Clause 9.2 of ISO 9001:2026 is unchanged in substance: internal audits at planned intervals, to establish whether the QMS conforms to the organisation’s own requirements and to the standard and whether it is effectively implemented and maintained (9.2.1), delivered through a programme that defines frequency, methods, responsibilities, planning requirements and reporting, considers the importance of processes, previous results and changes, and sets objectives, criteria and scope for each audit with objective and impartial auditors, reporting to relevant managers, timely correction and corrective action, and records of the programme’s implementation and results (9.2.2). What changes is the criteria. A certification body will expect at least one full internal audit against the 2026 edition, and a management review of its results, before it conducts your transition audit; an internal audit run on a 2015 checklist will not count, because it cannot have tested the new requirements. This page sets out what to change in the programme, in the checklist and in the auditors, with sample questions for every new or changed requirement.
Gap assessment, documentation update, training, internal audit and support through your transition audit, delivered end to end by our expert, experienced, professional and friendly local Filipino lead auditors.
The programme: three changes
First, the criteria. Every audit in the programme from now until the transition audit should cite ISO 9001:2026 as its criteria, alongside the organisation’s own documented requirements; an audit that cites the 2015 edition after your documentation has moved to 2026 numbering will produce findings that point at the wrong clauses. Second, the coverage. 9.2.2 requires the programme to consider changes affecting the organisation, and the transition is such a change; the new and changed requirements (culture and ethics, opportunities, planning of changes, the policy’s link to strategy, knowledge, management review inputs) need to be scheduled explicitly, not left to fall out of a process-based cycle. Third, the sequence. Plan the programme so that the full-system audit against the 2026 edition is complete, its findings closed, and its results reviewed at a management review, before the certification body’s transition visit; that sequence is what the certification body will look for as evidence that the transition is real.
The checklist: rebuild, do not annotate
A 2015 checklist cannot be patched, because the list lettering changed in 5.1.1, 5.3, 6.1.1, 6.2.1, 6.3, 7.3, 9.1.3 and 9.3.2, 6.1 acquired a third sub-clause, and 10.3 disappeared. Rebuild it from the 2026 standard. Three design rules make a rebuilt checklist useful rather than ceremonial. Write the questions in the language of the person being audited rather than the language of the standard, and keep the clause reference in a separate column for the report; a production supervisor cannot answer “how do you address 6.1.3” but can answer “what could this line do better, and who decided whether to try it”. Add a column for the evidence actually seen, not a tick box. And weight the new requirements: an audit that spends four hours on 8.5 and ten minutes on Clause 5 will miss what the transition audit will find. Sterling’s internal audit checklists are built on those rules; for the changed requirements the transition audit will weight most, the free online ISO 9001:2026 gap check gives you twenty questions with clause references and an instant scored report.
Sample questions for every new or changed requirement
| Requirement | Ask (to whom) | Evidence that satisfies |
|---|---|---|
| 4.2 c) which interested-party requirements the QMS addresses | To the quality manager: which stakeholder requirements did you decide to manage through the system, and which did you leave out, and why? | Interested-party table with an “addressed through QMS” column or equivalent |
| 5.1.1 i) quality culture and ethical behaviour | To three staff at different levels: what does this company expect of you in doing the job right and behaving honestly; what happens when someone raises a problem; give me an example. To top management: what did you do this quarter to promote it? | Consistent answers across levels; a route for raising concerns; leadership examples; induction content |
| 5.1.1 k) opportunity-based thinking | To top management: what opportunities did you decide to pursue this year, and how were they chosen? | Opportunity register with evaluation and decisions; leadership can describe them |
| 5.2.1 e) and 5.2.2 d) policy | To top management: how does the policy support where the business is going; give me a decision the policy shaped. To staff: what does the policy mean for your work? | Policy specific to the organisation; leadership and staff examples |
| 5.3 e) reporting opportunities for improvement | To the role holder: when did you last report an improvement opportunity to top management, and what happened? | Named role; management review inputs; minutes |
| 6.1.2 risks analysed and evaluated | To process owners: how did you rate this risk and why; which risks did you decide to accept? | Register with analysis and evaluation, treatment decisions, effectiveness results |
| 6.1.3 opportunities analysed and evaluated | To process owners: what could go better in this process; was it evaluated; what was decided? | Opportunity register with benefit, feasibility, decision and effectiveness |
| 6.3 c), e), f), g) planning of changes | Pick a recent change: who was told and how; what information did you need before starting; how did you know it worked; where was the result reviewed? | Change plan or record covering the seven considerations; review in management review |
| 7.1.6 knowledge retained, applied and shared | To a process owner: if your most experienced person left, what would be lost; where is that knowledge kept and who else can use it? | Documented methods, training and handover practices, knowledge in systems |
