ISO 9001: Building a Quality Management System That Works

13 Οκτ 2026 · @Nikos Stavropoulos


Introduction


An ISO 9001 quality management system is worth having only if it changes what people do each day: fewer errors, clearer processes and more consistent results. The standard is used by more than one million organisations worldwide, according to ISO [1], yet the research shows that certification on its own does not guarantee those results. This article explains what ISO 9001 asks of a company, summarises what empirical studies say about certification and performance, and sets out what separates a system that works from one that only produces paperwork. The standard was revised in September 2026, so the current requirements are covered as well [1][2]. Statements that are my inference rather than a cited finding are labelled as such.


What ISO 9001 requires, and the 2026 edition


ISO 9001:2026 is the current edition, published on 16 September 2026, and ISO's catalogue page lists the 2015 edition as withdrawn and replaced [1][2]. DQS describes the revision as evolutionary rather than a new standard [2].

The changes it lists include:

  • Structure: full alignment with the Harmonized Structure used by other ISO management system standards, and a revised Annex A [2].
  • Risks and opportunities: clause 6.1 is split into 6.1.2 (actions to address risks) and 6.1.3 (actions to address opportunities) [2].
  • Culture and ethics: top management must promote quality culture and ethical behaviour (clause 5.1.1), and employees must be aware of them (clause 7.3) [2].
  • Strategy: quality policy, objectives and actions are expected to align more explicitly with the organisation's long-term strategy (clause 5.2.1 e) [2].
  • Climate, sustainability and AI: climate and sustainability sit more firmly in the context of the organisation. AI is not a separate requirement, and the standard stays technology-neutral [2].

Certification bodies report the transition dates. NQA and IPC state that accredited ISO 9001:2015 certificates stop being valid on 30 September 2029, and that from 31 March 2028 new certifications are issued only against the 2026 edition [3][4]. These dates come from certification bodies, so confirm them with your own body before planning a client's transition.


Does certification improve performance?


The evidence says that certification can be followed by better performance, but that the result depends on how the system is used. Three studies illustrate the range.

  • Financial results. In a study of publicly traded US manufacturing firms from 1987 to 1997, certified firms showed significant abnormal financial improvement after their first certification. Three years later the effect was strongly significant under every control-group specification the authors tested. The timing and size of the effect depended on how the comparison group was built [5].
  • Internalisation. In interviews with 47 quality managers, the authors identified four ways firms internalise ISO 9000: documentation, process improvement, education and auditing. Firms with no quality system before, and with external pressure to adopt the standard, were most likely to improve operations substantially. Where a firm already had a quality system or ran other quality initiatives, gains could not be attributed to ISO 9000 alone [7].
  • Profitability. A Basque study compared the audited accounts of 400 certified and 400 non-certified firms over five years. Its authors noted "little empirical research" on this question when they began [8]. I could not access its results, so I cite it only for its design.

My reading, not a finding of one study, is that certification tends to help most firms that are building a system from a low base and least firms that already work well.


Why some systems work and others become paperwork


A system becomes paperwork when staff treat it as a ritual for the auditor rather than a tool for their own work. Boiral interviewed nearly 50 managers and employees away from the workplace and found often critical, shallow support. He grouped respondents into three types: ceremonial integrators, quality enthusiasts and dissidents, and described certification as a kind of rite of passage [6]. Greek evidence points the same way on the practical side. A survey of 370 Greek companies certified to ISO 9001:2000 found low use of quality tools and techniques, mostly the simplest ones, and little training on them. The data reflect quality managers' perceptions, and the study did not examine why firms avoid the tools [9]. The survey is old, so it cannot tell us how Greek firms use the 2015 edition. Putting these together, my inference is that three signs separate a working system from a ceremonial one: staff use the procedures to solve real problems, managers read the results of audits and indicators, and the system is shaped to the firm's own processes rather than copied from a template. For a wider view of open questions on ISO 9001 and ISO 14001, see the research agenda in [10], which I could not read in full and cite only as a pointer.


How to build a system that works?


Start from the company's real problems and build only the documentation that supports them. This sequence is my practical suggestion, informed by the studies above and not taken from any one of them.

  1. Pick the problems. List the errors, complaints and delays that cost the most, so the system has a purpose staff recognise.
  2. Map the key processes. Describe how work actually flows, with owners, inputs, outputs and indicators.
  3. Treat risks and opportunities separately. The 2026 edition now asks for both, in clauses 6.1.2 and 6.1.3 [2].
  4. Document lightly. Keep the records the process needs and the standard requires, and drop the rest.
  5. Train for use. The Greek survey found training on quality tools to be limited [9], so teach people the few tools they will use.
  6. Audit to learn. Use internal audits and indicators to find where the process fails, and have management review them.
  7. Plan the transition. Agree the timeline for moving from the 2015 to the 2026 edition with the certification body [3][4].

For an existing system, my suggestion is a gap review against the 2026 changes first, since the revision is evolutionary [2].


Limits of the evidence


No cited study tests the 2015 or 2026 edition directly, because the main performance studies cover earlier versions of the standard. The financial study covers US manufacturers up to 1997 and its result depends on how the comparison group is built [5]. The internalisation study is based on interviews with quality managers [7], and the Greek survey on their perceptions [9]. Because the 2026 edition was published only in September 2026, the dates and requirements in this article rest on ISO's page and on certification-body summaries, so confirm them against the published standard before advising a client. The review agenda [10] and the Basque study [8] are cited for their scope and design, since I could not read their findings.





References

  1. ISO (2026). ISO 9001: Quality management systems — Requirements. ISO catalogue page.
  2. DQS (2026). What you should know about the ISO 9001:2026 revision.
  3. NQA (2026). ISO 9001:2026 Transition Guide.
  4. IPC (2026). ISO 9001:2026 certification and transition.
  5. Corbett, C. J., Montes-Sancho, M. J., & Kirsch, D. A. (2005). The financial impact of ISO 9000 certification in the United States: An empirical analysis. Management Science, 51(7), 1046–1059. Record
  6. Boiral, O. (2003). ISO 9000: Outside the iron cage. Organization Science, 14(6), 720–737. DOI: 10.1287/orsc.14.6.720.24873
  7. Cai, S., & Jun, M. (2018). A qualitative study of the internalization of ISO 9000 standards: The linkages among firms' motivations, internalization processes, and performance. International Journal of Production Economics, 196, 248–260. DOI: 10.1016/j.ijpe.2017.12.001
  8. Dick, G. P. M., Casadesus, M., & Heras-Saizarbitoria, I. (2002). ISO 9000 certification and the bottom line: A comparative study of the profitability of Basque region companies. Managerial Auditing Journal, 17(1/2), 72–78. DOI: 10.1108/02686900210412270
  9. Fotopoulos, C., & Psomas, E. (2009). The use of quality management tools and techniques in ISO 9001:2000 certified companies: The Greek case. International Journal of Productivity and Performance Management, 58(6), 564–580. DOI: 10.1108/17410400910977091
  10. Heras-Saizarbitoria, I., & Boiral, O. (2013). ISO 9001 and ISO 14001: Towards a research agenda on management system standards. International Journal of Management Reviews, 15(1), 47–65. DOI: 10.1111/j.1468-2370.2012.00334.x