Quality Culture and Ethical Behaviour in ISO 9001:2026: What 5.1.1 i) and 7.3 e) Ask, and How to Evidence It

Updated against the ISO 9001:2026 standard (sixth edition, published 16 September 2026). Reviewed by Kaushal Sutaria, Lead Auditor, Sterling International Consulting.

“Quality culture and ethical behaviour” is the phrase ISO’s Foreword uses for the most discussed addition to ISO 9001:2026, and the requirement is smaller and harder than the discussion suggests. Smaller, because it appears in exactly two requirements: top management shall promote quality culture and ethical behaviour (5.1.1 i)), and persons doing work under the organisation’s control shall be aware of the organisational quality culture and ethical behaviour (7.3 e)). Harder, because neither requirement can be met with a document. The standard’s only description of what it means is a NOTE: an organisation’s quality culture and ethical behaviour are reflected in its shared values, attitudes, practices and actions (5.1.1 NOTE 2). Values, attitudes, practices and actions are audited by interview and observation, which is why this is the one 2026 change that needs elapsed time rather than desk work.

Exactly where it appears in the standard

There is no documented-information requirement attached to any of these. The standard does not ask for a culture policy, a code of ethics, an ethics training programme or a culture survey. It asks that leadership promote and that people be aware, and it leaves the means to the organisation.

Why it was added, and why it is not soft

Quality management has always depended on people doing the right thing when no one is checking: recording the measurement that was taken rather than the one that was expected, stopping a job that is wrong, telling a customer the truth about a delay. The 2015 edition assumed that behaviour; the 2026 edition names it. Ethical behaviour is not an ethics-committee abstraction here. In the language of the standard it is the difference between a record that is evidence and a record that is fiction, and between customer communication that informs and customer communication that conceals (8.2.1). Every one of the standard’s records requirements depends on it. That is why ISO/TC 176 put it under leadership rather than under support: a culture in which people falsify or stay silent is created, or tolerated, at the top.

How auditors will test it

Certification auditors have been told, through Annex A and ISO 10010, to look for culture in values, attitudes, practices and actions. In practice that means four things.

Interviews at several levels with the same questions. A new joiner, a supervisor, a process owner and a member of top management will each be asked what the organisation expects of them in doing the job right and behaving honestly, what happens when someone raises a problem, and for an example. Consistency across levels is the evidence; contradiction is the finding.

Observation during the audit itself. How a manager responds when an auditor finds a nonconformity in front of the team is data. So is whether the production supervisor consults the operator or speaks over them.

Records read for what they imply. Concerns raised and acted on without penalty; nonconformities reported by the people who made them; a management review that discusses a failure rather than only successes; rework recorded rather than hidden in scrap.

The reward system. If the bonus scheme pays for output with no quality or integrity condition, the stated culture is contradicted by the organisation’s own money, and an experienced auditor will say so.

The Philippine context: hierarchy and the junior who must say stop

Philippine workplaces run on respect for seniority, and that is not a flaw; it is a strength when senior people use it to protect quality. The failure mode is specific and every auditor in the country has seen it: the junior technician who notices the out-of-tolerance reading and does not say so because the supervisor has already signed, the encoder who corrects a date because the manager asked, the team leader who ships a batch under pressure from sales. ISO 9001:2026 does not ask Philippine organisations to abandon hierarchy. It asks leadership to make it explicit that stopping a job for quality, and speaking up about a problem, is an act of loyalty rather than insubordination, and to prove it by how the next person who does so is treated. That single behaviour, demonstrated and repeated, does more for 5.1.1 i) than any values poster.

Double duty for BPO, shared services and offshore delivery

Organisations serving foreign clients already face culture and conduct audits from those clients: codes of conduct signed at onboarding, speak-up hotlines, integrity training, data-handling attestations. Those arrangements are usable evidence for 5.1.1 i) and 7.3 e), provided they belong to the organisation and not only to the client. The auditor’s question will be whether the expectations are the organisation’s own, applied across all accounts and to support functions, or a client-by-client overlay that disappears when the account does. Bringing the client-driven arrangements into the organisation’s own induction, values and speak-up route is the efficient way to meet both audits with one system.

