For a Philippine BPO, IT services firm or shared-services centre, ISO 9001:2026 formalises what offshore clients already audit for: honest reporting, escalation that works, continuity when the lights go out and control over people and systems that are not in the building. The requirement that leadership promote quality culture and ethical behaviour (5.1.1 i)) with staff aware of it (7.3 e)) does double duty for client due diligence. The 7.1.3 NOTE and Annex A.7.1.3 and A.7.1.4 acknowledge remote and hybrid work; Annex A.5.3 sets the accountability rule for automated systems; 8.2.1 e) extends customer communication to disruptions. ISO 9001:2015 certificates are valid until 30 September 2029.
Gap assessment, documentation update, training, internal audit and support through your transition audit, delivered end to end by our expert, experienced, professional and friendly local Filipino lead auditors.
Key facts for BPO, IT and shared services
- ISO 9001:2026 was published on 16 September 2026 as the sixth edition; it cancels and replaces ISO 9001:2015 and incorporates Amendment 1:2024 (climate change).
- Global ACI (successor to IAF and ILAC since 1 January 2026) issued Global ACI-TECH-3-TR 2029-09-30 (M): transition to 30 September 2029; new and initial accredited certifications only to the 2026 edition from 31 March 2028.
- The standard does not mention artificial intelligence and does not name any software; it acknowledges remote work, digital systems and automated communication in NOTEs and Annex A, which are informative. For a BPO or IT company the practical question is different: the 2026 evidence trail is far easier to run on a platform than on shared drives, which is where Effivity, our group’s low-code GRC and ISO automation platform, and Vegam AI, our AI-native process automation platform, fit.
- ISO/IEC 27001:2022 shares the Harmonized Structure; its own transition closed on 31 October 2025. SOC 2 is an attestation report, not a certification.
- The transition audit may be combined with surveillance or recertification and may be conducted remotely by ICT, which suits multi-site delivery centres.
Client audits versus certification audits: what each one tests
A client audit tests whether your operation can deliver its account; a certification audit tests whether your management system conforms to ISO 9001:2026 and works. They overlap more in 2026 than in 2015, because the new requirements name the things client auditors already probe. The table separates the two so that the same evidence can be prepared once.
| Aspect | Client (second-party) audit | Certification (third-party) audit |
|---|---|---|
| Who conducts it | The client’s vendor-management, quality or risk team | An accredited certification body’s auditors, independent of you and of the client |
| Criteria | The contract, SLAs, the client’s code of conduct and control framework | ISO 9001:2026 Clauses 4 to 10 plus your own documented requirements |
| Scope | One account or programme | The QMS scope in 4.3: sites, services and processes |
| Sampling | The client’s transactions, agents and controls | Processes across the organisation, including support functions and leadership |
| Outcome | Scorecard, corrective action requests, commercial consequences | Certificate, nonconformities to close, surveillance cycle |
| What both now test | Escalation safety and honest reporting (5.1.1 i), 7.3 e)); continuity during disruption (6.1.2 NOTE 1); communication when service is disrupted (8.2.1 e)); control of remote staff and systems (7.1.3, 7.1.4, 7.5) | Same, expressed as ISO clauses |
| What only certification tests | — | Policy linked to strategy (5.2.1 e)); opportunities analysed and evaluated (6.1.3); planning of changes (6.3 e) to g)); management review inputs (9.3.2 c), g), h)); internal audit (9.2) |
Definition 3.18 in the 2026 edition describes first-, second- and third-party audits explicitly, and 9.3.2 d) 3) asks for trends in audit results at management review, which means client audit findings belong in the same review as certification findings.
Quality culture and ethical behaviour: the clause that does double duty
5.1.1 i) requires top management to promote quality culture and ethical behaviour, reflected in shared values, attitudes, practices and actions (NOTE 2), and 7.3 e) requires everyone working under the organisation’s control to be aware of it. Offshore clients already impose codes of conduct, integrity training, speak-up hotlines and data-handling attestations. Those arrangements are usable evidence for both audits, provided they belong to you and not only to the client.
The certification auditor’s question will be whether the expectations are the organisation’s own, applied across all accounts and to support functions, or a client-by-client overlay that disappears when the account does. The efficient answer is to bring the client-driven arrangements into your own induction, values statement and concern route, so that an agent on any account can say what the company expects of them in doing the job right and behaving honestly, and what happened the last time someone raised a problem. Auditors will interview a new hire, a team leader and an operations director with the same questions, look at how metrics are reported when a target is missed, and check whether the incentive scheme pays for handle time with no accuracy or integrity condition. Annex A.5.2 notes that the quality policy can reflect the organisation’s quality culture and expectations for ethical behaviour, which is a sensible place to state them once. The quality culture and ethical behaviour page has the twelve-week evidence sequence and a section on offshore delivery.
