ISO 9001:2026 Tries to Kill the Calibration Sticker and the Annual Audit Pilgrimage

ISO 9001:2026 will not require every measuring device to carry a calibration sticker, and it will not require auditors to tour every clause of the standard once a year. Those two myths, along with the belief that all suppliers deserve identical treatment, are the targets of the third installment in a four-part series unpacking the revised quality management standard, which continues to build on the Plan-Do-Check-Act (PDCA) cycle for managing production processes, supplier quality, and continual improvement.

Do: run what you planned

The "Do" phase sounds deceptively simple: run the processes you planned. That covers production itself plus the supporting cast — purchasing, supplier management, receiving, training, calibration, maintenance, inspection, shipping, and customer communication. For established organizations, the author argues, this is the easy part. "You were in business before the ISO certificate showed up on the wall." The standard should help control and improve those processes, not force companies to pretend they have never operated a business.

What does risk-based supplier control actually mean?

The series takes direct aim at uniform supplier treatment. "That is neither practical nor good risk management," the author writes. ISO 9001:2026 retains the requirement to evaluate, select, monitor, and re-evaluate external providers using criteria proportionate to what they supply and its effect on requirements. The supplier running a critical special process should not be controlled the same way as the office-coffee vendor.

Practical controls the author endorses include:

• Supplier scorecards and performance reviews
• Receiving inspection and direct verification
• Certificates and second-party audits
• Approved-provider status

The governing questions: what is supplied, how critical it is, whether output can be verified after receipt, what performance history shows, and what regulatory or technical requirements apply. His warning is blunt — do not build a supplier-rating bureaucracy just to show an auditor a colorful spreadsheet.

Why the calibration sticker is not the objective

For measurement professionals, the sharpest section concerns monitoring and measuring resources. The sticker is one way to communicate calibration status, not the objective itself. The objective is confidence that instruments are fit for purpose and, when measurement traceability is required, appropriately calibrated or verified against suitable references.

An alternative the author accepts: a unique physical ID linking the device to an electronic system showing current status and due date, with flags preventing overdue use. He also cautions against reflexively enrolling devices in a calibration program when they serve only as indication and do not determine product acceptance. "The question is not 'Does it have a sticker?' The question is 'Can we trust the measurement for the decision we are making?'" — a framing that shifts the compliance debate from artifacts to measurement integrity.

What changes in the internal audit program?

The "Check" phase gets the most substantive standard-specific update. ISO 9001:2026 now requires audit objectives to be defined alongside criteria and scope. The author welcomes this: "Verify compliance with ISO 9001" is not much of an objective, because conformance already sits inside the audit criteria. Proper objectives, he suggests, look like these:

• Determine whether corrective actions for recurring supplier defects worked
• Evaluate whether a new inspection process controls its target defect trend
• Check whether recent training changes improved competence and reduced errors
• Assess control of a high-risk outsourced process

He also dismisses the "annual pilgrimage through every clause." The audit program should weigh process importance, organizational changes, and previous results; a stable, low-risk process may need less attention than one with recurring failures or ineffective corrective actions.

Audit the process, not the paperwork

His audit method replaces checklist compliance with eight questions — what result the process should produce, how effectiveness is measured, what happens when results are missed, what risks interfere, what changed since the last audit, and what the people doing the work would improve. A checklist can support the audit; it should not become the audit.

Management review receives the same treatment. Whether held as one formal annual meeting, quarterly reviews, or executive dashboards, its value lies in the decisions drawn from trends, nonconformities, audit results, supplier performance, and whether prior actions produced their intended result. "Do not spend three days making graphs nobody discuss," he writes — spend the time understanding what the graphs say.

His closing point on data: the most valuable data is often not what looks best in a management presentation, but what makes management uncomfortable enough to ask another question. If inspection, monitoring, audits, and review all happen and nothing changes, he questions whether anything meaningful is being checked at all.

Part four will cover the "Act" phase: customer feedback, corrective action, effectiveness verification, and the lesson that closing an action is not the same as proving it worked.