Building the evidence trail in twelve weeks

Because the requirement is behavioural, the work is sequenced rather than drafted.

Weeks 1 and 2: leadership decides, in its own words, what it expects of people in doing the job right and behaving ethically, in five or six statements a line worker can repeat. If a values statement or code of conduct exists, test it against that standard and shorten it.

Weeks 3 and 4: define the route for raising a quality or ethical concern that does not depend on the person’s own manager, decide how concerns are acknowledged and answered, and decide, in advance, that no one who raises a concern in good faith is disadvantaged. Publish the route.

Weeks 5 to 8: put the expectations into induction and into a short briefing for everyone already employed, delivered by their own managers rather than by the quality function, so that 7.3 e) is met and the manager is seen to own it. Add the expectations to the policy if the policy is being revised anyway (A.5.2).

Weeks 9 to 12: leadership acts visibly. A concern raised is answered publicly. A job stopped for quality is praised in the weekly meeting. A management review discusses a failure. Where the reward system contradicts the expectations, it is changed. Then, before the transition audit, the internal auditor interviews people at three levels and records what was heard.

None of this needs a consultant to write it; all of it needs leadership to mean it. Sterling’s role in transitions is usually to run the interviews first, so that leadership hears what its people actually believe before it decides what to promote.

What a finding looks like

A minor nonconformity under 5.1.1 i) reads like this: top management could describe the organisation’s values, but three of four staff interviewed could not describe what the organisation expects of them in raising a quality concern, and two stated they would not raise one with their supervisor; no route for raising concerns other than through the line manager exists. A finding under 7.3 e) reads: induction material does not address the organisational quality culture or ethical behaviour, and staff employed before September 2026 have received no briefing. Both are closable within a quarter. What is not closable in a quarter is a culture in which the records are not believed, and that is the finding the standard was written to surface.

Frequently asked questions

What does ISO 9001:2026 require on quality culture and ethical behaviour? Two things: top management shall promote quality culture and ethical behaviour (5.1.1 i)), and people doing work under the organisation’s control shall be aware of the organisational quality culture and ethical behaviour (7.3 e)). NOTE 2 to 5.1.1 explains that these are reflected in shared values, attitudes, practices and actions.

Is a code of ethics or an ethics policy mandatory? No. There is no documented-information requirement attached to 5.1.1 i) or 7.3 e). A values statement or code of conduct is a common and sensible way to make the expectations visible, but the evidence auditors weigh is behaviour and interviews.

How will auditors check quality culture? By interviewing people at several levels with the same questions and comparing the answers, by observing how problems are received during the audit, by reading records for what they imply, and by checking whether the reward system contradicts the stated values.

Does this apply to contractors and agency staff? Yes. 7.3 applies to persons doing work under the organisation’s control, which includes contractors, agency workers and outsourced staff working within the organisation’s processes.

When does the requirement take effect? It is in force in the published standard. It applies to a certified organisation from its transition audit, and to a first-time certification to the 2026 edition from the first accredited audit against it.

Where can we get guidance on quality culture? ISO 10010, Quality management — Guidance to understand, evaluate and improve organizational quality culture, is cited in Annex A.5.1 and A.7.3; ISO 10018 on people engagement is cited in A.7.3.

We already pass client conduct audits. Does that help? Yes, if the arrangements are the organisation’s own and apply across all work, not a client-specific overlay. Bring them into your induction, values and speak-up route and they become evidence for both audits.

Read next

Leadership, the policy and 5.3 in ISO 9001:2026; internal audit for ISO 9001:2026; the clause-by-clause register; ISO 9001:2026 for BPO and IT companies; the ISO 9001:2026 playbook; and ISO 9001:2026 training.

Sources

ISO 9001:2026, Quality management systems — Requirements, sixth edition (published 16 September 2026): Foreword, 5.1.1 i) and NOTE 2, 7.1.4 NOTE, 7.3 e), 8.2.1, Annex A.5.1, A.5.2, A.7.3. ISO 10010, Quality management — Guidance to understand, evaluate and improve organizational quality culture. ISO 10018, Quality management — Guidance for people engagement.