Planning of Changes in ISO 9001:2026: Managing Change Without Breaking the System

InsightsPlanning of Changes2026

How to manage changes to processes, products and the organisation without breaking the quality management system

Key takeaways

• Clause 6.3 of ISO 9001:2026 strengthens change management: purpose and consequences, system integrity, resources, responsibilities, communication, monitoring and review of results.
• Many quality failures follow an uncontrolled change: a new supplier, a modified machine, a reorganised team or a new IT system.
• A simple change request form with one field for each consideration gives auditors clear evidence.
• Change management must be proportionate: a label font change and a new production line do not need the same review.

---

1. Why changes cause failures

Look back at your last serious complaints or incidents. Many will trace back to something that changed: a substitute raw material during a shortage, a new operator on a critical step, a software update in the weighing system, a shift pattern change. The change itself was reasonable; the problem was that nobody checked its consequences on the rest of the system.

ISO 9001:2015 already required planned changes. The 2026 edition lists the considerations more completely and links them to monitoring and review of results.

---

2. What the organisation should consider

Consideration	Questions to ask	Example evidence
Purpose and potential consequences	Why are we changing? What could go wrong for products, customers and other processes?	Change request with impact analysis
Integrity of the QMS	Which procedures, records, risks, controls and KPIs must be updated?	Checklist of affected documents
Availability of resources and information	Do we have people, skills, equipment, budget and data?	Resource plan, training plan
Allocation of responsibilities and authorities	Who approves, implements, verifies and closes the change?	Named owner and approver
Communication	Who must know, inside and outside (customers, suppliers, certification body)?	Communication record, customer notification
Monitoring effectiveness	How will we know the change works as intended?	Defined indicators, trial results
Review of results	When will we confirm the change is complete and effective?	Closure review with date and decision

---

3. Types of change to capture

• Product and process: new products, recipe or specification changes, new equipment, modified process parameters.
• Supply chain: new or substitute suppliers, outsourced processes, transport changes.
• People and organisation: restructuring, new managers, shift changes, loss of key staff.
• Infrastructure and IT: software upgrades, ERP migration, remote or hybrid working arrangements.
• External: new legal requirements, customer requirements, standards editions.
• Management system: merging systems, changing scope, adding sites.

---

4. A proportionate change process

Change level	Examples	Review
Minor	Typographical correction in a work instruction	Document control approval only
Moderate	New supplier for a non-critical material, layout change in a warehouse	Change request reviewed by process owner and quality
Major	New product line, new critical supplier, ERP replacement, site relocation	Multidisciplinary review, trial or validation, management approval, post-implementation review

Defining levels in the procedure prevents both bureaucracy for small changes and informal decisions for large ones.

---

5. The change request form

A practical form has one section per consideration:

1. Description and reason for change.
2. Level (minor / moderate / major) and requester.
3. Impact assessment: products, customers, processes, risks, legal requirements, food safety or OH&S where relevant.
4. Affected documents and records.
5. Resources and training needed.
6. Responsibilities: owner, approver, verifier.
7. Communication plan, including customers and the certification body where required.
8. Verification or validation before release.
9. Effectiveness indicators and review date.
10. Closure decision and signature.

---

6. Links to other requirements

• 6.1 Risks and opportunities: a significant change should trigger a review of affected risks and opportunities.
• 8.5.6 Control of changes in production: changes during production are reviewed and controlled, with records of the review and authorisation.
• 8.3.6 Design changes: where design applies, changes are identified, reviewed, verified and approved.
• 9.3 Management review: changes in external and internal issues and needed changes to the QMS are inputs and outputs.
• In food safety systems, change management also links to the HACCP plan review and, for FSSC 22000 Version 7, to product design and development and equipment change requirements.

---

7. Common mistakes

1. Change management exists only for documents, not for processes, people or IT.
2. Emergency changes made during a crisis and never reviewed afterwards.
3. No post-implementation review, so ineffective changes remain.
4. Customers not informed of changes that their contracts require them to approve.

---

Conclusion

Most organisations are good at deciding to change and weak at checking the consequences. Clause 6.3 of ISO 9001:2026 provides a simple structure to close that gap. A proportionate procedure, a clear form and a post-implementation review turn change from a source of nonconformities into a controlled improvement.

Pick the last significant change in your organisation and check: was there a documented review of its effect on the rest of the system?

← All insights