Remote and hybrid work under the 2026 standard
The requirements on infrastructure (7.1.3) and work environment (7.1.4) are unchanged, but the 7.1.3 NOTE now states that infrastructure applies to all types of work, on site, remote or a combination, and Annex A.7.1.3 and A.7.1.4 explain the intent. For a Philippine delivery centre with work-from-home agents, remote work is inside the audit scope, and so are the people who never enter the office.
Annex A.7.1.3 observes that hybrid and remote work and emerging technologies can introduce risks and opportunities for infrastructure management and control, which is a cue to put home connectivity, device provisioning and access to controlled documents into the risk and opportunity registers (6.1.2, 6.1.3). Annex A.7.1.4 observes that the work environment can evolve with emerging technologies and working practices, and that its management can become more complex when it is not under the organisation’s direct control; a home workstation is exactly that. Competence and awareness (7.2, 7.3) must reach remote staff, including the new 7.3 e) awareness of quality culture and ethical behaviour, and documented information controls under 7.5.3 (access, distribution, protection) apply to a laptop in Batangas as to a desk in Taguig. None of this requires a return-to-office policy; it requires that the QMS has visibly considered remote work, which the technology, remote work and AI page sets out reference by reference.
Automation, RPA and AI: the accountability rule in Annex A.5.3
ISO 9001:2026 does not mention artificial intelligence and adds no requirement to automate. What it adds is an accountability principle, in informative Annex A.5.3: where technologies support the management of the QMS, confidence in its integrity depends on reliable information for decisions and clarity about who has responsibility and authority for those decisions. For an operation running RPA bots, automated QA scoring or AI-assisted customer handling, that is the audit question.
The other references are consistent. Annex A.7.1.2 notes that technologies used to support people in their roles can create risks and opportunities relevant to the QMS; A.7.4 recognises automated interactions between devices as communication; A.7.1.5 recognises IT systems for data collection and analysis as measurement resources, which brings automated QA scoring under 7.1.5.1 and its fitness for purpose under evidence. In practice: if a bot processes claims, who owns the exception queue (5.3); if an algorithm scores calls, has its scoring been verified against a human sample (7.1.5.1); if a chatbot answers customers, does the communication meet 8.2.1 a) to e) and is the output owned (A.5.3); what risks and opportunities were determined when the tool was introduced (6.1.2, 6.1.3); are its records protected from unintended alteration (7.5.3.2)? Where AI itself must be governed, ISO/IEC 42001 is the AI management system standard and integrates under the same structure. Automation is also the most common opportunity a BPO will record under 6.1.3, with the benefit, feasibility, decision and result documented.
Customer communication under 8.2.1: SLAs, disruptions and the client portal
8.2.1 requires communication with customers on product and service information; enquiries, contracts and orders including changes; feedback and complaints; handling of customer property; and, changed in 2026, information on contingency actions, when relevant, including any related to disruptions to the provision of services. The new NOTE recognises websites, publications, social media, FAQs and training as channels. For a BPO the contract, the SLA reporting pack and the incident notification are all 8.2.1.
Two audit lines follow. First, 8.2.1 e): what does a client hear from you, through which channel and within what time, when a site loses power, a typhoon closes an office or a system fails, and is that agreed in the contract or the business continuity annex rather than improvised? Second, 8.2.2 to 8.2.4: how are the requirements for a new programme determined and reviewed before you commit, including the client’s regulatory requirements and the ones they have not stated but obviously need; how are verbal changes confirmed; and when the statement of work changes, is documented information amended and are the teams told? Customer property under 8.5.3 includes the client’s data, as the NOTE confirms, which is where the QMS meets the information security management system.
Disruption and the always-on operation
6.1.2 requires risks to be determined, analysed and evaluated, with actions proportionate to their potential impact on the intended results of the QMS, and its NOTE 1 names the ability to keep providing conforming services during and after a disruption. For a 24/7 operation that means grid failure, typhoon and flood access, connectivity loss, a cyber incident and the loss of a key site or supplier, each analysed rather than listed.
