ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
Quality culture and ethical behaviour entered ISO 9001 in September 2026, and they arrived in three places at once. The sixth edition asks top management to promote them (clause 5.1.1), notes that they shape the environment in which processes operate (7.1.4), and requires every person working under the organization’s control to be aware of them (7.3). None of that existed in ISO 9001:2015. This guide explains what the standard actually says, what an auditor will ask, and what evidence a small organization can produce without inventing a program.
The standard spells it “behaviour”; we keep that spelling for the term and US English for everything else. For the full list of what changed, see ISO 9001:2026 changes; for the standard as a whole, our complete ISO 9001 guide.
| Clause | Requirement (paraphrased) | Who it lands on |
|---|---|---|
| 5.1.1 i) | Top management demonstrates leadership and commitment by promoting quality culture and ethical behaviour | Top management |
| 5.1.1 note 2 | An organization’s quality culture and ethical behaviour are reflected in its shared values, attitudes, practices and actions | Everyone — it is observable, not declared |
| 7.1.4 note | Some factors in the environment for the operation of processes — social and psychological ones in particular — can be influenced by the organizational quality culture and ethical behaviour | Whoever owns the working environment |
| 7.3 e) | Persons doing work under the organization’s control shall be aware of the organizational quality culture and ethical behaviour | Every person, including contractors and agency staff |
Three things follow from the wording. It is a leadership commitment, so the evidence starts with what top management does, not with a poster. It is tied to the working environment, which is why the 7.1.4 note now lists stress reduction, burnout prevention and emotionally protective practices among the psychological factors. And it is an awareness requirement, which means an auditor will test it the way awareness is always tested: by asking people.
ISO 9001 has always assumed that records are truthful, that nonconformities are reported, and that people follow the process rather than the schedule. The 2015 edition never said so. The gap showed up in the cases every auditor has seen: inspection records signed for inspections that did not happen, dates adjusted to hit a target, near-misses that went unreported because reporting them was unwelcome. A quality management system runs on the behaviour of the people in it, and the 2026 edition names that dependency. The standard’s bibliography points to ISO 10010:2022, the guidance standard on understanding, evaluating and improving organizational quality culture, for organizations that want to go deeper; the requirements themselves are in ISO 9001:2026.
The standard does not define either term, and it does not need to — the note in 5.1.1 says they are reflected in shared values, attitudes, practices and actions. For a QMS the working definitions are narrow and testable:
Notice that both definitions are about records and reporting as much as about attitude. That is deliberate. The behaviours an auditor can actually verify are the ones that leave a trail.
Expect three lines of questioning, one per clause.
To top management (5.1.1): how do you promote quality culture and ethical behaviour? What happens when someone raises a concern? What happened the last time a record was found to be wrong? Vague answers about “values” do not survive a follow-up question; a signed statement, a concern channel with a response time, and one real example of action taken do.
To whoever owns the working environment (7.1.4): which social and psychological factors do you control, and how? Workload planning, a stated rule that schedule pressure is never a reason to skip a control, access to support — the note now expects the organization to have thought about burnout and about people feeling safe to act.
To staff at random (7.3): what does the organization expect of you on quality and ethics? What would you do if you were asked to sign for an inspection you did not do? How do you raise a concern, and what protects you when you do? This is the test that fails first. People who cannot answer the last two questions are the finding, whatever the policy says.
The 7.1.4 note is easy to skim past and matters more than it looks. The environment for the operation of processes has always had social, psychological and physical factors; the 2026 edition expands the psychological examples to stress reduction, burnout prevention and emotionally protective practices, and then says that some of these factors can be influenced by the organizational quality culture and ethical behaviour. The link runs both ways.
A culture in which schedule pressure is used to bypass controls produces stress and hidden nonconformities; an environment with realistic workloads and no fear of reporting produces truthful records. So the evidence for 7.1.4 is partly the same evidence as for 5.1.1: a stated rule that pressure is never a reason to skip a control, a workload review, and a concern channel people actually use. Physical factors — temperature, light, noise, hygiene — stay where they were, controlled and monitored where they affect conformity.
| Evidence | Clause it satisfies | Effort |
|---|---|---|
| A one-page policy signed by top management stating the commitments (truthful records, speak up, no retaliation, fairness, honest dealing) | 5.1.1, 7.3 | An afternoon |
| A concern channel — any manager, HR, or an anonymous route — with an acknowledgement time and a log | 5.1.1, 7.1.4 | A week to set up |
| Induction and annual briefing content covering the policy, with a five-question check of understanding kept on file | 7.3 | Add to what you already run |
| Workload and schedule-pressure rules written into the resource procedure; absence and survey data reviewed | 7.1.4 | Ongoing |
| Three indicators at management review: concerns raised, concerns acknowledged on time, records-integrity findings | 5.1.1, 9.3 | An hour per review |
| Corrective action records that ask whether pressure or leadership behaviour contributed to a nonconformity | 10.2 | One extra line on the form |
None of this requires a culture program, a consultant or a survey platform. It requires top management to write down what they expect, to make it safe to say when something is wrong, and to act visibly when it is not. The ISO 9001 Toolkit — 84 templates rebuilt on the 2026 text, $99 — includes a signed-policy template for quality culture and ethical behaviour, an awareness briefing with the check of understanding, and the resource procedure with the working-environment controls, so the three clauses are covered by three documents that reference each other.
No document is named. The standard requires top management to promote quality culture and ethical behaviour and requires people to be aware of them. A short signed policy is the simplest evidence of both, and it gives the awareness briefing something concrete to cover, but an organization could evidence the requirement through other means if it can show them.
No. ISO 9001’s scope is the QMS — truthful records, honest conformity decisions, speaking up, fair treatment while doing that work. ISO 37001 covers anti-bribery management systems; a corporate code of conduct is broader still. They can reference each other; they are not substitutes.
By interview at all three levels: top management on how they promote it, the environment owner on the social and psychological factors, and staff on what is expected of them and how to raise a concern. Expect them to open the concern log and a recent corrective action as well.
It covers the concern channel and the no-retaliation commitment, which is a good part of it. It does not by itself show that top management promotes a quality culture, that the working environment is managed for it, or that people are aware of it. Link the procedure from the policy and the briefing rather than relying on it alone.
September 21, 2026
September 21, 2026
September 20, 2026
September 20, 2026
September 19, 2026