thinking.
- Risks (6.1.2): risks determined, analysed and evaluated, with actions.
- Opportunities (6.1.3): actions planned, integrated into the QMS, and with a stated way of judging effectiveness.
- Changes (6.3): at least one real change you can trace from trigger to review, including how it was communicated and monitored.
- Awareness (7.3): people who can explain quality culture and ethical behaviour in their own words.
- Customer communication (8.2.1): how you tell customers about contingency actions, with an example if a disruption has occurred.
- Customer satisfaction (9.1.2): complaints and other sources, including social media where relevant, are being used.
- Internal audit (9.2.2): objectives, criteria and scope defined for each audit, with the changed requirements covered.
- Management review (9.3.2): the new input covered, with risks and opportunities reported separately.
- Changes in your business: a list of what has changed since your last audit, including any new sites, so that your scope and certificate wording stay accurate.
If you do receive a finding, it does not mean you have failed. Minor nonconformities are common, and your auditor's recommendation can be made subject to closing them. Our guide to grading nonconformities explains how the difference between major and minor is decided, and the wider steps in preparing your organisation for an external audit all still apply.
Training for the Transition
If you are responsible for moving a QMS to the 2026 edition, or you audit one, the fastest route is to learn the changes from someone who audits them. The ISO 9001:2026 Transition Course at Audit Workshop covers what changed and how to apply it. If you are building your auditing skills, our ISO 9001:2026 Internal Auditor and Lead Auditor courses go deeper, and the Foundation course is the place to start if you are new to the standard.
Our courses are delivered by Dilawar Laghari, a certified lead auditor with over 14 years of compliance experience and more than 500 external ISO certification audits.