The climate determination in 4.1 sits alongside: for most Philippine delivery centres the honest determination is that climate change is relevant through typhoon exposure and power reliability, recorded as a decision with reasons, not as an emissions inventory. Clients expect redundancy, generator runtime and a work-from-home fallback; the QMS expects the same evidence to be tied to an analysed risk with an effectiveness check that feeds 9.1.3 e) and 9.3.2 g). Where an organisation holds ISO 22301, the business continuity system supplies the analysis; where it does not, the risk register with a tested continuity arrangement is sufficient, and the 6.1.2 NOTE 2 treatment options include retaining a risk by informed decision.
Running ISO 9001:2026 with ISO/IEC 27001:2022 as one system
ISO 9001:2026 and ISO/IEC 27001:2022 share the Harmonized Structure, so context, leadership, planning, support, performance evaluation and improvement can be run once for both. The ISO/IEC 27001:2022 transition closed on 31 October 2025, so a BPO that holds ISO/IEC 27001 already has a current 2022 certificate; the ISO 9001 transition adds to that integrated system rather than duplicating it.
The shared additions to make once are the interested-party decision (4.2 c)), the planning-of-changes items (6.3 e) to g)) and the management review input on changes in interested-party expectations (9.3.2 c)); the quality-specific additions are the culture and ethics requirements (5.1.1 i), 7.3 e)), the separation of opportunities (6.1.3) and the policy’s link to strategy (5.2.1 e)). One internal audit programme under 9.2 and one management review under 9.3 can carry both standards, and a certification body auditing the integrated system can conduct the ISO 9001 transition at a combined visit. SOC 2 sits outside this: it is an attestation report under a different framework, not a certification, and should never be described as one.
Transition plan for a multi-site delivery organisation
For a BPO or shared-services centre with a working 2015 system the transition is an update, usually complicated only by the number of sites and the proportion of remote staff. Plan it as a 6.3 change with communication, monitoring and review built in, and sequence the internal audit and management review before the certification body’s visit.
| Step | Action | Clauses | Typical timing |
|---|---|---|---|
| 1 | Obtain the standard; brief the country head, operations directors and the compliance lead on 5.1.1 i) and k), 5.2.1 e), 6.1.3, 6.3 e) to g) | 5 | Week 1 |
| 2 | Gap analysis against the published register, including client-driven controls that can serve as QMS evidence | 4 to 10 | Weeks 1 to 2 |
| 3 | Gap report with scope and the number before commitment (Sterling Revise™ week two) | — | Week 2 |
| 4 | Split and analyse the risk and opportunity registers; add disruption, remote-work and automation entries | 6.1.2, 6.1.3, A.7.1.3 | Weeks 3 to 6 |
| 5 | Revise the policy; fold client codes of conduct into the organisation’s own expectations; update the management review agenda | 5.2, 7.3 e), 9.3.2 | Weeks 3 to 6 |
| 6 | Leadership statements and concern route communicated to all sites and remote staff; awareness refresh | 5.1.1 i), 7.3 e) | Weeks 4 to 12 |
| 7 | Internal audit to the 2026 edition across a sample of sites and accounts; management review | 9.2, 9.3 | Weeks 12 to 16 |
| 8 | Transition audit at surveillance or recertification, on site or by ICT as agreed with the certification body once it is accredited for the 2026 edition | — | 2027 onwards |
Certification bodies must complete their own accreditation transition by 30 September 2027; ask yours for its date in writing and plan the visit against it.
How Sterling helps BPO, IT and shared-services firms
Sterling International Consulting has implemented and audited ISO 9001 and ISO/IEC 27001 for contact centres, IT services firms, healthcare BPOs and captive shared-services centres across the Philippines, from Makati, Cebu and Davao. We build the QMS and its evidence so that the same material satisfies the certification auditor and the client’s vendor-management team. We prepare you for an accredited certification body; we do not issue certificates.
Sterling Revise™ is the fixed-scope transition: week one documentation review and gap assessment against the ISO 9001:2026 standard, week two gap report with the number before you commit, weeks three and four plan, certification-body booking and first updates. For first-time certification we build to the 2026 edition from day one, integrated with ISO/IEC 27001 where you hold it. Where records live in Effivity, the split registers and new review inputs are configuration rather than rebuild. Call +63 977 815 1204, email info@iso-philippines.com or book a consultation.
Don’t take our word for it — read our clients’.
80+ verbatim client feedback letters → — searchable by standard and industry, quoted word-for-word from signed originals you can verify. And see the organizations we serve — Unilab, McDonald’s, SAP, GE, ZTE, JLL and more.
