The standard, the ISO 9000 family, and how to read it
You will be able to open ISO 9001:2026 at the right page, tell a requirement from a note and from Annex A, and read the six words that decide how much work a clause creates.
By the end of Module 1 you will be able to:
- Find any requirement in ISO 9001:2026 in under a minute and say whether what you are reading is a requirement, a note or informative guidance.
- Apply the terminology A.2 clarifies under a) to f), appropriate, applicable and as applicable, consider and take into account, continual, ensure, the two documented information phrases and strategic direction, and say what each one costs you in work.
- List the changes from the 2015 edition clause by clause and state what each one means for a system that is already certified.
- Build a twelve month implementation plan with phases, roles, a steering meeting agenda and a documentation list that contains no quality manual.
- Complete a Gap Assessment line, choose one of the four statuses, and write a justification for not applicable that survives a stage 1 audit.
- Write a scope statement under 4.3 that states the types of products and services covered and justifies any requirement determined not applicable.
This course is for the person who has to build the system, upgrade it or run it. Everything in it assumes you will be sitting with the standard open, a site around you and a certification audit somewhere in the diary. This first module puts the document in your hands, shows you what changed in the sixth edition, and turns the whole thing into a twelve month project with dates, owners and a gap assessment you can start on Monday.
The case study that runs through the course is Mzansi Fresh Meals, a chilled ready meals site in Kempton Park, Gauteng: 400 people on two shifts, 38 products, about 1.2 million meals a month, certified to a GFSI benchmarked food safety scheme but not to ISO 9001. The case is built from real audit patterns and no real company is named. Your role through the course is fixed: you are the second person on the project behind Nomvula Khumalo, the QA manager, who has two days a week for it and a stage 2 audit targeted for September 2027. Every activity in this module can be done on your own site or on Mzansi Fresh Meals with the data supplied.
What is in the document, and which parts bind you
ISO 9001:2026 is the sixth edition, published on 16 September 2026. It cancels and replaces ISO 9001:2015 and it incorporates Amendment 1:2024, the climate change amendment. It is thirty six pages, and only about half of those pages are requirements. Knowing which half saves you a great deal of unnecessary work.
| Part of the document | What it is | Does it bind you? |
|---|---|---|
| Foreword | Who wrote it, what edition it is, and a list of the main changes | No, but the change list is the shortest honest summary of the revision |
| Introduction 0.1 to 0.4 | Benefits, the seven quality management principles, the process approach, PDCA, relationship with other standards | No. 0.1 says the document does not imply the need for uniformity, alignment of documentation to the clause structure, or use of its terminology |
| Clause 1 Scope | What the standard is for and who it applies to | Yes, it sets the frame: a) and b) |
| Clause 2 Normative references | One reference only, ISO 9000, undated | Yes. ISO 9000 definitions are part of this standard by reference |
| Clause 3 Terms and definitions | A limited set of core terms, 3.1 to 3.20, with sub-entries for quality management system, quality policy and quality objective | Yes, as definitions. ISO 9000 remains the normative reference for all quality management terms |
| Clauses 4 to 10 | The requirements. Every sentence with shall in it | Yes. This is the whole of what an auditor can raise a nonconformity against |
| Annex A | Informative clarification of structure, terminology and clauses | No. A.1 says it does not add to, subtract from or in any way modify the requirements |
| Bibliography | The other standards the notes point to | No |
Clause 1 is two lines that decide everything else. The standard specifies requirements for a quality management system when an organisation a) needs to demonstrate its ability to consistently provide products and services that meet customer and applicable statutory and regulatory requirements, and b) aims to enhance customer satisfaction through the effective application of the system. Then it says all the requirements are generic and the document is applicable to any organisation regardless of type, size, or the products and services it provides. NOTE 1 limits the words product and service to those intended for, or required by, a customer. NOTE 2 says statutory and regulatory requirements can be expressed as legal requirements. That is your licence to leave your internal housekeeping out of the scope and to call R638 a legal requirement in your register.
Clause 2 and clause 3: the words the standard owns
Clause 2 has one entry: ISO 9000, Quality management, Fundamentals and vocabulary. It is cited undated, which means the latest edition applies. The 2015 edition cited ISO 9000:2015 by date. Practically, buy ISO 9000 as well. Half the arguments in an audit are vocabulary arguments, and the auditor will use the ISO 9000 definition.
Clause 3 is new work in this edition. The 2015 edition simply pointed at ISO 9000 and listed nothing. The 2026 edition brings a limited number of core management system terms into the document itself, from the first entry, organisation, through to the last, monitoring. Six of them change how you build the system.
