Clause 9: Performance Evaluation

Requirement
9.1.1 General and 9.1.2 Customer Satisfaction are unchanged from 2015. 9.1.3 Analysis and Evaluation carries one change:

New in 2026, “the effectiveness of actions taken to address risks” and “the effectiveness of actions taken to address opportunities” are now two separate items (e and f) instead of one combined line. This simply mirrors the Clause 6 split: you now check whether your risk actions worked, and separately, whether your opportunity actions worked, rather than lumping both together.

How to Implement
Pick a small set of metrics that actually tell you something useful, and analyse them against the standard’s list of evaluation points. When you get to risks and opportunities, look at them as two separate questions rather than one: “did the things we did to manage our risks actually reduce them?” and, separately, “did the things we did to chase our opportunities actually pay off?”

Mandatory Documents
Yes, explicitly mandatory. Documented information “shall be available as evidence of the results” of your monitoring and measurement.

Requirement
9.2.1 General is unchanged. 9.2.2 Internal Audit Programme carries two additions. 

New in 2026: when deciding what to audit and how often, the organisation must now also think about “changes affecting the organization,” alongside the 2015 factors of how important a process is and how it performed in previous audits. A new item (d) also requires the organisation to “take appropriate correction and corrective actions without undue delay.”

How to Implement
When building your annual audit schedule, build in a step that asks “what’s changed recently or what’s about to change?” as well as the usual questions about process importance and past audit history. For the timeliness requirement, agree an internal target, for example, corrective actions opened within ten working days of a finding being raised, and track whether you’re actually hitting it.

Mandatory Documents
Yes, explicitly mandatory. Documented information must be available as evidence of audit programme implementation and audit results. You must maintain:

• An Internal Audit Programme or Schedule
• Internal Audit Reports with findings and corrective action tracking that shows how quickly each one was closed

Requirement
9.3.1 General carries one addition: 

New in 2026, management review must now check that the QMS remains suitable, adequate, effective, and aligned with the organisation’s strategic direction (this last part is new). 9.3.2 Management Review Inputs splits risk and opportunity effectiveness into two separate items (g and h), matching the 9.1.3 change. 9.3.3 Management Review Results now explicitly names resource needs, alongside improvement opportunities and QMS changes, as something the review should produce decisions about.

What “Alignment with Strategic Direction” Actually Means
This addition exists because a QMS can technically tick every box in the standard while quietly becoming disconnected from where the business is actually going, for example, still focused on a product line the company has deprioritised, or missing controls for a new service the business has since expanded into. The new requirement simply asks leadership to check, during management review, that the QMS still reflects current business priorities, not just whether it’s running smoothly on its own terms.

How to Implement
Add a standing item to your management review agenda that asks directly: “does our QMS still match where the business is actually heading?” This doesn’t need a separate process; it can be a short discussion alongside the usual performance review. When you get to risk and opportunity actions, discuss them as two separate agenda points rather than one combined slide, and make sure any decisions about extra staff, budget, or tools are written down as an actual output of the meeting, not just implied by the discussion.

Mandatory Documents
Yes, explicitly mandatory. Documented information “shall be available as evidence of the results of management reviews.” You must maintain:

• Management Review Minutes covering all required inputs, including explicit decisions on resourcing