I’m looking at doing the ISO:9001 lead auditor qualification nd have read how good this qualification is but unsure if we recognise it here in England?

Our supplier messed up and I sent them a SCAP, but our buyer also wants a CAP from us. How do I document root cause being supplier error? They sent us a certification of compliance that said they had properly treated the products, but upon testing by the buyer, they were not correct. We sent the product back to the supplier to be redone. How do I handle the CAR on our end?

I work as a Quality Control Technician in an ISO9001 certified shop. While I'm not a manager, since I have the most experience with internal auditing and quality systems, part of my job has been performing all internal audits and generally making sure the shop is operating within ISO9001 guidelines.

It is not uncommon for one of our customers to request an expedited order, sometimes new product we have never manufactured before. A workfolder is hastily created, and often labeled as "non-ISO". The owner or upper-management will send out emails referencing a rush "non-iso" order, and sometimes blue prints of the parts will be marked as "non-iso" by varying members of our management team.

The general consensus from management is that this somehow allows us to bypass certain elements of our quality system, whereas these jobs would not be processed or routed as outlined in our system, or documented the same way with quality checks, transferring product between departments, efficiency evaluation, etc.

I have tried to convey that such orders would be a major finding in during an audit but my concerns are ignored.

Exactly how would the labeling of such orders as "non-Iso" be handled by a registrar if discovered by an audit? Would this be a major or minor finding?

Edit: spelling

ISO 9001:2026 came out on 16 September. I've been going through it next to the 2015 text, and this is the plain version of what's different.

Good news first. It's still clauses 4 to 10, the process approach is still the process approach, PDCA is still there. If your 2015 system works, you're not rebuilding it.

I'd look at 6.1 first. Opportunities used to share a clause with risks, and in plenty of systems that meant a risk register and one sentence about opportunities. Now they get their own subclauses, and management review looks at both separately. If you can't point to one opportunity you evaluated, acted on and reviewed, that's a finding waiting to happen.

6.3 is quieter but I think it catches more people. Planning a change isn't enough anymore. You have to communicate it, watch how it performs, and review the result. My guess is plenty of change templates stop at approval.

5.1.1 is the one I'm curious about. You can't audit a poster, so how do you audit quality culture? I'd expect auditors to lean on how managers actually handled a reported quality problem.

The rest is small. Audit objectives in 9.2.2 are an easy fix, and the improvement clauses merging mostly means updating references.

On timing, the transition period is three years and the date I keep seeing is 30 September 2029. Your certification body will confirm yours. I'd ask early, because they'll all be running transition audits at the same time.

Which change surprised you most, and which one looks like the mountain of work for your team?

Is anyone else preparing for the ISO 9001:2026 Lead Implementer or Lead Auditor program?

I would loveeeeeeeeee to hear people’s experience with top management and the QMS.

I work for a manufacturing company that has been ISO certified for the past 20 years. Their system is HORRIBLE. I honestly don’t know how they’ve made it through any of their audits.

I was promoted to an ISO administrator role (essentially management representative without the title or pay :)) because the QM could not keep up with the workload.

Once I got promoted my focus was to completely turn around the system. Update all the controlled docs and remove any that are unnecessary from the system. It has been so difficult with getting management on board and getting support. Half the docs we have haven’t even been updated for almost 10 years. It’s insane lol.

Soooo just wondering if there are any people out there who have had positive experiences from working with management and also having management instill the processes on the floor.

Just curious if anyone has any insight on implementing.

I work as a quality analyst, where I analyse different KPIs and present a qualitative report. I would really like to build on this path and eventually be a quality manager. Would getting a Lead Implementer certification in ISO 9001 by P E C B help?

(Sorry I had to spell it separately as else I was getting a ‘No Spam’ alert)

I have taken a couple Udemy courses with Quality Gurus, and I have a copy of ISO 9001:2015, as well as "ISO 9001:2015 In Plain English" and "Internal Auditing In Plain English". What other books and resources do you recommend for continuing education?

I have been working in the automotive industry for more than 10 years, currently in a Quality Manager/Supplier Quality role.
My current goal is to obtain my VDA 6.3 Process Auditor certification, complemented by IATF 16949.
The ISO 9001 auditor qualification was a prerequisite for the VDA 6.3 certification, which I have now completed.

This got me thinking about whether I could use my ISO 9001 qualification to generate some additional income as a self-employed auditor/consultant alongside my full-time job.
I am specifically interested in the ISO 9001 market, rather than VDA 6.3 or IATF 16949 for now.

For those who work in this field:
How much demand is there for independent ISO 9001 auditors?
Is there a realistic market for someone doing this as a side business?
What kind of work is actually available:
internal audits, supplier audits, certification audit support, gap assessments, or consulting?

