The long-awaited revision to ISO 9001 was published in September. The good news? It isn’t a complete overhaul—if you’re already certified under ISO 9001:2015, you likely have many of the key elements in place.
In this episode, our Technical Advisor David Burns breaks down:
- Legal Metrology in the UK and beyond.
- Advice on achieving marketplace certification for your weighing and measuring instruments.
- Practical guidance on the auditing process and maintaining a higher level of compliance.
- Regulatory updates and what they mean for your business.
A full transcription of our podcast is available below:
Introduction
Hello, my name is David Burns of the UK Metrology Board and welcome to our podcast. Hopefully one of many. This particular podcast is going to be about the revisions to the new ISO 9001: 2026 standard.
Now, there’s been a lot of information out there, of course, in the public domain. And also, I think we’ve been drip-fed a lot of information from various institutions, possibly over the last 12 months or so. At UK Metrology Board, we’ve tried to keep ahead of the game.
And we’ve made sure that we’ve got some good reference information for our clients. And of course, our audit team. Okay, so taking it from the top, the general requirements of the new ISO 9001-2026, in many respects, have simply caught up with modern business practice.
Process Effectiveness against KPI’s
I think more so than ever, we’ve noticed that most businesses do have a high level of management system understanding of commercial and technical risk. And they’ve already implemented measures to make sure that the business remains safe and secure for business continuity purposes. The standard sort of screams for things like PESTLE and SWOT analysis, supply chain integrity, and appropriate stress testing of your own supply chain to make sure that there are no bumps in the road during your production processes with parts and components.
They’re looking at sort of process effectiveness against key performance indicators. So nothing new there; that’s always been there. Information technology, particularly the onset of AI, they’d like you to do a bit of a deep dive on data security to make sure that again, that stress tested to make sure that your business isn’t vulnerable from a cyber attack.
AI and your quality management system
And also you keep up to speed with the likes of AI and how it’s used. One example of that: we came across one company that used AI for their quality management system, which was great; it looked amazing. But when we started to interrogate and have a chinwag with people, they really didn’t know why those parts of the management system were actually implemented.
And what was the meaning behind things that had been implemented? So the management system should be able to emphasise not only a robust quality management system and its supporting documents, but you’ve got the technical competence to support that.
Mitigation of counterfeits, that’s part and parcel of what we do day to day. But again, as we know, a counterfeit, there has to be malicious intent to defraud or deceive you about the product. But again, certification bodies will be looking at how you mitigate counterfeit parts.
Process Reviews
And also a contract review, sales order processing- just make sure you’ve got your ducks in a row as far as legislation is concerned, and commercial terms and conditions are read and understood. Okay. Now, apart from that, that’s the overall general requirements, we’re going to dive into the weeds a bit more now on this.
UKAS must be ready to accredit the certification body within the next 6 months
But if we start with accreditation now, UKAS, as you know, United Kingdom Accreditation Service, they are our accreditation body; they come and audit us on a pretty regular basis. But basically, they’re making sure that we’ve got our ducks in a row when it comes to service delivery to yourselves. So UKAS themselves have to make sure they’re ready to accredit a certification body within the next six months.
So basically, we are accredited against ISO 17021. Now, that standard has not really changed. There’s probably a little bit of guidance flying around.
But that’s more for us to worry about than you about service delivery; the requirements of the certification body- that’s us, United Kingdom Metrology Board.
How we can help
For our part as a certification body, we’re expected to communicate and offer our clients the three-year transition process. So we need to advise you that from this point forward, you’ve basically got three years to get your ducks in a row for the new 2026 standard from the existing 2015 standard.
We’re not supposed to accept any new applications against the old standard; we should be really looking at receiving applications for transition to the new standard. Although we’ve got 18 months on our side. After 18 months from this point forward, we should not be accepting any more applications against the old standard.
So, that puts the pressure on you guys really to make sure you get your systems up to speed from the 2015 to 2026 requirements fairly quickly. So what can we, the UK Metrology Board, offer? Well, what are we going to offer?
What we have created is a gap analysis checklist against the 2026 standard. And that’s going to be available for download for you to use as your own internal checklist and gap analysis against what you do at the moment, what the new standard says, and what information you’ve got to create or provide.
The other thing as well, we’re going to hopefully run more of these podcasts to support clients in their endeavours to actually achieve certification within a timely manner against the new standard. So look out for more podcasts. Okay, so the key changes, so that is the dribble from me anyway, that’s all the mad nonsense that you’re probably not really interested in. And it’s probably more of our problem, what I’ve just been banging on about. But anyway, let’s rattle into the changes.
