ISO 9001:2026 · Clause 5.1.1 i) and 7.3 e)
Quality culture, and what counts as evidence
Posters do not satisfy it. Neither does a values statement or a survey nobody acted on. What clause 5.1.1 i) and clause 7.3 e) actually require, with three worked examples of management actions that pass.
The short answer
Clause 5.1.1 i) of ISO 9001:2026 requires top management to promote quality culture and ethical behaviour, and clause 7.3 e) requires everyone to be aware of it. Neither is satisfied by a poster, a values statement, or a culture survey with no recorded action. What satisfies 5.1.1 i) is dated actions taken by top management with measurable outcomes. What satisfies 7.3 e) is operators answering in their own words, consistently, across every shift.
This is the requirement most likely to be underestimated in the transition, because it produces no obvious document. It is evidence, not paperwork.
Where culture lands in the standard
Quality culture is one of the six changes the ISO 9001:2026 foreword names. It is not a clause of its own. It appears in three places, and each asks for something different.
| Where | What it says | Who has to demonstrate it |
|---|---|---|
| 5.1.1 i) | Top management shall demonstrate leadership and commitment by promoting quality culture and ethical behaviour. One of twelve commitments, a) to l) | Top management. Not the quality manager. The auditor will interview a director |
| 5.1.1 Note 2 | An organization’s quality culture and ethical behaviour are reflected in its shared values, attitudes, practices and actions | Nobody. It is a note. But it is the working definition an auditor will use |
| 7.1.4 note | Some factors in the environment for the operation of processes can be influenced by the organizational quality culture and ethical behaviour | Nobody. Informative. Social and psychological factors were already in the 2015 note |
| 7.3 e) | Persons doing work under the organization’s control shall be aware of the organizational quality culture and ethical behaviour. One of five awareness items | Everyone. Tested by interview, on the floor, across shifts |
Two requirements, two audiences, two kinds of evidence. Sites that treat it as one initiative usually satisfy neither.
The definition the standard gives you
Note 2 under 5.1.1 tells you culture is reflected in shared values, attitudes, practices and actions. There is no requirement to adopt that wording, but there is a strong practical reason to.
If your in-house definition pulls against the note, whether purely aspirational or purely about compliance, you have given an auditor an easy opening question, and you have made your own evidence harder to organise. Using the note’s four words as headings gives you a structure that maps directly onto what an auditor is looking for:
The fourth is where the evidence lives. The first three are context.
Five things that do not satisfy it
We have seen all five offered at audit, and we have seen all five written up.
- Posters on the wall. A quality policy in a frame is evidence the policy was printed. It is not evidence top management promoted anything.
- A values statement in the induction pack. Same problem. It shows the words exist. Clause 5.1.1 i) uses the verb promoting, which is an activity, not a document.
- A culture survey with no recorded action. This one is worse than nothing. A survey that found problems and produced no dated action is documented evidence that management knew and did not act.
- A management review slide that says culture is important. An assertion in minutes is not an action with an outcome.
- A signed attendance register for culture training. This is the 7.3 e) version. Signatures prove attendance. Awareness is proved by what people say.
The trap. Because none of these are wrong, sites do all five, feel well prepared, and are surprised by the finding. Every item above is worth doing. None of them is evidence of the thing the clause asks for.
What a dated action actually looks like
The shape that works is always the same: something happened, top management decided something, the decision is dated, and a number moved. Three worked examples from packaging and manufacturing sites.