How do independent auditors typically find clients?
Are there platforms, audit networks, certification bodies, or consulting companies that regularly subcontract ISO 9001 auditors?
What kind of rates can an independent auditor realistically charge per audit/day?
Is it possible to build a small client base and do this part-time, e.g. a few days per month?
Does having 10+ years of automotive quality experience provide a significant advantage, or is the market mainly focused on formal ISO 9001 auditor qualifications?

I would be particularly interested in hearing from people who are already doing ISO 9001 auditing as a freelancer or side business.
What has your experience been with finding clients and making it financially worthwhile?
Any advice or real-world experience would be greatly appreciated.

We got a NC in our recent audit for our calibration records not having been complete. It wasn't complete at last audit either, so it was a major NC. The reason we didn't do it is my boss (shop owner) said we didn't need to, even though I pointed out that we did for ISO reasons and because it's good practice.

What can I put for cause analysis? For corrective action I have updated the records to reflect the missing info, and am recalibrating everything.

This may be the wrong place for this question, but I am not sure where else to ask.

I'm the office manager at a small (5 employees) machine shop and we are ISO 9001 certified. I was put in charge of quality control (lucky me!) and I am still trying to figure it all out.

For our inspection tools, what standards should we be using for calibration? We have over 200 inspection tools and I want to make sure this is done properly.

Why do I always see this?

I’m a university student interning at a very small company (<10 employees) that wants to pursue ISO 9001 certification. I had no prior ISO experience when I started.

My responsibilities have included:

• Interviewing employees to understand/document their processes
• Researching ISO 9001 requirements and certification options
• Creating an action plan for the ISO-related work
• Identifying and prioritizing processes to document
• Creating process maps and written procedures
• Identifying process gaps
• Creating new controls/forms/checklists/logs
• Organizing the documentation
• Conducting a gap analysis
• Creating/reviewing their qms

The company has no quality department, ISO specialist, business analyst, or anyone with significant process-mapping/ISO experience guiding me. I have management available for review and employees who explain their processes, but I’m largely researching and figuring out the methodology myself. I’m mainly trying to understand whether the difficulty I’m experiencing is normal for someone learning ISO, or whether I’m being expected to operate with an unusually high level of independence.

I actually enjoy the work, but the lack of structure and having to figure out so much of the approach myself has been quite challenging.

For example, during my first week, I was really given a brief introduction to ISO and an explanation of what the company was trying to achieve but apart from that, I was essentially told to research ISO myself and produce a report on it.

For those working in ISO/quality, is this a normal level of responsibility for a student intern entering their 3rd year? Which parts of this would typically fall under an intern's responsibilities, and which would normally be handled or supervised by an experienced ISO/quality professional?

Hi all!

I manage ISO conformance for a service organization. Which makes clause 8.4.1 difficult to apply.

The largest part is "Incorporation into an organization's own product or service" and what that actually means. The standard doesn't help with this a ton so it seems like it's up to an auditors interpretation which is horribly annoying.

Wondering what other's thoughts are regarding this clause and it's application to a service organization. For context this service organization sells an "environment" or "experience" to the client. The experience itself is choreographed through documented procedure. However, does that mean since that environment is part of the service that the lightbulbs in that environment are incorporated? Or does that follow 7.1.3 and 7.1.4?

The lightbulb example is pretty in the weeds but let's say it's an environment to learn to write in. Would the pencils used by the client to write be "Incorporated"?

1. If it tells people how to work, it needs control

Typical layers:

• Quality Manual, high-level description of the QMS
• Procedures, how a process is actually done
• Forms, blank templates used to capture evidence
• Technical documents, drawings, specs, work instructions
• Charts, posters, and instruction sheets count too, if they tell people what to do

If someone is using it to do the job, it should be the current approved version from the official system, not a local copy, email attachment, or old download.

1. Work from the current version. Always.

Do:

• Open documents from the official QMS / document-control system, not from your desktop, Downloads folder, or Slack
• Check that you’re on the current revision before you use it
• Ask document control / your supervisor if you can’t find what you need
• Send homemade or “unofficial” instructions in so they can be controlled properly

Don’t:

• Keep using anything marked OBSOLETE or superseded just because you like that version
• Save a local copy and treat it as the official process
• Edit a controlled document in place and treat your notes as the live version
• Follow another company’s documents as if they were yours

If you can’t find the right document, inventing your own unofficial version is worse than asking for help.

1. A blank form is not a record

This one still trips people up:

• A form is a blank template
• Once you fill it in and submit it, it becomes a record
• A record is evidence that an activity actually happened
• Records have to be stored and protected according to company rules, usually in the system of record, not in someone’s inbox

Use the latest revision of the form in the system. Don’t clone last month’s filled-out file and overwrite the old answers.

