Preparing an internal audit in 2026: ISO 9001 has changed, and your evidence trail is what gets tested

This audit season is different. ISO 14001 was revised in April 2026 and ISO 9001 in September, so two transition clocks are already running, and ISO 45001 follows in 2027. Meanwhile the thing auditors test has not changed at all: not whether you have procedures, but whether you can produce evidence that they were followed.

What changed with ISO 9001:2026

The sixth edition of ISO 9001 was published in September 2026, replacing the 2015 version. Certified organisations have a 36-month transition, which runs to September 2029. Your 2015 certificate stays valid in the meantime, so there is no emergency, but there is a deadline that will arrive during a year when you are also busy with something else.

It is a revision, not a redesign. Process approach, PDCA and risk-based thinking are all still the backbone. The changes published by certification bodies summarising the new edition cluster around five themes:

• The Harmonised Structure, updated. ISO 9001 aligns to the current version of the common framework shared across management system standards, including the harmonised terms and definitions in clause 3. The 2015 edition already shared that structure, so this is not new ground. What it adds is tighter alignment with the editions of ISO 14001 and ISO 45001 you will be audited against next.
• Climate change. Organisations are expected to consider whether climate change is relevant to their context, in line with the amendment already applied across ISO management system standards.
• Quality culture and ethical behaviour. Leadership is expected to promote both, and awareness requirements extend to them. Commentators point to clauses 5.1.1 and 7.3 as the places this lands.
• Risks and opportunities, separated. The 2015 text treated them together and opportunities were routinely under-addressed as a result. The new edition splits them, around clauses 6.1.2 and 6.1.3.
• Annexes. Annex A has been reworked and expanded with fuller explanations, and Annex B disappears as a standalone annex, its relevant references folded into Annex A.

One thing the revision does not do, despite a lot of speculation: it does not introduce artificial intelligence requirements. If a consultant tells you ISO 9001:2026 obliges you to govern your AI, ask them to point at the clause. The governance obligations that do exist for AI at work come from the AI Act, which we cover separately in AI in QHSE.

Where ISO 14001 and ISO 45001 stand

If you run an integrated system, the thing to understand is that you are not waiting for one deadline. You are already inside two.

ISO 14001 was published as its fourth edition in April 2026, five months ahead of ISO 9001, and ISO 14001:2015 is now withdrawn. Its own three-year transition has been running since then. If you hold both certificates, you are managing two overlapping clocks rather than one, and they are set per certificate and per audit cycle, so confirm both end dates with your certification body rather than assuming they align.

ISO 45001 is the one still in progress. The Draft International Standard was registered in April 2026 and its ballot closed in September, with publication expected in 2027 and a transition period still to be confirmed by the accreditation bodies. The themes in the draft are a good signal of where occupational health and safety auditing is heading: psychosocial risk and mental health, worker wellbeing, remote and hybrid working arrangements, climate-related safety risks, responsibility along the supply chain, and a shift towards demonstrating that safety culture is effective rather than documented.

The useful conclusion is that all three revisions push in the same direction: less weight on the existence of documents, more weight on being able to show that something actually happened, to whom, when, and with what result. Work done on that now counts whichever edition you are audited against.

The six things an auditor asks to see

Strip away the preparation anxiety and an internal audit, like the certification audit it rehearses, tests six objects. If you can produce all six quickly, the rest is conversation.

Where the evidence usually falls apart

The action that closed without proof. The status says closed. The date is there. What is missing is the evidence of effectiveness: the follow-up check, the re-audit, the measurement that shows the problem did not return. A closure without verification is among the findings auditors raise most often, and it is almost always a system design problem rather than negligence. If the tool never asked for proof, nobody produced proof.

The version you cannot pin down. An inspection was carried out in March using a checklist that has since been edited twice. Which version was used? If the answer involves opening a file's properties and guessing, you have a documented information problem that the 7.5 requirements are written precisely to prevent.

The record written after the fact. Everyone recognises the week before an audit when records get tidied. The risk is not the tidying, it is that an auditor can often tell: three months of inspections all created on the same afternoon, timestamps clustered, signatures identical. Capturing at the moment of the observation, from the field, removes the temptation and the suspicion at once.

A six-week preparation sequence

This is written for an internal audit, but it is the same sequence that makes a certification audit uneventful.

1. Week one: close the gap list from last time

   Pull every action left open from the previous audit. Anything that cannot be closed with evidence in six weeks gets a revised deadline and a named owner today, not an optimistic status.

2. Week two: test six actions at random

   Pick six closed corrective actions from the last twelve months and try to reconstruct each one end to end. The ones that take longest tell you exactly where the audit will hurt.

3. Week three: pin your document versions

   Checklists, procedures, forms. One current version each, approved, dated, and identifiable from any record that used it.

4. Week four: rebuild the KPI pack from source

   Recalculate your indicators from the underlying records rather than from last quarter's slides. Where the two disagree, you have found something more useful than a clean number.

5. Week five: run the management review properly

   All required inputs, decisions written as actions with owners and dates. A review that produces no actions reads as a review that was not taken seriously.

6. Week six: do a dry run on one process

   Have someone independent audit a single process as if they were the certification body. One real rehearsal is worth more than four weeks of document polishing.

What the revision means for your audit programme

Three concrete adjustments to make during the transition, none of which need to wait for 2029.

First, add transition status to your audit programme as a line item. Each cycle should ask what has been mapped to the new edition and what has not, so the gap is visible monthly rather than discovered in year three.

Second, start generating evidence on the themes that are new. Culture, ethics and opportunities cannot be evidenced retroactively. An awareness session held in 2027 produces a record in 2027. If you begin at the end of the transition you will have procedures describing a culture and nothing showing it.

Third, if you are integrated, do the mapping once. The Harmonised Structure is what makes a single audit programme covering quality, safety and environment realistic instead of theoretical. With ISO 14001 and ISO 9001 both revised and their transitions running in parallel, mapping your evidence to the common clauses now means the ISO 45001 edition expected in 2027 becomes an update rather than a third project.

And if the honest answer to “where is the evidence” is a shared drive and four spreadsheets, that is the thing to fix before the next audit, not after it. We covered why in running QHSE on spreadsheets.

Frequently asked questions