| Example 1 | Example 2 | Example 3 | |
|---|---|---|---|
| The trigger | A customer complaint about colour drift that an operator had noticed at 02:00 and not stopped the run for | Two operators separately reported the same near-miss, and neither report was actioned | Month-end pressure led to a batch being released against a pending lab result |
| What management did | The MD changed the stop-the-line rule so any operator can halt a run on a quality concern without supervisor approval, and said so at both shift briefings in person | The operations director created a two-working-day response commitment on every operator report, with the response given to the person who raised it by name | The MD wrote into the release procedure that no batch ships against a pending result regardless of month-end, and removed the release authority from the commercial manager |
| Dated evidence | Revised WI 8.5.1 rev 3, 14 Mar 2026; briefing attendance and notes, both shifts, 17 Mar 2026 | Revised procedure and the report log showing response dates against each entry, from 2 Apr 2026 | Revised PRO 8.6 rev 5, 8 May 2026; responsibilities matrix updated same date |
| The number that moved | Colour complaints per million units: 31 to 9 over two quarters | Operator reports raised per month: 4 to 17. Rising is the point | Batches released against pending results: 6 in the prior year to 0 |
| Why it persuades | Management gave away control to the floor, which is costly and therefore credible | The measure went up, showing the system got more honest rather than quieter | Management removed an authority from a senior commercial role. Hardest kind of evidence to fake |
Note what all three have in common: top management gave something up. A culture claim that cost the business nothing is the one an auditor probes hardest.
The toolkit ships a quality culture evidence pack. Part 3 Module 1 covers 5.1.1 i), the 7.1.4 note and 7.3 e): the evidence log with the four Note 2 headings, a floor-interview practice set, multilingual induction material, and the working definition drawn from the standard’s own wording.
Building the evidence pack
One document, maintained continuously, not assembled the week before the audit. An auditor can tell the difference instantly, because a pack written in one sitting has entries that all date from the same fortnight.
- Open the log now, and backdate honestly
Go back twelve months. Find the decisions top management already made that were culture decisions, even though nobody called them that. Most sites have three or four and have never written them down. Record them with their real dates and their real evidence.
- Record the trigger, not just the decision
“Why did you change this?” is the second question every auditor asks. An action with no trigger reads as a policy change; an action with a trigger reads as a response, which is what culture looks like.
- Attach a measure to each one
It does not have to be a KPI. Complaints, reports raised, overdue actions, repeat findings, releases against pending results. Pick something that already exists in your data so you are not building a measurement system as well.
- Record the ones that did not work
An action that was taken, measured, found ineffective and then followed by a second action, is stronger evidence than three successes. It shows the loop runs.
- Put it on the management review agenda
Clause 9.3 does not list culture as an input, but 5.1.1 is what an auditor writes the finding against when a review shows no engagement. A standing item keeps the log current and creates its own dated trail.
- Review it quarterly against 5.1.1 i) and k)
Item k) requires promoting risk-based and opportunity-based thinking. The same log serves both, and the same weakness, assertion without action, fails both.
Passing the 7.3 e) interview
Clause 7.3 e) is tested by asking people. The bar is not that they can recite anything; it is that they can describe, in their own words, what is expected of them when quality and something else are in tension.
The real questions
“What do you do if you think something is not right?” · “Has anyone ever stopped a run here?” · “What happens if you raise something?” · “Who would you tell?” · “What if the shift manager disagreed with you?” None of these mention the word culture.
A consistent, specific answer
Different words from different people, describing the same actual practice, and ideally naming a real occasion. Consistency across shifts matters more than polish. One person who says “we’d stop it and call Thabo” is worth more than five who recite the policy.
The tell-tale patterns
Identical phrasing from everyone, which reads as coached. Day shift confident and night shift blank. Or the honest, fatal answer: “You can stop it, but you’d get grief for it.” That last one is a finding against 5.1.1 i), not against the operator.
Practise, do not script
Ask your own people these questions during internal audits, all year. Record what they actually said. If the answers are thin, that is your gap analysis, and you have time to fix the practice rather than the wording.
Language matters in South Africa. Awareness is demonstrated in the language people work in. If induction and briefings are delivered only in English to a workforce that works in isiXhosa, isiZulu or Afrikaans, 7.3 e) will be hard to evidence however good the material is. Multilingual induction is not a requirement of the clause, but it is often the practical difference between passing and failing it.
The “ethical behaviour” half
The clause says quality culture and ethical behaviour, and the ethical half gets forgotten because it sounds like a governance topic. In a quality management system it is narrower and more concrete than that: it is about whether records tell the truth.
- Records reflect what happened. Checks recorded at the time they were done, not filled in at the end of a shift. This is the single most common integrity problem on a factory floor and auditors look for it by comparing handwriting and ink.
- Results are not adjusted. Nobody re-tests until a result passes without recording the earlier result and the reason.
