Audit What People Do, Not What the Procedure Says. Your First ISO 9001:2026 Internal Audit.

The Problem: The audit tours the documents and misses the floor

Last issue ended with a warning: the step that decides whether your ISO 9001:2026 transition worked is the internal audit. If the auditors test documents, you get a 2026 manual. If they test behavior, you get a 2026 quality system. This issue is about the second kind of audit.

Here is the audit most plants will run first. The audit checklist is updated with the new clause numbers. The auditor sits with the quality manager, opens the revised policy, finds the new sentence about quality culture, and ticks the box. The risk procedure now has separate sections for risks and opportunities, so that box gets ticked too. The change procedure has a new field for checking results after go-live. Tick. The audit report says "no nonconformities" and goes to management review.

Nobody in that audit talked to an operator. Nobody traced a real change from request to station. Nobody asked what happened the last time quality and the schedule disagreed. The audit confirmed that the documents were rewritten, which you already knew.

Naming the failure: the Document Tour Audit

We call this the Document Tour Audit. The auditor walks through the procedures, compares them with the standard, and treats a matching document as proof that the requirement is met.

For the clauses that moved most in the 2026 edition, that approach cannot work. The main changes listed in the standard's own foreword are about what people do: leaders promoting quality culture and ethical behavior, a clearer split between risks and opportunities, and stronger management of changes. ISO's summary adds new awareness requirements in Clause 7.3, so that people understand quality culture and ethical behavior, not just the quality policy. A policy statement cannot show that a leader promotes ethical behavior. An operator can.

The Document Tour Audit also tends to grade the wrong thing. It answers "does the procedure say the right words?" when the standard has always asked a second question: is the system effectively implemented and maintained?

What the standard and the audit guidance actually ask for

Internal audit is not on ISO's or DNV's list of the main changes in ISO 9001:2026. The core of Clause 9.2 is familiar from the 2015 edition: audits at planned intervals that tell you whether the system conforms to your own requirements and to the standard, and whether it is effectively implemented and maintained. The audit programme is planned around the importance of the processes, changes affecting the organization, and the results of previous audits. Auditors are selected so the audit stays objective and impartial, and the results are reported to relevant management.

Read that list again with the transition in mind. The new edition is a change affecting the organization, so it belongs in your audit programme. The clauses that changed most are the ones that matter most this cycle. And "effectively implemented" is a floor question, not a document question.

The guidance standard for auditing was also revised this year. ISO 19011:2026, Guidelines for auditing management systems, was published in May 2026 as the fourth edition. Its foreword says the main changes are expanded guidance on remote auditing methods, drawing on ISO/IEC TS 17012, and an expanded Annex A on remote methods and virtual locations. ISO/TC 176 described the revision as addressing technology, digitization, and virtual environments, with more focus on risk, and added that effective audits are more than verifying conformity. ISO 19011 is guidance, not a requirement of ISO 9001, but it is the reference most audit programmes are built on, so it is worth checking that your audit procedure has caught up.

Clause	Document Tour question	Floor question
5.1.1 Quality culture and ethical behavior	Does the quality policy mention culture and ethics?	Ask three operators what happened the last time quality and the schedule disagreed. Do the answers match what leaders say?
6.1 Risks and opportunities	Does the procedure have a section for opportunities?	Pick one opportunity from the list. Who owns it, what is the next date, and has anything happened since it was logged?
6.3 Planning of changes	Does the change form have a results field?	Trace one change from the last quarter to the station. Was the result checked after go-live, and by whom?
9.3 Management review	Are the required inputs on the agenda?	Read the last minutes. What was decided, who owns each decision, and can you see it on the floor?
10.2 Corrective action	Is there a corrective action procedure?	Pick one closed corrective action. Has the problem come back since it was closed?

The floor questions are not harder to ask. They just take the auditor out of the conference room.

How to run a behavior-first internal audit

You do not need a new audit system. You need the existing one pointed at what people do. Here is a sequence that fits Clause 9.2 and the way ISO 19011 describes collecting evidence through interviews, observation, and review of records:

Update the programme, not just the checklist: Treat the transition as the change it is. Put Clauses 5.1.1, 6.1, 6.3, 7.3, 9.3, and 10.2 at the front of this cycle, because they changed most and they decide whether the transition is real. Note why in the programme, so the priority is a decision and not an accident.
Write floor questions first: For each clause, write the question you will ask on the floor before you write the document question. Use the table above as a starting point. If a question can only be answered in the quality office, rewrite it.
Sample people, not only records: Interview at more than one level for each clause: a leader, a supervisor, and an operator. When their answers differ, that difference is the finding, or at least the place to keep looking.
Trace, do not sample at random: For planned changes and corrective actions, follow one real item from start to finish. A trace shows whether the steps connect, which a pile of filled-in forms cannot.
Keep the auditor independent of the answer: Clause 9.2 asks for objectivity and impartiality. The person who wrote the new change procedure should not be the one auditing whether it works. In a small plant, swap auditors between areas or borrow one from a sister site.
Report what you saw, in plain words: Write findings as observations with evidence: "Two of three operators said the line keeps running when a gauge is out of calibration." That sentence will drive a management review decision. "Clause 5.1.1 partially implemented" will not.

If you audit remotely, for a second site or an off-shift, the updated ISO 19011 guidance on remote methods is the place to start. Remote does not have to mean document-only; a live video walk of a station can still answer a floor question.

Practical takeaways for this week's Gemba walk

Take your current audit checklist to the floor and test it:

Count the floor questions: Go through the checklist and mark every question that can be answered without leaving the office. If that is most of them, you have a Document Tour Audit.
Ask one culture question: Ask an operator, "What happens here when you find a problem near the end of the shift?" Write the answer down word for word and compare it with your quality policy.
Trace one item: Pick the most recent closed corrective action and walk to where the problem happened. Check whether the fix is still in place.

An audit that finds nothing is not automatically good news

The first internal audit against ISO 9001:2026 will set the tone for the whole transition. If it only checks the documents, it will almost certainly find them in order, and everyone will relax too early. If it tests behavior, it will probably find gaps, and those gaps are what your management review and your transition plan need. In our next discussion, we will look at Clause 7.3 awareness and how to check that people understand quality culture and ethical behavior, not just that they attended a briefing.

Next Issue Preview

Next up: ISO 9001:2026 Clause 7.3 and the new awareness of quality culture and ethical behavior. We look at why a sign-in sheet from a training session is not evidence of awareness, and what is. Stay tuned.

Call to Action

Pull up your internal audit checklist. How many of its questions can only be answered on the floor? Tell me your count and the floor question you would add first. P.S. Share this with whoever runs your internal audit programme.

Newsletter replies and questions: [email protected]
Follow updates on X.com: @kaizen6sigma