It's published! Now what?

Yesterday, September 16, after months of waiting and hype, the 2026 edition of the ISO 9001 quality management system standard was formally published. You can buy a copy from the ISO themselves, or wherever you normally acquire standards.

Great news! Now what?

Well, that depends. Overall there is a three-year transition period from the 2015 edition to the 2026 edition. But what you have to do during that time depends on how you interact with the standard.

• Do you work for a company that is certified to ISO 9001?
• Do you work for a Certifying Body (CB) that certifies other companies?
• Do you work for an Accrediting Body (AB), that accredits CBs so they can be allowed to certify companies?

In each case the requirements are a little different.

If you work for a regular company certified to ISO 9001—but not a CB or an AB—the requirement is that you need to acquire an updated certificate reflecting the new edition of the standard no later than September 30, 2029. The only way to get a new certificate is for your CB to conduct an audit to the new standard, either as part of your normal schedule or else as an extra, out-of-sequence audit. It will take your CB some time after conducting the audit to process the results and issue your certificate. So you would be well-advised to contact your CB, and ask how much time they need. Then schedule the transition audit early enough to give them more time than they asked for. Unexpected issues always come up towards the end of any transition period, and you don't want someone else's unrelated accident to jeopardize the timely issuance of your certificate.

What do you need to do on your side to get ready for the transition audit? Fortunately, not much. Several months ago I wrote about the changes that were planned for this edition, and not much has shifted between then and now. The consequence is that the updates in this edition are few, and they are mostly pretty intuitive. You shouldn't have to change much about your current management system in order to comply with them. Be sure to read the new edition, of course! Once you do, you'll find in many cases that your current system already meets the new requirements without the need for any change at all (except maybe in terminology). Explain that to your auditor, and you are done. If you do have to adjust something, then plan and implement the updates in a systematic way like you would do with any other changes. But you shouldn't find it a burden.

If you work for a CB or an AB, the requirements are a little more detailed. I'll summarize them here, but they have been compiled into a document published by the Global Accreditation Cooperation Incorporated (Global ACI), the international authority on the accreditation of laboratories, certification bodies, and others. You'll want to download the document for reference. (See links below.🡳🡳)   

In a nutshell, a CB has to develop and implement a transition plan, including communication with all existing clients. As part of their transition plan, they have to communicate with their AB and provide all documentation the AB might request. In the end, the CB must communicate to their AB no later than June 30, 2027 that they can certify companies to the new edition. Then the AB has three months (latest September 30, 2027) to decide whether the CB has made the transition adequately. After that decision, the AB must conduct at least one (preferably more) witness audit of the CB where the CB is auditing a client to ISO 9001:2026.

An AB, for their part, has to be ready to accredit CBs to the new edition no later than March 31, 2027. They too have to prepare a transition plan, and to communicate with both their CBs and Global ACI.

Any new or initial certification to ISO 9001 after March 31, 2028, must be to the 2026 edition.

For more details, please see the documents linked below.   

Global ACI transition requirements for ISO 9001:2026

Global ACI transition requirements for ISO 14001:2026

Global ACI downloadable transition requirements documents page

           

"Did you bribe the auditor?"

I've talked in earlier posts about how formally analyzing the Context of the Organization can support you in assessing the business risks you face, or the scope of your management system. But sometimes your context can have a huge impact even in a far less formal way.

Years ago, I worked for a small company here in Santa Barbara, California, that was acquired by a Big Company with headquarters in Europe. A couple of years after the acquisition, Big Company informed us that we had to certify to ISO 14001, the environmental management system standard.

So we set to work, building on our ISO 9001 quality system to create an integrated management system addressing both standards. We worked with an expert from another of Big Company's American offices, trained everyone at our location about the new system, and scheduled an audit. We passed the audit, and got our certificate. So far, so good.

The management from Big Company's home office back in Europe congratulated us, of course, but at the same time they expressed considerable incredulity. Our office had had a lot of trouble getting our initial certification to ISO 9001 some years before, so our European colleagues tended to think of us as chronically a day late and a dollar short. At the same time, when it came to ISO 14001 the European home office hadn't achieved certification until their third external audit! How did we—of all people—manage to score on our first? One vice-president even asked me, "Did you bribe the auditor?" I think he was joking—he made it sound like a joke—but clearly he was also rattled.

Just to be clear, no of course we didn't bribe the auditor. (Long time readers will remember this post from two years ago, where I explain exactly why bribery is a bad thing, as if that weren't already obvious!) I don't remember what I told our VP—the question was so unexpected that I probably fumbled it. But months later, in a very prolonged case of l'esprit d'escalier, I figured out the true answer to explain the seeming incongruity that was troubling him.

In the first place, certification to ISO 14001 generally involves implementing two kinds of measures in your organization: environmental measures and system measures.