- Release decisions are made by the person with the authority. Not by whoever was available at 18:00 on a Friday.
- Nonconformities are raised, not absorbed. A site with no minor nonconformities is not a site with no problems.
- People can raise a concern without consequence. If there is a route to report a quality or integrity concern, and evidence it has been used, that is the strongest ethical-behaviour evidence there is.
If you already run food safety culture
Sites certified to FSSC 22000 already have a food safety culture programme under Additional Requirement 2.5.8. That is a real head start, and it should not be duplicated.
| What you already have | Decision | What to change for ISO 9001:2026 |
|---|---|---|
| Culture plan with objectives, activities and measures | EXTEND | One plan covering both. Add quality objectives and quality measures alongside the food safety ones |
| Culture survey and results | EXTEND | Add quality questions to the same survey. Crucially, add the action log, because a survey without recorded action fails 5.1.1 i) |
| Induction and awareness material | EXTEND | One induction covering 7.3 a) to e). Quality culture becomes a section, not a second session |
| Top management commitment evidence | EXTEND | One evidence log. Tag each entry food safety, quality, or both. Many entries will be both |
| Food safety specific behaviours (hygiene, reporting illness) | SEPARATE | Leave them where they are. They have no ISO 9001 equivalent |
If you are working out how far to take this, our article on whether you need both ISO 9001 and FSSC 22000 covers the full SHARE, EXTEND and SEPARATE decision across all thirty-eight clause-level rows.
Clause 7.3 e) is tested by interview, and your team is the evidence. The Introduction to ISO 9001:2026 course is built for everyone an auditor will interview (supervisors, line leaders, QA staff, stores and dispatch), and it reaches night shift as easily as day shift.
Questions people ask
Is quality culture auditable at all, or is it just a soft requirement?
It is auditable, and it is audited the same way food safety culture has been audited under GFSI schemes for years: by asking top management what they did and when, and by asking operators what they would do. What makes it feel soft is that it produces no single document. What makes it auditable is that actions have dates and measures have numbers. Treat it as an evidence requirement rather than a documentation requirement and it stops being vague.
Does top management have to be personally involved, or can the quality manager own it?
Clause 5.1.1 is explicitly about top management demonstrating leadership and commitment, and it cannot be delegated. The quality manager can maintain the evidence log, but the actions in it have to be decisions top management made, and the auditor will interview a director to confirm it. A pack full of quality-department initiatives is the most common way this requirement fails.
How much evidence is enough?
There is no number. For a single manufacturing site, four to six well-documented actions across a twelve-month period, each with a trigger, a date and a measure, is comfortably defensible, especially if one of them was measured and found ineffective and followed by a second action. Twenty thin entries are weaker than four strong ones, because thin entries invite the auditor to test every one.
We are a small site. Do we still need a culture programme?
You need the evidence, not the programme. On a twenty-person site, an auditor is far more likely to be persuaded by watching the owner stop a job on a quality concern and by hearing three operators describe the same expectation than by any documented initiative. Keep a simple log of decisions with dates and outcomes. The smaller the site, the more the behaviour itself is the evidence.
What if our culture survey results are bad?
Then you have a finding waiting to happen, but only if you do nothing. A poor survey followed by dated management action and a re-measure is strong evidence the system works. A poor survey sitting in a folder with no action is documented proof that management knew and did not respond, which is worse than never running the survey. If you are going to ask, commit to acting on the answer.
Is ethical behaviour the same as a code of conduct?
A code of conduct is useful but it is not what the clause is testing in a quality context. Here, ethical behaviour is mostly about data integrity: that records are made at the time, that results are not quietly re-tested until they pass, that release decisions are made by the person with the authority, and that people can raise a concern without consequence. Evidence of a concern actually being raised and handled is worth more than the code itself.
ISO 9001:2026 is published by the International Organization for Standardization. Clause references follow the sixth edition published on 16 September 2026; confirm the lettering against your own controlled copy. FSSC 22000 is operated by Foundation FSSC. ASC Food Safety Consultants is an independent consultancy, training provider and auditing firm. Our toolkits and courses are our own products and are not approved, endorsed or accredited by ISO, by Foundation FSSC or by any certification body.