Dispelling the Myths of ISO 9001
Part Three of Four — DO & CHECK
By Bretta Kelly
Editorial update: This 2026 edition preserves the practical themes, examples, and point of view of Bretta Kelly’s original “ISO 9000 Is Not Rocket Science” series while updating outdated ISO 9001:2000 references and terminology for ISO 9001:2026.
Do – run the processes you planned
Once you have planned your management system, the next step is wonderfully complicated: do what you planned.
This includes the processes that create your product or service and all the supporting processes around them – purchasing, supplier management, receiving, training, calibration, maintenance, production, inspection, shipping, customer communication, and whatever else your organization needs to deliver the intended result.
For most established organizations, this is actually the easy part. You were in business before the ISO certificate showed up on the wall. You already knew how to buy material, make parts, deliver services, train people, and take care of customers.
ISO 9001 should help you control those processes and make them better. It should not make you pretend you have never operated a business before.
Myth: Every supplier must be treated the same way
No. That is neither practical nor good risk management.
ISO 9001:2026 continues to require organizations to evaluate, select, monitor, and re-evaluate external providers using criteria appropriate to what those providers supply and the effect their output can have on your ability to meet requirements.
The supplier who provides a critical special process should not necessarily be controlled the same way as the company that supplies office coffee.
- What is being supplied?
- How critical is it to your product or service?
- Can you verify the output after you receive it?
- What has the supplier’s performance been?
- What customer, regulatory, or technical requirements apply?
- What evidence do you need to retain to show the controls were applied?
A supplier scorecard can be a great tool. So can receiving inspection, certificates, second-party audits, performance reviews, approved-provider status, or direct verification. Use the amount of control that makes sense for the risk and the requirement.
Do not build a supplier rating bureaucracy just so you can show an auditor a colorful spreadsheet.
Myth: Every measuring device needs a calibration sticker
Not necessarily. A calibration sticker is one way to identify and communicate calibration status, but the sticker itself is not the objective.
The objective is confidence that the monitoring and measuring resources you rely on are suitable for their intended purpose and, when measurement traceability is required, appropriately calibrated or verified against suitable references.
If a sticker helps employees identify calibration status, use it. If a unique physical ID links the device to an electronic system that shows current status, due date, and prevents or flags overdue use, that can also be an effective control. If a device is used only for indication and the measurement does not determine product acceptance, understand the intended use before automatically adding it to a calibration program.
The question is not “Does it have a sticker?” The question is “Can we trust the measurement for the decision we are making?”
Check – stop auditing just to prove you audited
Internal auditing is where many ISO systems lose their common sense.
Companies create an annual schedule, divide the ISO clauses into twelve boxes, send an auditor around with a checklist, and celebrate when every box is checked and no findings were written.
What did management learn from that?
ISO 9001:2026 adds an important emphasis to the internal audit program: audit objectives are now defined along with criteria and scope. I like this change because it forces us to ask why we are spending time on the audit in the first place.
“Verify compliance with ISO 9001” is not much of an objective. Conformance is part of the audit criteria. The objective should tell us what we actually want to understand.
- Determine whether the corrective actions from recurring supplier defects have been effective.
- Evaluate whether a new inspection process is controlling the defect trend it was designed to address.
- Determine whether recent training changes have improved competence and reduced errors.
- Evaluate how effectively the organization is controlling a high-risk outsourced process.
Now the audit has a purpose.
Myth: We must audit every clause every year
ISO 9001 does not require an annual pilgrimage through every clause of the standard.
Your audit program should consider the importance of the processes, changes affecting the organization, and previous audit results. A stable low-risk process with excellent performance may not need the same attention as a process with recurring failures, major change, customer complaints, or corrective actions that have not proven effective.
This does not mean you ignore parts of the QMS forever. It means you plan audits intelligently.
Audit where the information will help the business.
Audit the process, not the paperwork
When I audit a process, I want to know more than whether someone signed the right box.
- What result is this process supposed to produce?
- How do you measure whether it is effective?
- What happens when the result is not achieved?
- What risks could interfere with the result?
- What opportunities have been identified?
- What changed since the last audit?
- How do other processes affect this one?
- What would the people doing the work improve if they could?
Those questions create conversations. They also reveal much more about the health of a process than a checklist copied from the standard.
A checklist can still be useful. I use them. But the checklist should support the audit, not become the audit.
Management review is not a meeting for the auditor
Management review is another process companies sometimes perform because “ISO says we have to.”
Yes, ISO 9001 requires top management to review the QMS at planned intervals. But the value is not the meeting. The value is the management decision that comes from reviewing meaningful information.
Whether you use one formal annual meeting, quarterly business reviews, executive dashboards, or a combination of methods, management needs to evaluate whether the QMS remains suitable, adequate, effective, and aligned with the organization’s direction.
Management should be looking at trends, customer information, process performance, nonconformities, corrective actions, audit results, supplier performance, resource needs, risks, opportunities, and whether previous actions actually produced the intended result.
Do not spend three days making graphs nobody discusses. Spend the time understanding what the graphs are telling you.
Analysis without action is just decoration
Organizations collect enormous amounts of information today. Software makes it easy to generate dashboards and charts. That does not automatically mean the organization is managing with data.
The purpose of analysis is to understand performance and make decisions.
If scrap is increasing, what is driving it? If on-time delivery dropped, which processes changed? If customer complaints are concentrated around one product family, what is common? If supplier defects are rising, which suppliers or purchased processes are creating the risk?
The most valuable data is often not the data that looks best in the management presentation. It is the data that makes management uncomfortable enough to ask another question.
The original reason for measuring a process has not changed: understand whether you achieved the intended result, identify where improvement is needed, and take action.
The real value of CHECK
The Check part of Plan-Do-Check-Act is not there to prove that everyone followed the procedure.
It is there to tell us whether the process is working.
Inspection tells us whether outputs meet requirements. Monitoring and measurement tell us how processes are performing. Internal audits give us another view of effectiveness and conformance. Management review connects that information to decisions.
If all of those activities happen and nothing changes, then I would question whether we are checking anything meaningful at all.
Coming in Part Four: ACT
In Part Four we close the loop.
We will look at customer feedback, corrective action, assigning and tracking actions, verifying effectiveness, continual improvement, and one of the most important lessons in any ISO system: closing an action is not the same thing as proving the action worked.
About the Author
Bretta Kelly is the owner and operator of Business Management Systems Consulting, LLC (BMSC). She has more than 30 years of experience implementing and managing business management systems across a wide range of manufacturing industries, including aerospace, electronics, and semiconductor environments.
Her experience includes implementation of business management systems for more than 200 manufacturing companies. Bretta holds Bachelor of Science and Master of Science degrees in Industrial Engineering from Arizona State University and holds quality and aerospace auditing credentials. She is also a CIS Certified Consultant and President of CIS World Wide Sales Group, LLC.
Learn more about Bretta Kelly and Business Management Systems Consulting: https://www.businessmsc.com/brettakelly