ISO 9001:2026 internal audit: rebuilding the checklist and briefing your auditors

Written from the ISO 9001:2026 standard (sixth edition, published 16 September 2026). Reviewed by Kaushal Sutaria, Lead Auditor, Sterling International Consulting.

Clause 9.2 of ISO 9001:2026 is unchanged in substance, so the way you run internal audits does not change: a programme, planned intervals, defined criteria and scope, impartial auditors, reported results, prompt correction. What changes is the criteria: from your transition onwards, your auditors audit against the sixth edition, published 16 September 2026. The work: re-base the programme on the 2026 standard, rewrite the checklist around the new and strengthened requirements, brief the auditors on what is new, what is renumbered and what is only a NOTE, and record a full audit against ISO 9001:2026 before the certification body arrives.

What changes in the internal audit when clause 9.2 does not?

The mechanics stay and the content moves. Clause 9.2 still asks for audits at planned intervals that tell management two things: that the QMS meets the organisation’s own requirements as well as those of the standard, and that it is effectively implemented and maintained. The standard is now ISO 9001:2026, so every plan, checklist and report naming it changes.

Stays the same under 9.2	Changes for the 2026 edition
A programme: frequency, methods, responsibilities, planning requirements, reporting	The criterion in every plan: ISO 9001:2026 plus your own requirements
The programme weighs process importance, changes affecting the organisation and previous results	The transition is such a change, so it moves up the programme
Criteria and scope defined for each audit	Checklists rewritten; numbering corrected (6.1.1 to 6.1.3; no 10.3)
Auditors selected for objectivity and impartiality	Every auditor has read the 2026 standard and been briefed
Results reported to management; correction and corrective action without undue delay	Findings against the changed requirements closed before the transition audit
Documented information available as evidence of the programme and results	Every record names the edition audited against

The one wording change touching 9.2 runs through the edition: “retain” has become “documented information shall be available as evidence of” (Annex A.2 e)), creating no new record.

How do you re-base the audit programme on the 2026 standard?

Five steps inside one audit cycle. Skipping the first is the commonest mistake we see: an auditor working from a summary or a slide deck is not auditing against the criterion, and the certification body’s auditor notices in the first interview.

1. Obtain the standard. A licensed copy of ISO 9001:2026 for every auditor.
2. Map the changes. From the clause-by-clause register, list the new items, the strengthened items and the renumbering: 6.1 split into 6.1.1 to 6.1.3; 10.3 absorbed into 10.1; Annex A rewritten as A.1 to A.10; Annex B removed.
3. Re-sequence the programme. The transition is a change affecting the organisation: schedule one full-system audit against the 2026 standard after the documentation switch-over and before the transition audit slot.
4. Rewrite criteria and checklists. From the switch-over date every plan names ISO 9001:2026 as the criterion and the 2015 checklist is withdrawn.
5. Close the loop. Report to management review, correct and take corrective action without undue delay, and keep the closure evidence.

Timing is set by Global ACI-TECH-3-TR 2029-09-30 (M). Issued on 4 September 2026, it appeared on 16 September 2026 alongside the standard itself: the transition ends on 30 September 2029, and ISO 9001:2015 certificates lose their validity after that date. Your certification body chooses whether the transition audit rides on a scheduled surveillance or recertification audit or stands alone as a special transition audit, whether it is conducted on site or remotely by ICT, and whether additional audit time, justified under ISO/IEC 17021-1, is needed. Accredited 2026 certificates appear during 2027 as accreditation is extended body by body, and no new certification may be issued to any edition but 2026 from 31 March 2028. A transition audit in a 2027 or 2028 surveillance visit needs its 2026-based internal audit in the months before; the free ISO 9001:2026 gap check gives the programme its starting point.

Which questions test the new and strengthened requirements?

One or two questions per changed item, with the evidence a competent auditor expects. It is not the whole checklist: Clause 8 is substantively identical, so the 2015 questions stand. Ask the person who does the work and record the answer as evidence.

