ISO 9001 asks you to manage change in two main places: clause 6.3 covers planned changes to the quality management system, and clause 8.5.6 covers changes in production and service provision. Other clauses cover changes to customer requirements, designs and documents. Together they ask for the same thing: think through a change before you make it, have the right person approve it, and keep a record.
Where ISO 9001 talks about change
There is no single "change management" clause. The requirements are spread across the standard, and an auditor can raise a finding under any of them. Clause numbers below follow ISO 9001:2015.
| Clause | Kind of change | What it asks for, in short |
|---|---|---|
| 6.3 | Changes to the quality management system | Carry them out in a planned way, having considered purpose, consequences, system integrity, resources and responsibilities |
| 8.1 | Changes to operational plans | Control planned changes and review the consequences of unintended ones |
| 8.2.4 | Changes to customer requirements | Amend the documents and tell the people affected |
| 8.3.6 | Design and development changes | Identify, review and control them; keep records of the change, the review, the authorization and the actions |
| 8.5.6 | Changes in production or service provision | Review and control them; keep records of the review, who authorized the change and the actions taken |
| 7.5.3 | Changes to documents | Control them, for example through version control |
Most audit findings on change come from 6.3 and 8.5.6, so this guide spends most of its time there.
Clause 6.3: changes to the system
Clause 6.3 applies when you decide to change the quality management system itself. Examples are a new ERP system, a reorganization that moves the quality function, a new site, outsourcing a process that was done in-house, a new product line or the move to a new edition of the standard.
The clause asks you to consider four things before you act:
- The purpose of the change and what could go wrong or right as a result.
- Whether the quality system stays whole while the change is under way.
- Whether the resources are there.
- Who is responsible for what, before and after.
The second point is the one people skip. During a move to a new ERP system, for a few weeks some records are in the old system and some in the new. Who can release product in that period, and from which system? If nobody decided, the quality system had a gap, and auditors look for it.
Clause 6.3 does not ask for a documented procedure or a specific record. You still need to show the change was planned. A short change plan, the minutes of the meeting where it was discussed or an entry in a change log all serve. Management review is a natural place to record larger changes, because changes that affect the quality system are one of its inputs.
Clause 8.5.6: changes in production and service provision
Clause 8.5.6 is about day-to-day change on the operational side: a different machine, a new material supplier, a revised work method, a temporary deviation, a change of shift pattern, a software update on a test rig.
It asks you to review and control these changes so that output continues to meet requirements. Here the standard does require records. You must keep documented information that describes the results of the review, the person who authorized the change and any actions that followed.
A single form or ticket can hold all three. What matters is that someone with authority looked at the change before it took effect and that you can show who.
A change process that works
One process can serve both clauses and the others in the table. It has six steps.
1. Request
Anyone can raise a change. The request says what will change, why, and when.
2. Impact review
The people affected look at what the change touches. A short list of prompts helps:
- product or service requirements, including customer approval
- risks and opportunities
- documents and work instructions
- training and competence
- equipment, tooling, software and calibration
- suppliers and purchase orders
- inspection and test
- stock and work in progress made the old way
3. Approval
A named person authorizes the change. Larger changes need more senior approval, and your procedure should say where the line is. If the contract requires it, the customer approves too.
4. Implementation
Documents are updated, people are trained and old versions are withdrawn, before or at the moment the change takes effect.
5. Verification
Someone checks that the change was made as approved: the first parts made the new way are inspected, or the first transactions in the new system are reviewed.
6. Effectiveness check
After an agreed period, the owner confirms that the change did what it was for and caused no new problem.
Keep it proportionate
A reworded work instruction needs a document change and five minutes. A new production site needs a project plan. A procedure that forces every small change through a committee will be bypassed within a month.
A worked example
This example is an illustration.
A plastics molder decides to switch resin supplier because the current one has raised prices. The purchasing manager raises a change request.
The impact review brings in quality, production and sales. Quality notes that the customer's drawing names an approved material, so the customer must agree. Production notes that a new resin may need different drying times and molding parameters. Sales checks the contract and finds a clause that requires notice of any material change.
