It is 4:40 on a Friday. The last lot of brackets has to ship by five to hit the customer’s dock on Monday, and the inspector has just found three parts with a bore at the top of the tolerance band, or maybe just over it, depending on which gauge you believe. Everyone on the floor knows what happens next is not a technical decision. It is a cultural one. And for the first time, ISO 9001 says so out loud.
ISO 9001:2026, published on 16 September 2026, adds an explicit requirement in clause 5.1.1 that top management promote a quality culture and ethical behaviour, and demonstrate that they do. The idea is echoed in clause 7.1.4, where the environment for operating processes now references culture and ethics, and in clause 7.3, where people must be aware of what is expected of them on both counts. The new informative Annex A offers guidance on demonstrating it; it adds no obligations, but auditors will read it.
Why ISO added it
Because the gap between the paper system and actual behaviour has been the most expensive failure mode in quality for a long time, and the standard had no clean way to name it.
Every quality manager knows the pattern from the trade press: a manufacturer, certified for years, discovers that inspection results were altered or test data copied forward to meet specifications, sometimes for decades. The procedures were fine. The audits were passed. The records were immaculate, which in hindsight was the tell. Nothing in the documented system failed; the people inside it had learned that bad news was unwelcome and adjusted the data to match.
Data integrity is the sharp end of this. A falsified inspection record is not a documentation error. It is a leadership outcome, produced by schedule pressure, fear of blame, and a signal from above that the number matters more than the part. Clause 5.1.1 now puts that squarely on top management.
What it means on a real shop floor
For a 40-person machine shop, a quality culture means the inspector in that Friday scene can say “these are out” without calculating the career cost first. It means the owner visibly backs a hold even when it costs a delivery. Ethical behaviour means nobody pencils a measurement they did not take, and everybody knows a supervisor asking them to would be a serious matter rather than a normal Friday.
For a 200-person contract manufacturer, the same ideas scale into structure: a known way to raise a concern that does not route through the person causing it, supervisors who are measured on problems surfaced as well as units shipped, and a production manager who treats a line stop as information rather than insubordination.
Neither version requires much paperwork. Both require leaders to behave consistently when it is inconvenient.
What it does not mean
Worth saying before the culture-programme salespeople arrive:
- No ethics department. Nothing in 5.1.1 requires a new function or a compliance officer.
- No values poster. An auditor who has seen a hundred of them will not be moved by yours.
- No mandatory culture survey. You may find one useful. The standard does not require it, and a survey with no follow-up action is arguably worse than none.
What auditors can realistically ask for
Culture is hard to audit directly, so expect auditors to look for its fingerprints:
- Leadership actions. Ask top management for a specific example of backing a quality decision that cost money or schedule. Specifics are convincing; generalities are not.
- How bad news travels. Pick a recent significant NCR and trace how quickly it reached leadership, and who raised it.
- Stopping the line. Ask operators whether they can stop work for a quality concern, and whether anyone has. Then check whether the answer matches what management said.
- NCRs under schedule pressure. Look at nonconformances raised near ship dates. Were they dispositioned on the evidence, or conveniently use-as-is?
- Awareness content. Clause 7.3 now covers culture and ethics expectations, so awareness training should say what is expected and how to report a concern, and the records should show people received it.
- Management review. Does the review under clause 9.3 discuss culture signals: NCR reporting rates by area, near-miss reporting, how audit findings were accepted or contested, examples of escalation?
The metrics trap
A falling NCR count looks like improvement on a dashboard. It can equally mean people have stopped writing them up. An area that reports zero near misses for a year is not necessarily safe; it may be quiet.
Treat reporting volume as a health signal in its own right. A rising NCR rate from a newly engaged team is often good news. If your quality objectives reward low counts, you have built an incentive to hide problems, and 5.1.1 is now the clause that finding lands under.
The next 90 days
Steps leadership can take before the transition audit:
- Tell the story of a hold. Find a recent case where someone stopped or held product and leadership backed it. Talk about it publicly.
- Name the reporting route. Make sure every person knows how to raise a quality or integrity concern, including one route that bypasses their direct supervisor.
- Update awareness training to cover culture and ethics expectations, falsification as a serious matter, and how concerns are handled.
- Add culture signals to management review. Reporting rates, near misses, escalation examples, and how findings were received.
- Audit your incentives. Remove any objective or bonus measure that rewards a low problem count.
- Walk the floor and ask. Leaders asking operators “what would stop you raising a problem?” and acting on the answer is itself evidence.
Where a system of record helps, and where it cannot
Software’s role here is modest and real. A QMS system of record can make raising an NCR fast enough that nobody skips it for convenience, show who raised what and how it was handled, keep awareness training records against the current version of the content, and feed management review with reporting trends instead of hand-assembled anecdotes. That is the role My ISO QMS is built to play.
But be honest about the limit: software records culture; it cannot create it. A perfectly configured NCR module in a company where raising one gets you shouted at will simply record a very low number.
The bottom line
Clause 5.1.1 asks leadership to own the behaviour the system depends on. The auditor’s real question is simple: when quality and schedule collide here, what actually happens, and how do you know? If leadership can answer with examples, and the records agree, you are ready. If the only evidence is a policy statement, the Friday afternoon scene is already deciding your culture for you.