| 7.3 e) awareness of culture and ethics | To staff: see 5.1.1 i) | Induction and briefing records; interview consistency |
| 8.2.1 e) contingency information incl. disruptions | To customer-facing staff: what do customers hear from you when delivery is disrupted, and how is that agreed? | Contract terms, service terms, incident communications |
| 9.1.3 e) and f) effectiveness of risk and opportunity actions | To the quality manager: show me the analysis that says the risk actions worked, and the opportunity actions delivered | Analysis records; effectiveness columns completed with results |
| 9.3.2 c), g), h) management review inputs | To top management: what changed in stakeholder expectations this year and where was it reviewed; were the risk and opportunity actions reviewed separately? | Minutes with the three inputs and decisions |
| 10.1 improvement covering processes and future needs | To process owners: what did you improve this year that was not a fix to a past problem? | Improvement records showing process and forward-looking improvements |
| 4.1 climate change determination | To top management or the quality manager: did you decide whether climate change is relevant, and where is that recorded? | Dated determination with reasons |
Auditing culture and ethics without a document
This is the requirement internal auditors find hardest, because there is nothing to inspect. The method is triangulation. Ask the same three questions of people at three levels (a new joiner, a supervisor, a member of top management) and compare the answers; consistency is the evidence, contradiction is the finding. Observe: whether problems raised in the audit are received as information or as accusation, whether records show concerns raised and acted on without penalty, whether the reward system contradicts the stated values. Read what exists (values, code of conduct, induction material) last, not first, so that the document does not anchor the interviews. Report what was heard and seen, not a judgement on the culture, and cite 5.1.1 i) and 7.3 e) with the evidence. ISO 19011, cited in the 9.2.2 NOTE, remains the guidance for method; ISO 10010, cited in Annex A, is the guidance on quality culture itself.
The auditors: competence for the 2026 edition
7.2 applies to internal auditors as it does to anyone whose work affects QMS performance, and Annex A.7.2 NOTE 2 points to ISO 19011 for auditor competence. An auditor qualified on the 2015 edition needs, at minimum, a working knowledge of the clause-by-clause changes, practice in interviewing for culture and ethics, and the ability to evaluate analysis rather than the presence of a register. A half-day transition module with a practical exercise is proportionate for experienced auditors; new auditors need the full internal auditor course delivered on the 2026 standard. Keep the records; the certification body will ask how your auditors were brought up to date.
Don’t take our word for it — read our clients’.
80+ verbatim client feedback letters → — searchable by standard and industry, quoted word-for-word from signed originals you can verify. And see the organizations we serve — Unilab, McDonald’s, SAP, GE, ZTE, JLL and more.
Rebuild your internal audit programme for ISO 9001:2026
Free consultation for certified companies and first-timers · ISO 9001:2026 transition and implementation planning against the ISO 9001:2026 standard · itemized quotation within 48 hours. Call +63 977 815 1204, email info@iso-philippines.com, or book your slot →.
Frequently asked questions
Did clause 9.2 change in ISO 9001:2026? No. The requirements for internal audit and the audit programme are the same as in 2015; the wording on documented information changed to “shall be available as evidence of the implementation of the audit programme(s) and the audit results”.
Do we need an internal audit against ISO 9001:2026 before the transition audit? Certification bodies expect the system to have been internally audited against the new edition, with findings closed and the results reviewed by management, before they conduct the transition audit. Plan the programme so that this sequence is complete.
Can we reuse our 2015 internal audit checklist? Not without rebuilding it. The list lettering changed in eight sub-clauses, 6.1 gained a third sub-clause and 10.3 no longer exists, and the new requirements need their own questions.
How do you audit quality culture? By interviewing people at several levels with the same questions, observing how problems are received, checking that concerns raised were acted on without penalty, and comparing what is rewarded with what is stated. The evidence is consistency; the finding is contradiction.
Do internal auditors need retraining for ISO 9001:2026? Their competence must be evidenced under 7.2. A transition module covering the changes and interview practice for the new requirements is proportionate for experienced auditors; new auditors should be trained on the 2026 standard.
Is there a ready-made checklist? Not a public one for all of Clauses 4 to 10; a checklist worth using is rebuilt from the 2026 standard on the three rules above. For the changed requirements, the free online ISO 9001:2026 gap check gives you twenty questions with clause references and an instant scored report.
Read next
The plain-language checklist download; ISO 9001:2026 training; the clause-by-clause register; quality culture and ethical behaviour; management review inputs; and the ISO 9001:2026 playbook.
Sources
ISO 9001:2026, Quality management systems — Requirements, sixth edition (published 16 September 2026): 7.2, 9.2.1, 9.2.2 and NOTE, Annex A.7.2 and A.9.2. ISO 19011, Guidelines for auditing management systems. ISO 10010, Quality management — Guidance to understand, evaluate and improve organizational quality culture.
Certified to ISO 9001:2015? Take the free ten-minute ISO 9001:2026 gap check, then let a local Sterling lead auditor turn your result into your transition plan.