The quality manager approves a trial. Sample parts from the new resin pass dimensional and strength tests, and the results go to the customer, who approves in writing. The work instruction and the control plan are revised, operators on both shifts are briefed, and the old resin is used up on orders already confirmed.
The first three production lots are inspected at a higher frequency. After two months, scrap and complaint data are reviewed and show no change. The request is closed with the test reports, the customer's approval, the revised documents and the review attached.
An auditor who picks this change will find everything clause 8.5.6 asks for: the review, the person who authorized it and the actions taken.
Temporary and emergency changes
Two kinds of change cause most of the trouble.
Temporary changes, such as running a job on a backup machine or using an alternative material for one lot, are still changes. They need a review and an approval, with an end date. Without the end date, a temporary deviation turns into the normal way of working and nobody has reviewed it as such.
Emergency changes happen when something breaks and production cannot wait. Allow them, with two conditions: a named person authorizes the change at the time, even by phone, and the full review is completed within a few days. Clause 8.1 asks you to review the consequences of unintended changes and act on any adverse effects, and this is how you show it.
What auditors look for
Auditors rarely ask to see "the change procedure". They find a change and follow it.
They compare the organization chart with last year's and ask how the reorganization was planned. They notice a new machine on the floor and ask for the review and the first-off inspection. They pick a work instruction with a recent revision date and ask who approved the change and how operators were told. They read management review minutes for changes and check that the planning the minutes promise took place.
The findings that result are usually one of these:
- A significant change with no evidence that its effects were considered beforehand.
- A production change with no record of who authorized it.
- Documents and training updated weeks after the change took effect.
- Customer notification missed where the contract required it.
- A temporary deviation still in use long after its end date.
- No check that the change achieved its purpose.
What ISO 9001:2026 changes
ISO published ISO 9001:2026 on September 16, 2026, and certified organizations have until September 30, 2029 to move to it. The clause structure is kept, and clause 6.3 keeps its number.
Published summaries of the new edition report that clause 6.3 has grown, with added attention to communicating changes and to monitoring and reviewing their results. If your change process already includes implementation and an effectiveness check, as the one above does, you are close to what the summaries describe. Read the new text itself before you revise your procedure, and see the ISO 9001:2026 transition checklist for the wider list of changes.
Frequently Asked Questions
Does ISO 9001 require a change management procedure?
No. It requires that changes are planned and controlled. A documented procedure is the easiest way to make that happen consistently, and most certified companies have one.
What records does ISO 9001 require for changes?
For changes in production and service provision (8.5.6): the results of the review, who authorized the change and the actions taken. For design changes (8.3.6): the change, the review results, the authorization and the actions. Clause 6.3 names no record, and you should still be able to show the planning.
What is the difference between clause 6.3 and clause 8.5.6?
Clause 6.3 is about planned changes to the quality management system as a whole. Clause 8.5.6 is about changes in how products are made or services delivered.
Do document changes count as change management?
Document control (7.5.3) covers the revision itself. If the document changed because the process changed, the process change also falls under 6.3 or 8.5.6.
When does the customer have to approve a change?
When the contract, the drawing or the customer's supplier requirements say so. Changes to material, process, site or sub-supplier are the usual triggers. Check before you make the change, because approval after the fact is hard to get.
How does change management relate to risk?
Every change brings risks and sometimes opportunities. The impact review is where you identify them, and larger changes should be reflected in the risk and opportunity register required by clause 6.1.
Related insights
- ISO 9001:2026 transition checklist
- QMS Gap Analysis: Step-by-Step Guide and Checklist
- ISO 9001 Internal Audit: Program, Plan and Checklist
- Documentation best practices
Get a head start
The ElevateQCS implementation kit for ISO 9001:2026 includes procedures and forms aligned with ISO 9001:2026, ready to edit. Explore the ISO 9001:2026 kit
Need help setting up change control? Find a vetted quality expert.
General guidance aligned with ISO 9001. Clause numbers follow the 2015 edition; refer to the standard for its exact requirements.
Sources
These references provide standards, regulatory text, or background context. They do not independently validate every recommendation in this article. Linking does not imply endorsement. Standards may require purchase; refer to the publisher for the current text.