Clause	What changed	Ask	Look for
4.1	Determine whether climate change is relevant	“How was the relevance of climate change decided, and where is that decision recorded?”	A recorded determination with reasons; no carbon accounting
4.2 c)	Which interested-party requirements the QMS addresses	“Which of these requirements does the QMS address, and who decided?”	A decision column in the analysis
5.1.1 i)	Top management promotes quality culture and ethical behaviour	Director: “What have you done this year to promote it?” Operator: “What happens when someone reports a defect they caused?”	Consistent answers across levels; handled incidents
5.2.1 e), 5.2.2 d)	Policy reflects context and strategic direction; implemented, understood, applied	“How does the policy reflect your context? Give me a floor-level decision that applied it.”	Policy review record; interview answers
5.3 e)	Reporting on opportunities for improvement assigned separately	“Who reports opportunities for improvement to top management, and when did they last?”	The assignment; management review inputs
6.1.1 to 6.1.3	Risks analysed and evaluated, proportionate actions; opportunities separate, actions appropriate to context	“How was this risk analysed and evaluated? Why does the action on this opportunity fit your context?”	Analysis and evaluation columns; opportunities kept apart
6.3 c), e), f), g)	Information; communication; effectiveness evaluated; results reviewed	“Take the last significant change: who was told, what did you measure, where were the results reviewed?”	A change record; management review minutes
7.1.6	Knowledge retained, applied and shared	“When an experienced supervisor left, how was their knowledge kept and shared?”	Handover records; updated instructions
7.3 e)	Awareness of quality culture and ethical behaviour	“What does ethical behaviour mean in your job?”	Answers in the person’s own words
8.2.1 e)	Contingency actions cover disruptions to provision	“What do customers hear from you when a typhoon stops the line?”	Customer communication for disruption
9.1.3 e), f)	Effectiveness of actions on risks and on opportunities evaluated separately	“Where is the evaluation of whether the action on this opportunity worked?”	A separate analysis for each
9.3.2 c), g), h)	Inputs: changed interested-party expectations; effectiveness of actions on risks; on opportunities	“Show me the last management review input on changed interested-party expectations.”	Inputs and minutes
10.1	Improvement covers processes and future needs and expectations	“Which improvement addressed a future need rather than a current problem?”	Improvement records

How should you brief your internal auditors?

One session before the first 2026-based audit, covering the renumbering, the documented-information wording, the difference between a requirement and a NOTE, and interview technique for culture and opportunities. Most wrong findings against the 2026 standard come from an auditor who skipped one of the four.

Trap	Why it is wrong	Brief them to
Citing 10.3	There is no 10.3; continual improvement sits in 10.1	Cite 10.1
Citing 6.1 as one sub-clause	It is now 6.1.1, 6.1.2 and 6.1.3	Use the split numbering
Demanding a new document for 6.3 e) to g) or 7.3 e)	No new mandatory documents or records	Accept evidence in any form
Treating a NOTE as a requirement (7.1.3, 7.1.4, 8.2.1, 8.3.1, 8.3.3, 10.2.1)	NOTEs are informative	Use NOTEs for questions, never findings
Asking for an AI policy	ISO 9001:2026 does not mention AI; ISO/IEC 42001 covers AI management systems	Leave AI out
Asking for a quality manual, documented procedures or a management representative	None is required	Audit the process, not the binder
Auditing culture by asking for a culture document	5.1.1 NOTE 2: culture shows in shared values, attitudes, practices and actions	Ask the same questions at three levels; examine handled incidents

How do you record the audit against the new edition before the transition audit?

Structure the report the way the certification body will. The transition audit covers, at a minimum, three headings: the requirements ISO 9001:2026 changed; shifts in the organisation’s context since the last audit; and any further change the system now needs. A report on those three headings, with ISO 9001:2026 as the criterion, is the strongest single record you can hand over.

• Plan: criteria “ISO 9001:2026 and the organisation’s own requirements”; full-system scope; dated after switch-over.
• Checklist: 2026 numbering only, in Effivity or your document control, 2015 version withdrawn.
• Report: part 1, each changed requirement with evidence and conclusion; part 2, changes in context since the last audit, including the 4.1 climate change determination and the 4.2 c) decision on interested-party requirements; part 3, any other changes the audit shows are needed.
• Findings: correction and corrective action without undue delay, closure verified before the transition audit; complaints as a source of nonconformities (10.2.1 NOTE).
• Management review: results presented with the new and strengthened inputs at 9.3.2 c), g) and h).
• Records: programme and results available as documented information.