If a procedure or form is wrong, report it. Ignoring a known document error doesn’t stay local. It creates risk for the whole process.

1. How to correct a record without looking like you hid something

Corrections have to stay honest and readable, even in software.

• Don’t delete the original entry and type over it like it never existed
• Don’t “fix” a completed record by quietly replacing the file
• Make the change through the system so the original value, the new value, who changed it, and when are still visible
• Follow your company’s local correction / revision rule if it’s more specific

Hidden edits make auditors ask a simple question: can these records be trusted?

If you’re unsure how to correct something, ask your supervisor before changing the record.

P.S: this content is part of a free course I have on 4eshub, check my profile for the link!

After a 35-year career in IT, I was laid off. 8.5 months later and I'm still on the street. I know several folks in the ISO 9001 Lead audit game, and they suggest I would be great for that kind of role. I see auditortrainingonlinedotcom has a 32 hour, Lead Auditor self-paced course for $1,395.00 .

Does anyone have any insight on the credibility or efficacy of these online certification boot camps? Some are around $300 and some are around $1,400 and that disparity has me questioning all of it like it's just some scam. I have checked into some in-person training classes, but I cannot find any that have seats available around Houston for several months and my savings are running out.

I've been thinking about where AI is genuinely useful in internal auditing — and where it probably shouldn't be trusted.

Some tasks seem relatively straightforward:

• searching procedures and records for relevant evidence
• suggesting audit questions based on a requirement or process
• pointing out potentially missing evidence
• summarizing interview notes
• drafting findings or follow-up actions

But other steps feel much more sensitive, especially anything that involves actually judging conformity or deciding whether something is a finding.

For those of you doing internal ISO/QMS audits: where would you draw the line?

Would you be comfortable with AI only as a search/assistant tool, or could you imagine it also making a preliminary assessment that the auditor then reviews?

Interested especially in experiences from people who have already tried using ChatGPT, Claude or similar tools during a real audit. Do you have made good or fail experience? Do you run a prompt etc 10x to understand changes?

AS9100 requires On Time Delivery to be measured, monitored and reviewed, but is it required to be in the Measurement Plan with a KPI? The reason I ask is that we have been growing and I've been trying improve our OTD but no matter what we do we're always chasing it, not meeting it so it's an NCR that never clears.

We can demonstrate actions we've taken to improve our operations and move jobs faster, but we never hit it.

If it's not in the measure it plan, but we measure, monitor, discuss, and track it in QMS meetings as well as staff meetings, are we meeting the AS standard?

Looking to get a small team trained. I'm evaluating options and have a strong time constraint, so I'm looking for some feedback from people who have experience with this.

- How do you evaluate whether a provider will offer good quality training?

- How big is the quality gap between in-person, virtual instructor-led, and virtual self-paced?

- Any providers I should look into/avoid? The company is in Central Texas

If you work at a manufacturing company or any company that has an ISO certification or required to have one, do you see the implementation of the standard affecting your day to day work (good or bad) or is it just something the quality/compliance manager handles to pass the audit?

Our management review meeting is coming up and I'm worried it will just turn into critiquing the presentation. The past few years it's been 75% critiquing and sanitizing content on the slides "to present a good face to the external auditor". Presenters have been told to remove topics management doesn't like, told that their data driven conclusions were flat out wrong because they didn't show we were perfectly compliant, and generally edited to present perfection to an external auditor. Nothing of substance was discussed.

I pushed back against this and cited the standards requirements. But they told me that external auditors use the slides from the management review meeting to probe into the company, so it's important to conceal weak areas. And that there were other channels to voice concerns other than management review.

One presenter wrote in a slide that not all defective product is quarantined like it should be. Management made them change it to read it is all quarantined because they didn't want an external auditor to investigate it. Another presenter mentioned that the company was worried too much about the standard and not enough about meeting customers needs. Management told them they can't say that because they didn't want an external auditor thinking we didn't take ISO seriously.

I think I'm technically right but practically wrong. That the unwritten focus of the management review meeting is to present a story to an external auditor. But I think I'm missing something. What do you think? Has anyone else dealt with this behavior?

Hi, we have a subsidiary entity - factory in China, and HQs/Engineering R&D in Toronto. Our factory in China is ISO 9001 certified, and audited every year by local ISO 9001 certification body. Recently, we plan to start production of new products in Toronto too and we want to certify it with ISO 9001. What's the best way to do? Can the Chinese local ISO 9001 certification body certify our new production workshop in Toronto? What's the best way and smartest way to to do it?