• Environmental measures are the programs you put in place in order to address your environmental impacts. These can be simple things like recycling your waste paper and your printer toner cartridges, or they can be large programs to reduce pollution or toxic waste resulting from your manufacturing activities. It all depends on what your current environmental impacts happen to be.
• System measures are (in essence) a series of paperwork exercises, that integrate these environmental activities into an overall management system. These measures include assessing your current environmental impacts, planning which ones to address, planning the programs to address them, measuring the results (i.e., the effectiveness) of those programs, and then using the output of those measurements to replan for next year.  

Certification to ISO 14001 requires that both kinds of measures are in place and working smoothly. And the reason our European home office had so much trouble getting their certificate was that they had to implement measures like a recycling program (and others, of course) from scratch. But it took a while for their employees to develop new habits. 

So an auditor would come to the site and hear that the company had implemented a recycling program. Then he would see that all the recycling bins were empty, and that people discarded copier paper into the regular trash. Naturally he would write a nonconformity that the recycling program was ineffective. Multiply this one example by enough other instances of the same basic problem, and you can see why it took them three tries to get their certificate.

But in our office the project was a lot easier. Remember that we were located in Santa Barbara, California. Santa Barbara was the site of a major 1969 oil spill; public outrage at the spill kickstarted local environmental activism, resulting in the 1970 Environmental Rights Day, and (a few months later) the very first Earth Day. Consequently, state and local ordinances governing the environmental behavior of businesses are already very strict, and have been for many years. Any company operating here has to comply to keep their doors open, and employees take environ­mental measures for granted.

So when we began our project to achieve ISO 14001 certification, half the job was already done. All we had to implement were the system measures. We did the assessments, determined that our current environmental measures were appropriate, and set up metrics to track their effectiveness.

We didn't have to bribe the auditor. We didn't have to be smarter than our European colleagues, and we didn't have to work harder. We just benefitted from our location, and from all the extra requirements which that location implied. In that sense, our context did half the work for us.  

__________

         

Off-cycle post: Can "lying to the public" be part of your process?

This post falls entirely outside my regular, planned sequence (the next of which is going to be Part 3 on process management -- Part 2 is here), and also outside the two-week cadence that I defined back in the beginning. (Is two weeks too long to wait between posts? Leave me a comment either way.) But I want to comment in a timely way on Christopher Paris's recent blogpost as follows:

Caspian Pipeline, Responsible for Falsifying Reports Related to Oil Spill, Holds ISO 14001 Environmental Certifications - Oxebridge Quality Resources

By all means read the whole story for the juicy details, as well as the story from the Moscow Times on which it is based. But the gist is in this one-sentence summary:

The Caspian Pipeline company responsible for falsifying the size of a recent Black Sea oil spill "guaranteed" its environmental safety capabilities by pointing to ISO 14001 certificates issued by Bureau Veritas Group and accredited by UKAS.

Of course the environmental damage is appalling, and the firm's mendacity is morally reprehensible. But I have to admit that when I first read the article, a small contrarian voice in the back of my head asked, "But what if they were following their internal processes? What if one of their processes says, 'In case of an environmental disaster, lie to the press.'? Could that make them still compliant to ISO 14001 after all?"

So I had to go check the standard. Turns out the answer is "No, your process can't tell you to lie to the public," but it's not as obvious as you would hope. The ISO 14001:2015 standard contains 25 instances of the word "communicate" or "communication" in the normative clauses 4-10. Of those 25 instances, three say that communication has to take into account the organization's compliance obligations (7.4.1, 7.4.3, and 9.1.1), and only one (in 7.4.1) requires the organization to "ensure that environmental information communicated is consistent with information generated within the environmental management system, and is reliable." But yes, that should be enough to prohibit lying to the public. Also, if the organization's compliance obligations happen to include truthful reporting then those three references apply as well.

What about other standards? ISO 9001:2015 references "communicate" or "communication" 17 times, but nowhere does it explicitly say those communications have to be truthful. Clause 7.4 gives the most guidance, but all it says is:

The organization shall determine the internal and external communications relevant to the quality management system, including: 
a) on what it will communicate; 
b) when to communicate; 
c) with whom to communicate; 
d) how to communicate 
e) who communicates.

ISO 45001:2018 takes the same approach as ISO 14001, requiring that:

When establishing its communication process(es), the organization shall:
-- take into account its legal requirements and other requirements;
-- ensure that OH&S information to be communicated is consistent with information generated within the OH&S management system, and is reliable.

In other words, standards that regulate topics where people might get hurt and around which there are probably legal regulations say something about keeping your communications "reliable."

Does this incident prove the system of certification and accreditation to be corrupt? Not by itself. In the absence of other information, it's always possible that someone went crazy five minutes before his press conference began, and therefore went completely off-script. No process can prevent isolated instances of non-compliance. What matters is how the organization responds to the situation after the fact, and whether Bureau Veritas follows up this paper trail during their next audit to ensure that the organization's response was meaningful and appropriate. Inquiring minds want to know....

Maybe Christopher Paris will be able to follow up on this news later. If you haven't seen his Oxebridge blog yet, by all means check it out.