Documented information (3.10)
Information required to be controlled and maintained, and the medium on which it is contained. The notes say it can refer to the management system including its processes, to information created in order for the organisation to operate, and to evidence of results achieved. One word covers your procedures, your specs and your records. There is no separate category called a record in this standard.
Risk (3.7)
Effect of uncertainty. Note 1 says an effect is a deviation from the expected, positive or negative. Note 5 says the word risk is sometimes used when there is the possibility of only negative consequences, which is how clause 6.1.2 uses it: risks that can have an undesired effect.
Process (3.8)
Set of interrelated or interacting activities that uses or transforms inputs to deliver a result. Note 2 is the one that builds your process map: inputs to a process are generally the outputs of other processes.
Competence (3.9)
Ability to apply knowledge and skills to achieve intended results. Not attendance, not a certificate on a wall. If your training matrix records who sat in the room, it records attendance, and clause 7.2 asks for something else.
Effectiveness (3.13)
Extent to which planned activities are realised and planned results are achieved. Every time the standard asks you to evaluate effectiveness, it is asking you to compare what you planned with what happened.
Requirement (3.14)
Need or expectation that is stated, generally implied or obligatory. Note 1 explains generally implied as custom or common practice. That note is why a customer can raise a nonconformity about something that is not written on the spec.
Annex A is informative, and it is the first thing I read
Annex A carries no requirements. A.1 says so in one sentence: this information is consistent with the requirements and does not add to, subtract from or in any way modify them. It also says the requirements are intended to be considered from a systems perspective rather than in isolation. Read it anyway, and read it before clause 4, because three passages in it will save you months.
- A.2 first paragraph: the clause structure of the requirements is not intended as a model for documenting an organisation's policies, objectives or processes. Your document set does not have to run 4.1, 4.2, 4.3. It should reflect the terms and processes used inside your business.
- A.2 second paragraph: lists within clauses are numbered solely to support identification and citation. Unless expressly stated, the order of items in a list does not indicate any prescribed sequence, priority or relative importance, and all listed items apply as written. So 5.1.1 a) is not more important than 5.1.1 l), and you cannot work down a list and stop half way.
- A.3: a requirement can be determined as not applicable only if this does not affect the organisation's ability to ensure conformity of products and services, enhance customer satisfaction or fulfil applicable statutory and regulatory obligations. Not applicable means considered, decided and justified, not forgotten. Lesson 5 works this properly.
A.2 then clarifies terminology under six lettered items, a) to f), and between them they cover ten terms. I put this table on the inside cover of my copy, because most of the arguments I have had with consultants and with auditors are arguments about one of them.
| Term | What A.2 says it means | What it costs you |
|---|---|---|
| Appropriate | Suitable for the organisation's context, and it involves judgement in determining what meets the requirement | You decide, and you must be able to explain the decision. An auditor tests the reasoning, not a benchmark |
| Applicable | If the requirement is determined to be relevant or possible, it applies to the organisation | You do not get to decide. If it is relevant, you do it |
| As applicable | A requirement, even if generally applicable under 4.3, can be determined as not applicable in some situations | You may leave it out of a particular situation, with a reason recorded |
| Consider | The organisation thinks about the topic to determine if it will be included in decisions or actions | You must show you thought about it. The answer may be no, and that is a complete answer if it is recorded |
| Take into account | Thinking about a topic and including it in decisions or actions | Stronger. The topic has to show up in the output, not only in the minutes |
| Ensure | There is a responsibility for making a specified result exist or occur. It refers to accountability for the result and not to performing every related activity directly | Actions can be delegated. Accountability cannot. This is the sentence that lets a managing director delegate without escaping |
| Continual | Duration that occurs over a period of time, but with intervals of interruption. The term continuous does not appear in the document and indicates duration without interruption | One word to change in your policy, your objectives and your procedures. It is also the fastest way an auditor judges how carefully the system was written |
| Shall be available as documented information, and documented information shall be available as evidence of | The first refers to the availability of information obtained, used or provided by the organisation. The second refers to the retention of objective evidence, and as evidence of does not imply legal evidential requirements | This is the sentence that tells you which of your papers is a live document you keep current and which is a record of something that happened |
| Strategic direction | Coordinated decisions, plans and actions that guide the organisation towards achieving its objectives | It is what 5.2.1 e) means when it says the policy supports the strategic direction, so you need to be able to say what yours is |
A.2 c) is explicit. Continual indicates duration that occurs over a period of time but with intervals of interruption. The term continuous does not appear in the document and indicates duration without interruption. Continual is the appropriate word for improvement in quality management. If your policy, your objectives or your procedure says continuous improvement, change it before the certification body reads it. It is a small thing that tells an auditor exactly how carefully the system was written.