ISO 9001: 2026: The changes that matter to you
Supply chain resilience
So basically, anything to do with IT, data security, AI, and all the rest of it is actually there. You need to get yourself sorted to make sure you’re compliant when it comes to digital data and information, information flows in and out of the business and how you protect the integrity of the business. Supply chain resilience is another one. You need to stress that from time to time, just to make sure that your supply chain is there for the future.
So, for example, long-term contracts- can you achieve them? How are they going to be achieved, particularly when you have to rely on suppliers or subcontracts to support whatever contract arrangements you’ve had? Okay, so that needs to be considered.
Okay, so that needs to be considered. Climate change, as we know, that was slipped in about a year or so ago now under the old standard. But climate change is now an integral part of the new standard; you’ve got to consider climate change.
Well, I guess everyone’s got a view on climate change, as long as you’ve considered it. And you’ve looked at it long and hard, looking at any possible impact climate change may have on the services and products you actually supply, as far as your business is concerned. Okay.
But again, it’s all in context. Okay, climate change will have some impact on some supply chains, perhaps not so much on others. But you just need to consider climate change as a risk to the business.
The importance of a robust business plan
So moving on, okay. Context matters of context, business perspective, background direction, strategic growth of the business, the value of your market, what market are you in? Context, what I’ve always said, can be supported by a robust business plan. So if you create a business plan for the business, things like commercial risk, resources, integrity, supply chain, strategic development, key performance indicators, cash flow forecasting- all that good stuff can be built into a business plan; that’ll tick a huge box.
When it comes to certification, although we’re not going to dive into your finances, we’re certainly going to have a look at the stability of the business in the context of what it is you’re actually offering the market. The risk to the business and of course, that magic SWOT analysis: Strengths, weaknesses, opportunities and threats, both internal and external.
You need to regularly review the impact on your business. And then process controls, obviously process controls have always been there procedure processes, we need procedure processes to run the business, but other processes effective for running your business.
The importance of leadership
The next clause five, here we go- leadership. Leadership has always been an integral part of the business.
Again, top driven, you can’t implement quality management systems from the middle or the bottom up. It’s got to come from the top, that philosophical policy overview. And having ISO 9001 is obviously a prerequisite for some contracts.
But you decide how you want to get involved as bosses and leaders of your company. Of course, you’re going to leave it to quality managers and quality management system controllers and so on internally for doing the nuts and bolts. But they do need your support, bosses, to make sure these initiatives are driven and taken seriously across the business.
So there’s an emphasis on quality culture, good governance, and good ethical behaviour. When it comes to policy, process performance requiring compliance oversight, so regular auditing, but planned auditing, again, considering risk, high risk areas of your business will be supported by procedure processes. And it’s likely that the high-risk areas will be audited more than some areas than others.
How do you plan those audits?
Okay, so again, how you plan your audits, there’s a clear expectation for data- and fact-driven decision-making processes. So again, information and data that flow from the system, tangible information, where senior management or the leadership team can actually make factual decisions based on information and data from the system. So again, this starts with your procedure processes, how you collate information, how you collate that information onto the IT system, and then how you produce information and data.
So bosses and leaders can actually make strategic decisions based on the information that’s being presented from the quality management system. So all good stuff there, but no surprises, I don’t think, because I think most companies tend to have a lot of this in place anyway.
It’s all in the planning
Clause 6 is all about planning.
Okay, so the key changes, risks and opportunities tend to be divided now into two separate clauses. Okay, so again, risks and opportunities. Okay, so risk and mitigation planning, and then opportunities.
Well, that sits nicely with your SWOT analysis, doesn’t it? Hey, ho, SWOT analysis tools have been around for a long time now. So risk and mitigation, opportunities and threats. Okay, so again, that can be on a risk mitigation table, and again, can be an integral part of your business plan as well.
Don’t forget that. Okay, digital information, as we said earlier, there’s more explicitly recognised global impact from AI, and how that is going to impact your business, your staffing level, the competition, even. So AI is an integral part of our business thinking now when it comes to quality management systems.
You can have as many KPI’s as you like
Okay, objectives. Now, KPIs, key performance indicators. Well, as you’re probably all aware, KPIs, you can have many KPIs as you’d like to run your business is entirely up to you.