How does Sterling train internal auditors during the transition?

Three formats: public, in-house at your site, and online or hybrid, delivered by local Filipino lead auditors Mark Santos (Metro Manila), Zia Bautista (Cebu) and Ann Reyes (Davao). The in-house course is built on your own documentation, so the checklist your auditors leave with is the one they will use, and the practice audit covers one of your own processes (ISO 19011 method).

Participants receive a certificate of training, not certification; Sterling does not certify. Dates are on the training page and on request. Where a small team cannot audit its own work impartially, a Sterling lead auditor conducts the pre-transition internal audit and trains the team while doing it.

Brief your auditors before the certification body briefs you

An internal audit that still cites the 2015 edition is the first finding your certification body will make. Sterling’s ISO 9001:2026 internal auditor training rebuilds your checklist on your own documents, runs a practice audit and leaves your auditors with this page’s briefing in their own words. Book a public date, or bring the course in-house, through the internal auditor and lead auditor training page.

Frequently asked questions

Has clause 9.2 changed in ISO 9001:2026? Not in substance. Internal audits at planned intervals, a programme, defined criteria and scope, impartial auditors, reported results and prompt correction all carry over. What has changed is the standard the audit compares your system with; the records wording is new but creates no new record.

Do we have to audit against ISO 9001:2026 before the transition audit? The certification body will expect your own system to have checked the changed requirements first. Because 9.2 requires the programme to take account of changes affecting the organisation, and the transition is one, ignoring the 2026 standard until after the transition audit is difficult to defend.

Can our auditors keep the 2015 checklist and add a few questions? Adding questions is the right idea, but the numbering must change too: 6.1 becomes 6.1.1 to 6.1.3, 10.3 disappears into 10.1, Annex A is rewritten as A.1 to A.10 and Annex B is removed. A checklist citing the 2015 numbers shows the auditor has not read the 2026 standard.

Do internal auditors need new training for ISO 9001:2026? They need to have read the standard and been briefed on the changes; whether that is a formal course depends on their previous training. Auditors who have never audited risks and opportunities as separate items, or interviewed for culture, benefit from a transition course with a practice audit.

Can an internal auditor raise a nonconformity against a NOTE? No. The NOTEs in ISO 9001:2026, such as those on remote and hybrid work in 7.1.3, culture in 7.1.4, website and social media in 8.2.1, iterative design in 8.3.1 and 8.3.3, and complaints in 10.2.1, are informative. They help frame questions; a finding must cite a requirement.

What if the internal audit finds we are not ready? That is its purpose. Correct and take corrective action without undue delay, verify closure, and present the results to management review before the transition audit. A certification body reads an audit that found and closed real gaps as a system working, and one with no findings against a new edition as a system nobody looked at.

Read next

Start with what changed for a certified Philippine company, by department; then the risk register page for 6.1.2 and 6.1.3, the planning of changes page for 6.3, the transition audit page for what the certification body will review, and the quality culture evidence page for interview questions by level. The clause-by-clause internal audit checklist is on iso-philippines.com.

Sources

• ISO 9001:2026, Quality management systems — Requirements, sixth edition, published 16 September 2026 (ISO/TC 176/SC 2 with CEN): 4.1; 4.2 c); 5.1.1 i), k), NOTE 2; 5.2.1 e); 5.2.2 d); 5.3 e); 6.1.1 to 6.1.3; 6.3 c), e), f), g); 7.1.3 NOTE; 7.1.4 NOTE; 7.1.6; 7.3 e); 8.2.1 e), NOTE; 8.3.1, 8.3.3 NOTEs; 9.1.3 e), f); 9.2; 9.3.2 c), g), h); 10.1; 10.2.1 NOTE; Annex A.1 to A.10, A.2 e). https://www.iso.org/standard/9001
• Global ACI-TECH-3-TR 2029-09-30 (M), Transition Requirements for ISO 9001:2026, version 1.0, issued 4 September 2026, published 16 September 2026.
• ISO/IEC 17021-1 (certification-body audit time).
• ISO 19011:2018, Guidelines for auditing management systems.
• ISO/IEC 42001 (AI management systems).
• No Philippine regulatory fact is stated on this page.