Four of the twelve items in clause 5.1.1 open with ensuring, a), b), c) and e). The managing director says he cannot personally ensure four things at once and asks you what he is actually signing up to. What do you tell him?Tap to see the answer
How to read a clause, in six passes
- Read the clause once for shape. Count the shalls. A clause with one shall and a list under it is one requirement with parts, not six requirements.
- Underline every appropriate, applicable, as applicable, consider, take into account and ensure, and write the A.2 meaning in the margin.
- Find the documented information sentence. Either the clause says information shall be available as documented information, or documented information shall be available as evidence of something, or it says nothing and the decision is yours under 7.5.1 b).
- Read the notes. Notes are not requirements, but a note is where the drafters put the checklist. The 4.1 notes give you the external and internal issue categories free of charge.
- Read the matching Annex A clause. A.4.3 tells you what a scope statement should define. A.6.1.2 tells you that risk-based thinking does not imply a formal risk management process. Both are arguments you will need.
- Write the evidence line last: if an auditor asked me to prove this tomorrow, what would I put on the table, and who owns it?
ISO 9001:2026 itself, then ISO 9000 for the vocabulary, because clause 2 makes it normative. ISO 9002 gives guidance on applying the requirements of ISO 9001 and ISO 9004 gives guidance on achieving sustained success, and 0.4 says so; those two are useful and neither is required. Do not buy a template pack. You are about to see why in lesson 4.
- Open your copy at clause 4 and mark every shall in clauses 4 to 10 with a highlighter. Count them. That number is the size of your gap assessment.
- Write the A.2 terms on the inside cover with their meanings, a) to f), and add the sentence from A.2 about list order.
- Search your existing policy, objectives and procedures for the word continuous and change every one to continual.
- Find one sentence in your current documentation that was written because somebody thought the clause structure was a documentation model, and mark it for deletion.
What you know
- Clause 4.3 says the scope shall be available as documented information and shall state the types of products and services covered.
- Clause 7.2 says appropriate documented information shall be available as evidence of competence.
- Clause 7.5.1 b) says the QMS shall include documented information determined by the organisation as being necessary for the effectiveness of the QMS.
- Clause 6.3 says the organisation shall consider seven items when planning changes to the QMS.
- Mzansi Fresh Meals facts: no quality scope is written; the FSSC scope covers manufacture of chilled ready meals at the Kempton Park site; a training matrix exists for operators and nothing for planners, buyers, sales, NPD or supervisors; the customer audit that was failed was failed on missing induction assessments for agency staff.
- Annex A.1 says the annex does not add to, subtract from or in any way modify the requirements.
Your task
- Take the four clause extracts below and, for each, say whether the documented information is required by the standard or is the site's choice, and name the record Mzansi Fresh Meals would put on the table.
- For each extract, write the A.2 meaning of the qualifying word used in it and say what it means for the amount of work.
- Write one sentence you would say to the managing director explaining why Annex A cannot create work for the site.
Compare with a model answerWrite yours first, then tap
Extract 1 is required: a written scope statement, available as documented information, naming manufacture of chilled ready meals at Kempton Park. Extract 2 is required as evidence: competence records for every person whose work affects QMS performance, which at Mzansi means extending the matrix beyond operators to planning, procurement, sales, NPD and supervisors, and fixing the agency induction assessments that cost the R1.4 million listing. Appropriate means the site judges what evidence is suitable, so a signed assessment is fine and a certificate from a college is fine; the judgement must be explainable. Extract 3 is the site's choice under 7.5.1 b), so nothing is automatically required. Extract 4 requires no document at all: consider means think about the seven items and be able to show you did, which one change record with seven headings achieves. The sentence for the managing director: Annex A explains what the requirements mean and cannot add a single thing to what we must do, so if anyone quotes Annex A at us as a reason to build something, the answer is to show them A.1.
- Only clauses 4 to 10 create requirements. The foreword, the introduction, Annex A and the bibliography do not.
- Clause 2 cites ISO 9000 undated, so the latest edition of the vocabulary applies.
- A.2 says the clause structure is not a documentation model and list order carries no priority, and all listed items apply as written.
- A.2 a) to f) decide the workload: appropriate, applicable and as applicable, consider and take into account, continual, ensure, the two documented information phrases and strategic direction.
- Continual, never continuous.