.png)
A surveillance audit rarely fails because an organization cannot locate a policy manual. Problems appear when an auditor asks the next question.
The procedure exists, but the training record is incomplete. A CAPA is marked closed, but there is no evidence that the corrective action worked. A changed specification is available, but teams cannot show which products, methods, documents, or employees were affected. Management review occurred, but the records do not show how quality data informed decisions.
ISO 9001:2026 will increase attention on how organizations maintain and use quality evidence. The revised standard is expected to be published by ISO/TC 176/SC 2 on September 16, 2026. Until the final text is issued, organizations should avoid claiming compliance with requirements that have not yet been published. They can still prepare by improving the evidence trails that surveillance audits already test.
The most useful preparation is not a last-minute document collection exercise. It is an honest review of whether the quality system can show what happened, who decided, what evidence was reviewed, and whether the organization acted effectively.
Can you reconstruct the history of a quality decision?
An auditor may begin with a deviation, complaint, nonconformance, CAPA, product change, audit finding, or out-of-specification result. The organization should be able to follow the record from the initial event through investigation, decision, action, approval, and closure.
That history should show more than a sequence of status changes.
For a deviation, the record may need to show the affected product, material, batch, sample, process, specification, procedure, supplier, or customer. It should show containment actions, investigation evidence, root-cause analysis, product disposition, corrective actions, approvers, and the basis for closure.
A review becomes difficult when the evidence is scattered across email, spreadsheets, document folders, laboratory systems, and separate quality records. The organization may have completed the work, but it cannot demonstrate the complete story efficiently.
Test this before the audit. Select a recently closed quality event and ask a reviewer who was not involved in the original work to explain what happened using the available records. If they need several exports and personal guidance, the evidence trail needs improvement.
Can you show that controlled documents are current and effective?
Document control is more than maintaining a library of approved procedures.
The organization needs to demonstrate that the current version was reviewed and approved, that obsolete versions are controlled, that changes were evaluated, and that affected people received the right training before the revised procedure took effect.
Consider a revised test method. The audit trail should show the previous and current versions, the reason for the change, review and approval history, effective date, affected specifications or forms, required training, and evidence that personnel performing the method were qualified under the current instructions.
This is where disconnected systems create unnecessary risk. A document-management platform may show that an SOP was approved, while the training system holds completion records and the laboratory system holds the results generated under the method. If those records cannot be connected, quality teams must reconstruct the evidence manually.
The question is whether the organization can show the full lifecycle of a controlled requirement, not simply the latest PDF.
Are CAPAs closed with evidence of effectiveness?
A CAPA record is not complete when the assigned action is checked off.
The organization needs to show that the action addressed the cause of the problem and that the problem did not continue in the same form. That requires an effectiveness check grounded in evidence.
If an investigation concluded that a procedure was unclear, revising the procedure may be appropriate. The effectiveness review should then consider whether similar deviations, errors, or complaints continued after the change. If the trend remains, the organization may need to review training, process design, forms, equipment, workload, supervision, or the original root-cause analysis.
Before the audit, select closed CAPAs that resulted from recurring or significant events. Confirm that each record explains the initiating issue, investigation, root cause, action plan, implementation, approval, and effectiveness review. Confirm that the conclusion is supported by relevant data rather than a statement that the task was completed.
Can you trace a change to every affected record?
Changes can affect far more than the record where they begin.
A supplier change may affect materials, products, specifications, manufacturing instructions, incoming inspection, supplier qualification, customer commitments, and quality risks. A test-method change may affect training, specifications, results, release decisions, and historical trend analysis. A process change may require updates to documents, validation evidence, equipment settings, and quality controls.
The change-control process should show what changed, why it changed, which records were assessed, what evidence was reviewed, what risks were considered, who approved the decision, and how implementation was verified.
A practical mock-audit question is simple: choose one recently approved change and ask the team to demonstrate its impact. Can they show the affected products, documents, training requirements, quality records, and implementation actions? Can they distinguish completed actions from work that remains open?
If the answer depends on separate trackers maintained by different functions, the organization should address those gaps before the audit.
Can leadership show how quality information drives action?
Management review should demonstrate more than attendance and a presentation deck.
Leaders need access to quality information that shows the health of the system: complaints, deviations, CAPAs, audit findings, supplier performance, training status, process trends, product quality, customer feedback, risks, opportunities, and resource needs.
The important question is what happened next.
If a management review identified recurring laboratory errors, supplier delays, overdue CAPAs, or an increase in customer complaints, the organization should be able to show the decision, assigned action, owner, due date, and subsequent review of effectiveness.
A management-review record is most useful when it connects leadership decisions to the underlying evidence. An auditor should be able to move from a quality trend to the events that produced it, then to the action the organization took in response.
Run a mock audit using live records
The strongest audit preparation uses real examples rather than hypothetical checklists.
Choose one recently closed deviation, one CAPA, one controlled document revision, one product or supplier change, and one management-review action. Ask a cross-functional group to retrieve the full evidence trail for each one.
The exercise should test whether the organization can show:
- The current controlled record and relevant prior version
- The people responsible for review, approval, and execution
- The underlying evidence that informed the decision
- The affected products, processes, documents, training, or suppliers
- The action taken and evidence that it was implemented effectively
Do not treat missing information as an audit-preparation failure. Treat it as a useful signal about where the quality system needs stronger relationships, clearer ownership, or better record discipline.
Prepare for the final ISO 9001:2026 text
The current ISO 9001 standard remains applicable until the revised edition is formally published and transition requirements are established. Organizations should monitor ISO and their certification body for authoritative updates rather than relying on summaries or early interpretations.
In the meantime, the most durable preparation work is practical. Strengthen document control, training traceability, change control, CAPA effectiveness, audit evidence, supplier oversight, management review, and the links among quality records.
These improvements help with surveillance audits today. They also make the organization more capable of responding when the final ISO 9001:2026 requirements and transition timeline are released.
.png)
.png)
.png)