As we said earlier, they’re based on fact and not fiction. Your KPIs are an excellent point of reference for leadership decision-making, and so on. For small to medium-sized companies, I tend to look at things like KPIs in the context of different departmental functions.
The three main functions, I suppose, from a practical point of view, sales order processing, contract review, getting the job done, getting the order in and getting the customer up to speed. So contract review, sales order processing, and then you’ve got production and production planning. And then of course, you’ve got procurement and supply chain.
So those three areas, sales, production, and procurement, I always believe are three integral parts of any quality management system. If you kind of get that right, everything else sort of falls into place. You can measure the effectiveness as well through a KPI on sales order processing.
A good sales order process means on-time delivery performance is going to be good. Good production planning means you’re going to minimise non-conformances within the production process. And of course, procurement: an effective acknowledgement of a good purchasing process is the fact that your suppliers deliver on time, and they always deliver good product.
Okay, so KPIs are entirely up to you. I’ve just thrown a few things in there for you to consider. The management of change as well.
Managing Change Management
Again, that’s always been an integral part of the old standard. But they’ve just emphasised it again now, change management requirements. So how do you change? Just to give an example, you know, it may pop up, but you just want a big contract, and you might have to move across to another industrial unit on your industrial estate.
And it’s how you manage that change, how you manage the movement, the same work that has been on an existing production line, but you just move them across the road into another unit, and how you’ve managed that change, okay, so it doesn’t impact on the performance of the company, or the integrity of the product. Okay. Clause number seven.
Okay, here we go. Support key changes. Well, oddly, no particular changes.
This particular clause of the standard hasn’t really moved on much, to be fair. They’ve emphasised the use of AI within the organisation. But they’ve also looked at the technical competence of those involved with IT and data security, and also production planning and the use of AI as and when they need to across the organisation.
Guidance on cloud-based systems
There’s up-to-date guidance on the use of cloud-based systems, and how you protect the integrity, again, of your information and data that’s held in the cloud. As we all know, it’s become more and more vulnerable these days, where we always used to think we thought we were okay, because we backed up our IT system and MRP systems into three different places, including the cloud. But again, history has told me, anyway, that even that’s vulnerable.
We come across a few companies that have been hacked, unfortunately, and have had malware, and they’ve had issues with data security. So again, don’t just give it lip service. I think just because you’ve got a backup from an IT service provider, you need to check the integrity of the data that is backed up.
You need to check the integrity of the information that is backed up really important. You might be given a report and a pie chart; just check what’s in the pie chart. Is it true, factual information?
Operational Matters
Clause number eight: okay, operational matters.
The key changes: the terminology; the reference to outsourcing is replaced with externally provided services. Okay, so again, just have a quick look at that; it’s terminology more than anything. There’s more emphasis on the supply chain integrity and associated risks with that supply chain.
We’ve already touched on that, haven’t we? If you’ve got a robust supply chain, obviously, that’s going to be good for your business; by default, it’s going to be safe and secure. But look beyond that. Just make sure that matters of climate change, global events, political, economic, whatever it may be, energy, and so on and so forth.
All this is built into your quality management system, highlighting the risks. But the most important for you again, if you don’t mind me saying, is not to make it what’s the word? Don’t just give it lip service. I come across so many management systems where they’ve ticked a few boxes to get over the line; in reality, how robust are their systems, you know, that’s the important thing.
Stress test your systems
So again, going back to what I was saying earlier, you do need to stress test your own systems internally. How you do that, your core, of course. Okay, linkages, more linkages from the management system for an effective risk-based management system.
Well, again, it’s just re-emphasising risk, again, technical risk, commercial risk, whatever the risks are, global risks, political risks, economic risks, energy issues, all these are risks that can have a direct impact on the business. But again, if you’ve been in business for many years, then these risks that you’re going to have to deal with, as you as you have done in, you’re going to have to deal with as you have historically, we just need to demonstrate that you are in control of your supply chains as best you can. So contracting legislation obligations confirmed.
So again, statutory and regulatory requirements have always been an integral part of ISO 9001. It’s sort of re-emphasised now in the new standard, where contract matters, contract legislation, terms and conditions, statutory requirements, just trying to keep a handle on everything, particularly with all the UKCA and CE marking and all the rest of it. Just try to keep up to speed with all the technical bulletins that are flying around.
Keeping you up to date
Okay, UKMB will keep clients up to date with any changes. Okay, but again, contract and legislative obligations, you just need to demonstrate that you are in control. And you’re aware.
