ISO 9001:2026 quality culture and ethical behaviour

What changes

The standard does not define a particular culture and does not require a code of ethics. It does require top management to take action and people to know what is meant. That makes a topic auditable that used to live mostly in mission statements.

How quality culture shows

Quality culture shows in how an organization deals with errors, conflicting goals and concerns. Auditors therefore look less at posters and more at behaviour and everyday traces:

• Are errors and near misses reported, or do they only surface through customer complaints?
• How does management react when deadlines and quality collide? Are decisions documented?
• Can people raise concerns without fear of disadvantage, and do they know how?
• Are deviations investigated for causes rather than for culprits?
• Does top management talk about quality in the audit itself or delegate the topic completely?

In a QMS context, ethical behaviour is mainly about honest test results, no embellished metrics, correct customer information and handling conflicts of interest. Where a code of conduct or a whistleblowing system already exists, the QMS should refer to it instead of inventing something new.

How to implement the requirements

1. 1

   State expectations

   Record in the quality policy or a short statement what quality culture and ethical behaviour mean for you. Three to five observable statements are enough.

2. 2

   Define leadership actions

   Decide how management promotes the culture: regular quality meetings, visible decisions on conflicting goals, feedback on reported problems.

3. 3

   Clarify reporting channels

   Make known how errors, near misses and concerns are reported and handle reports traceably, for example through deviation management.

4. 4

   Build awareness

   Brief people on expectations and reporting channels and have them confirm it. For new staff the topic belongs in onboarding.

5. 5

   Review the work environment

   Take the note in 7.1.4 as a prompt to look at psychological strain in processes with a high error risk. ISO 9001 does not make this mandatory, occupational safety law often does.

6. 6

   Evaluate effectiveness

   Watch indicators such as the number of reports and findings from audits and conversations. Discuss them in management review.

What you can show in the audit

• an approved statement by management on quality culture and ethical behaviour,
• minutes in which management handles quality topics and explains decisions,
• training records and read confirmations on expectations and reporting channels,
• reported deviations and near misses with a factual root cause analysis,
• interviews: people can explain what is expected of them and how they raise concerns.

Links to other clauses

Quality culture is not an isolated chapter. It affects the quality policy under 5.2, the handling of risks and opportunities under 6.1, competence under 7.2 and the treatment of nonconformities under 10.2. When deviations are reported openly and investigated factually, that is strong evidence of a living culture. When the number of reports drops after an incident, take a closer look.

Organizational knowledge under 7.1.6 is closely linked as well: knowledge is only shared where errors are not hidden. So do not plan the implementation as a single measure; check in each of these clauses whether your arrangements fit the culture you describe.

Implementation in docxpert

For the 2026 edition, the “Roles, responsibilities and authorities” template has a section on quality culture and ethical behaviour, and the “Competence, training and awareness” template one on awareness and organizational knowledge. Both are in the template library.

You distribute the approved statement with read acknowledgement and see who confirmed it. You plan and record briefings in training management. In the transition area the topics belong to the “leadership” and “awareness” steps. The transition check gives an overview of all changes.