Plan your ISO 9001:2026 transition with Sterling
Free consultation for certified companies and first-timers · ISO 9001:2026 transition and implementation planning against the ISO 9001:2026 standard · itemized quotation within 48 hours. Call +63 977 815 1204, email info@iso-philippines.com, or book your slot →.
Frequently asked questions
How does the quality culture requirement relate to our offshore client audits? Directly. 5.1.1 i) and 7.3 e) require leadership to promote, and staff to be aware of, quality culture and ethical behaviour, which is what client due diligence probes through codes of conduct, speak-up channels and integrity training. Bring those arrangements into your own induction and values so they apply across all accounts, and the same evidence serves both audits.
Does ISO 9001:2026 cover work-from-home agents? Yes. The 7.1.3 NOTE states that infrastructure applies to all types of work, on site, remote or a combination, and Annex A.7.1.3 and A.7.1.4 explain that remote work can create risks and opportunities and complicate the work environment. Competence, awareness and documented information controls must reach remote staff. No return-to-office policy is required.
Does ISO 9001:2026 say anything about AI or RPA? It does not mention artificial intelligence and requires no automation. Annex A.5.3 states the principle: where technologies support the management of the QMS, confidence depends on reliable information for decisions and clarity about responsibility and authority. Automated QA scoring and chatbots are audited under 7.1.5, 8.2.1 and 5.3. ISO/IEC 42001 is the separate AI management system standard.
Can we run ISO 9001:2026 together with ISO/IEC 27001:2022? Yes. Both use the Harmonized Structure, so context, leadership, planning, support, audit and review can be shared. The ISO/IEC 27001:2022 transition closed on 31 October 2025; the ISO 9001 additions are made in the integrated documentation, and one combined visit can carry the ISO 9001 transition audit if your certification body audits both.
What changes in customer communication under 8.2.1? Item e) now requires information on contingency actions to include any related to disruptions to the provision of services, and a new NOTE recognises websites, publications, social media, FAQs and training as communication channels. For a BPO that means the incident notification and continuity communication agreed with each client are QMS customer communication and will be audited.
Is the transition a large project for a BPO? No, for a functioning 2015 system. It is a gap analysis, targeted updates to the policy, registers, change-planning method and management review agenda, several weeks of culture evidence, one internal audit and one management review to the 2026 edition, then a transition audit at a scheduled visit. Multi-site organisations add a sampling round; remote conduct by ICT is permitted.
Is our ISO 9001:2015 certificate still valid for client contracts? Yes, until 30 September 2029 under Global ACI-TECH-3-TR 2029-09-30 (M), provided surveillance continues. Clients verify that a certificate is current and accredited. From 31 March 2028 new and initial accredited certificates can only be issued to the 2026 edition, which is when procurement teams will start asking why a supplier still holds a 2015 certificate.
Read next
The ISO 9001:2026 playbook; technology, remote work and AI in ISO 9001:2026; quality culture and ethical behaviour; the clause-by-clause register of changes; ISO 9001:2026 certification support; and ISO 9001:2026 transition consulting from Sterling.
Sources
ISO 9001:2026, Quality management systems — Requirements, sixth edition (published 16 September 2026): 3.18, 4.1, 4.2 c), 4.3, 5.1.1 i) and k) and NOTE 2, 5.2.1 e), 5.3, 6.1.2 and NOTEs 1 and 2, 6.1.3, 6.3 e) to g), 7.1.3 NOTE, 7.1.4, 7.1.5.1, 7.2, 7.3 e), 7.5.3, 8.2.1 a) to e) and NOTE, 8.2.2 to 8.2.4, 8.5.3 NOTE, 9.1.3 e), 9.2, 9.3.2 c), d) 3), g), h), Annex A.5.2, A.5.3, A.7.1.2, A.7.1.3, A.7.1.4, A.7.1.5, A.7.4. Global ACI-TECH-3-TR 2029-09-30 (M), Transition Requirements for ISO 9001:2026 (issue date 4 September 2026; announced 16 September 2026). ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements (transition closed 31 October 2025). ISO/IEC 42001, Information technology — Artificial intelligence — Management system. ISO 22301, Security and resilience — Business continuity management systems — Requirements.
Certified to ISO 9001:2015? Take the free ten-minute ISO 9001:2026 gap check, then let a local Sterling lead auditor turn your result into your transition plan.