The other thing as well that I’ve not really touched on is the matter of contract review and sales order processing, just very quickly, just to slip it in here. I’ve come across more and more now where there’s an obligation to review UK sanctions lists when it comes to customers and end user agreements, but also supply chain integrity. So from time to time, our recommendation is to keep an eye on the UK sanctions list.
There’s a published list available on government websites with regard to who’s who, what countries you can deal with, and what countries you can’t deal with. And again, end-user agreements. Okay, just take that into consideration.
Performance Evaluation
Clause number nine, performance evaluation. Well, it’s business as usual, really, as we’ve said before, we touched on KPIs, key performance indicators, and how you implement KPIs and how you get the data from a KPI. But again, that’s down to you and your MRP system or ERP system.
But again, information and data that’s going to be useful for the business. So measuring on-time delivery performance to the customer, measuring on-time delivery in full from the supplier, measuring internal non-conformances against production processes and planning. Okay.
And again, all of this information is going to be pulled into management review meetings; you’re going to be auditing the system, you’re going to be auditing the system for compliance, but also business improvement; you’re going to be auditing the system to make sure that not only have you, I suppose, got the right technical competence, in particular departmental functions, but as internal auditors, looking over the horizon to look at what potentially could go wrong if certain things are not dealt with. I suppose what I’m trying to say is: don’t use management review meetings and internal auditing is just a tick-the-box exercise, which again, that’s sounding too emotional. I’m not emotional; I’m not emotional. It’s down to you.
But it’s actually about making sure that you use it properly. Don’t just tick a box with it. Internal auditing should be undertaken by a person within the organisation independent of the area being audited.
Management review meetings should be against the appropriate clauses of the ISO 9001 along with other information that you may want to add to that agenda. So don’t think you’re corralled. If you think of the ISO 9001 proposed agenda is the minimum requirements, you feel free to add other stuff into that management review meeting.
Build a culture of continuous improvement
Number 10, improvements. Okay, here we go. Continuous improvement, internal auditing underscored by objectives for each audit, and they should be risk prioritised.
So I’ve always said, I’ve been saying this for a long time. So the standards kind of caught up with our thinking, really; internal auditing should be risk prioritised. If you know certain areas of the business are fine, why do you have to keep auditing them? You need to look particularly at it if you’re a small- to medium-sized company and you don’t have enough audit resource, or it’s tricky to actually pull people off a job into auditing.
You need to then prioritise what audits are important to you. And if you justify that to your auditor, from the CB, if you like, from us, then I think we can understand where you’re coming from; just justify why you’ve done what you’ve done. So risk-prioritised auditing is no bad thing.
Again, if you go back to the key three areas, sales order processing, procurement and production, you might want to audit those more often than you would say calibration, where you know your calibration is always pretty good, and you’ve got control over it. You might always think to yourself, you know, our document data control is pretty good; we’ve got a pretty good handle on it. So therefore, let’s not audit that as much, you know, there’s nothing wrong with auditing sales or processing four times a year if you think it’s high risk to you, okay, but it’s entirely up to you.
Okay, how you manage that, as long as you’ve got a risk-prioritised audit plan, with some tangible, rational reasoning behind it, that’s absolutely fine. The needs and expectations of interested parties. Now, as we all know, again, interested parties and stakeholders- all that list goes on forever, doesn’t it? So when you list your interested parties and stakeholders, you know, again, put it into context.
Quality Culture
So if you look at the key changes, okay, we’ve summarised the key changes. And again, you can have a copy of a PowerPoint presentation we’ve done as well. So, running along the key changes, okay.
So the quality culture across the organisation, the bars got to be raised, people need to know that quality is an integral part of the business, and that you mean business by driving quality in every area of the business. Okay. That’s the first thing: you need to communicate ethical behaviour effectively.
And that can be done through employee handbooks; it can be done through induction; that can be communicated via policy. But the main thing is, you get people to understand ethical behaviour across the business, everything from sales order processing, right the way through to interaction with the customer and supplier, and how you communicate right the way through to work orders and job cards being completed correctly.
Risk Assessment
Risk assessment: we’ve touched on risk assessment all the way through me gibbering on before, okay, but it tends to fall into two camps.
You got commercial risk to the business. And then you’ve got the technical risk, commercial opportunities, use the opportunities and threats within SWOT: strengths, weaknesses, opportunities and threats; a really good management tool. It’s been around for donkey’s years.
And again, I think it’s really good to demonstrate that you’ve got a handle on the business and the market you’re in. Dare I say I keep going back to it, but I think top-level documents these days should be supported by a business plan. If you have a robust business plan, the quality management system normally just slides in under that nicely, okay.
