Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    ISO 9001

    Definition

    An international standard specifying requirements for a quality management system.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/iso-9001

    Scope: Using software does not certify an organisation. Confirm the applicable edition and certification scope.

    Example for your evaluation: Trace a customer requirement through a nonconformity, corrective action and review.

    Sources checked: . Examples are editorial illustrations.

    What ISO 9001:2026 requires

    ISO 9001:2026, the sixth edition, was published on 16 September 2026 and replaces ISO 9001:2015 and its 2024 amendment. It specifies requirements for a quality management system and, according to ISO, is the only standard in the ISO 9000 family that can be certified to, although certification is not mandatory. It rests on the seven quality management principles described in ISO 9000: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision-making and relationship management.

    The foreword lists the main changes. A limited set of core management system terms now sits in clause 3, with ISO 9000 still the normative reference for quality terms; quality culture and ethical behaviour are addressed within the requirements; risks and opportunities are separated, with actions for each in 6.1.2 and 6.1.3; requirements on changes to the quality management system are strengthened; Annex A is expanded and Annex B removed.

    Clauses that quality software is usually asked to evidence include 7.5 documented information, 8.4 control of externally provided processes, products and services, 8.5.2 identification and traceability, 8.7 control of nonconforming outputs, 9.2 internal audit, 9.3 management review and 10.2 nonconformity and corrective action.

    Sources opened :

    What an ISO 9001 record holds in software

    • A nonconforming-output record (8.7): what was found, where, how much is affected, the disposition decided and who authorised it.
    • A corrective-action record (10.2) that goes further than the output: the cause, the action taken and the evidence that it worked before closure. The same event can need both records.
    • Controlled documents (7.5.3) with version, approver, distribution and access to superseded versions.
    • External provider records (8.4): evaluation criteria, results and the controls applied to what each provider supplies.
    • Risk actions and opportunity actions logged separately, matching the split between 6.1.2 and 6.1.3 in the 2026 edition.

    ISO 9001, ISO 9000 and ISO 9004

    ISO 9001 holds the requirements. ISO 9000 provides the fundamental concepts and vocabulary and remains the normative reference for quality terms; ISO 9002 gives guidance on applying ISO 9001; ISO 9004 gives guidance on enhancing an organisation's ability to achieve sustained success. Only ISO 9001 is used for certification. Treat a product claim of "ISO 9000 compliance" as a question: which ISO 9001 edition do its templates and clause references follow, now that the 2026 edition is published?

    A hypothetical example: a bad batch from a supplier, end to end

    The following case is made up to show how the records connect and is not drawn from any organisation. A machining shop receives a batch of bar stock, and the incoming inspector finds that a hardness reading is outside the purchase specification. The inspector quarantines the lot and records a nonconforming output: the supplier, the heat number, the quantity held and how many parts from the same lot have already reached the line. The quality manager decides the disposition, return to supplier for the unused bars and rework for the parts already cut, and a second person approves it.

    That closes the output but not the cause. The supplier is sent a corrective-action request, and the shop's own record asks why the certificate was accepted without a hardness check. The answer leads to a change in the receiving procedure, which goes through document control with a new revision, and to a note in the external provider evaluation that this supplier needs a tighter control. Two months later someone checks whether the next three lots passed, and only then is the action closed. The risk register is updated in its own entry, separate from any opportunity logged during the same review. At the next internal audit, the auditor can follow the thread from the receiving record to the revised procedure.

    Common misunderstandings about ISO 9001

    • A certificate does not say that products are good. It is an external judgement that a defined quality management system, within a stated scope, met the requirements when the audit took place, and the standard does not set product specifications.
    • Documented information does not mean paper or a particular tool. The requirements ask that what is needed is created, controlled and kept, and a controlled folder, a document system or a quality platform can all do that if the records show who approved what and when.
    • Fixing the output is not corrective action. Reworking a nonconforming batch deals with the nonconformity in front of you, while corrective action addresses why it happened so that it does not recur elsewhere, and software that merges the two hides the second step.
    • The standard is not an inspection regime for suppliers. Clause 8.4 asks for criteria and controls proportionate to the effect on conformity, so a supplier that supplies low-risk items does not need the same scrutiny as a critical one.
    • A quality platform cannot be certified to ISO 9001 as such. A certification body audits the organisation's system, including how its tools are configured and used, and clause references in a template are only as current as the edition they follow.

    How ISO 9001 relates to other glossary terms

    ISO 9001 shares its clause layout with the other management system standards, and several glossary terms describe processes that a quality system draws on.

    • QHSE: the combined scope in which a quality system is often run with safety and environment, sharing document control, audit and corrective action.
    • ISO 14001: the environmental standard on the same high-level structure, with its own requirements for aspects and compliance obligations.
    • ISO 45001: the occupational health and safety counterpart, where hazard identification replaces product conformity as the core concern.
    • Management of change: a safety-world process whose logic resembles the standard's requirement to control planned changes to the system and to products and services.
    • CAPA: the corrective-action cycle that follows a nonconformity, from correction through cause analysis to an effectiveness check.
    • Management review: where top management examines audit results, corrective actions and other performance evidence and records its decisions.

    Records and evidence that usually exist for ISO 9001

    • The scope of the quality management system, the quality policy and the objectives, with named owners.
    • The risks and opportunities the organisation identified, with the actions chosen for each and a check on how effective they were.
    • Controlled documents and records of the process steps that matter, with version, approver and the date each took effect.
    • Evaluation records for external providers, covering the criteria used, the results and the controls applied to what each one supplies.
    • Nonconforming output records with their disposition, and corrective-action records with cause, action and the check that it worked.
    • Internal audit programmes and reports, management review minutes and the decisions they produced.

    What a software tool needs to capture for ISO 9001

    • Separate records for a nonconforming output and for the corrective action that follows, linked so that one event can be traced through both.
    • Risk entries and opportunity entries that can be filtered apart, each with its own action and review date.
    • Revision control that keeps superseded versions readable, with approver, effective date and a list of who was told.
    • A supplier record that holds evaluation criteria and results next to the lots, orders or services they relate to, so a supplier problem can be found from a part and the reverse.
    • Lot or serial traceability fields, so that a nonconformity can be matched to the units it affects.
    • Audit and management review records that point to the evidence they examined, not only to a summary.
    • A read-only export of the history of an action, which an external auditor can examine without logging in.

    Catalog profiles documenting nonconformity-to-corrective-action workflows

    Same rule for every product: tagged “CAPA Management”, with a sourced nonconformance or CAPA capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 34 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    Does ISO 9001 require a particular software product?

    Define the management-system requirements first. Evaluate whether a product supports the records and controls you need.

    How should I compare document-control tools?

    Use a sample revision to check ownership, approval, availability of the current version and access to previous versions.

    Is a completed action enough to close a nonconformity?

    Define the evidence and review needed to accept the response, including effectiveness where required by the applicable process.

    More standards terms

    Related guides