Clause 10: Improvement

Requirement
The organisation must keep improving how suitable, adequate, and effective the QMS is, using results from monitoring, measurement, analysis, evaluation, and management review to find and act on improvement opportunities. This includes improving processes, products, and services, getting ahead of future needs and expectations, and correcting, preventing, or reducing anything undesirable. Unchanged from 2015.

How to Implement
Don’t treat improvement as something that only happens once a year at management review. Use audit findings, incident reviews, and staff feedback as they come in throughout the year, so small issues get fixed before they pile up into something bigger.

Mandatory Documents
There’s no explicit “shall be available as documented information” statement tied specifically to 10.1 itself. Improvement activity gets evidenced through the mandatory records of other clauses instead, such as management review decisions, audit results, and corrective actions.

Requirement
When something doesn’t conform, the organisation must deal with it, work out whether corrective action is needed to stop it happening again, carry out that action, check whether it actually worked, and change the QMS if necessary.

New in 2026: a new item (e) requires the organisation to “update the risks and opportunities determined during planning, if necessary.”

What This New Item Actually Means
When something goes wrong, it sometimes reveals that your original risk assessment missed something, or that a risk you thought was low is actually bigger than you realised. This new requirement simply asks you to check, every time you deal with a nonconformity, whether your Clause 6 risk and opportunity picture needs updating as a result, rather than fixing the immediate problem and leaving the underlying risk register untouched and out of date.

How to Implement
Add one extra question to your corrective action process: “does this tell us anything that should change our risk or opportunity register?” This keeps a recurring or significant nonconformity from being treated as a one-off event, and instead feeds it back into the bigger risk picture your ISMS runs on.

Mandatory Documents
Yes, explicitly mandatory. Documented information must be available as evidence of the nature of nonconformities and the actions taken, and the results of any corrective action. You must maintain:

• A Nonconformity and Corrective Action Register, with a field noting whether the risk or opportunity register was updated as a result