The business plan demonstrates that you have a good understanding of the market, you have a good understanding of the risks, both commercially and technically, and you can demonstrate compliance through the business plan. Management of change, as we said earlier, is planned across the business: change management- how do you respond to situations? How do you manage that change? Whether it’s internal or external, you need to have a change management process and know how you do that. Again, it’s going to vary across different businesses.
Planning for change
But again, planning changes is what we do pretty much all the time in business, okay. So just have a process for that. Climate change consideration: what it means for your organisation.
Climate change is up there again now. So we’ve got to consider that. And the impact of climate change on your business.
Supply chain integrity is the other one on the list. Okay. Continued assessment and awareness of what happens if you lose key suppliers.
What alternative options are there? What happens if one of your key suppliers disappears? Or they’re no longer available? Can you reach out to other suppliers offering similar services? Again, stress test the supply chain. It’s almost part and parcel of disaster recovery planning, really, to make sure that you look at every part of the business. And supply chain integrity is one of the ones that has the most impact, I think, whether it’s a global event, whether it’s political, or economic, or just environmental, is how that impacts your business.
Knowledge Management
Knowledge management, again, we touched on that earlier, but it’s being aware of technological advancements, particularly within AI, as we said earlier, AI is moving pretty swiftly now. And again, it’s how you manage that and how you use it to your advantage as well. And not be overwhelmed by it, I think, as well, use it to your best advantage.
Internal auditing, you know, that’s not going to go away. Compliance and improvement is what internal compliance and improvement is what internal auditing is all about. Do you comply with existing procedures? Can they be improved? Are they still effective? Okay, do they need improvement, and so on.
So internal auditing is good. Okay, that’s still there. Management review, regular management review meetings, I mean, I know they keep banging on about the fact you should review the system at least annually.
But I’m a great believer in sort of quarterly management review meetings; annually is too distant. As far as I’m concerned, you need to have more regular management meetings. Now, your management review meeting, of course, is not to replace any other meetings you have. If you have production meetings, sales meetings, you know, purchase and supply chain meetings, all those meetings can still bumble along. What this is all about is having an overview of the management system.
So you’re feeding into it. And it’s a good backstop measure as well for running the business. So the boss can sit there as the chairman of the management review meeting.
And you can say, how many nonconformances did we have last quarter? Any issues with suppliers? Is calibration up to speed? What training have we had done? What’s the future training budget? Are we on track with training for any new members of staff, any new documents and data, any risks that we should worry about, and so on? So again, it’s a good way for the management team to demonstrate that they have good governance over the business. But they’re also running an effective management system.
Our resources to support you
We are coming to the end now. I’m sure you will breathe a sigh of relief. If you want more information, obviously contact UKMB – we are here to help.
Just to recap, we are not going to come and start giving you a hard time at the moment. We shouldn’t really give you a hard time anyway, but what I am trying to say is that we are not going to be top probing at the moment about what you are going to do about the new standard.
But the audit team is bound to ask, ‘How do you feel about the new requirements? Do you feel comfortable with everything? When do you think you will be ready?’ What we have created, though, is a gap analysis checklist for yourselves. Our auditors will be using the GAP analysis checklist, but what we have decided to do is make this available to all clients so you can do your own self-assessment against the new standard. And if you want to, you can use that in conversation with our audit team when they come and visit you.
What it does is give plenty of guidance about what the 2015 standard said and then what the 2026 standard is saying. It provides a level of guidance against that particular clause, and in there, there are a few examples of how to interpret what the standard is saying in context with what you do. So, it’s a really good checklist; it’s a UKMB ISO 9001: 2015 VS iso 9001: 2026 gap analysis document; it will be up on the website for download at some point.
Our audit team has been looking at it themselves to make sure it reads correctly and is supportive. So, just ask for that. The other thing we have is a short presentation which will be made available for existing clients and new clients who want to move across to us.
Thanks for listening. I look forward to hearing from you. Thank you very much.
To find out more about transitioning to ISO 9001: 2026, achieving ISO 9001 certification for the first time or to receive a copy of our gap analysis document, you can send us an email at info@ukmb.org, or submit a contact request here.
To support your business, we are offering 25% off all new certifications (excluding existing certificate transfers). Applications must be submitted by 31st March 2027, and your audit must be undertaken by 30th September 2027.
This was transcirbed by TurboScribe.