Auditing Management of Change in ISO: How to Plan a Process

A change plan is audit-ready only when it shows how the change will be assessed, resourced and reviewed. For ISO 9001, auditing management of change focuses on clause 6.3, which addresses planning changes while maintaining the integrity of the quality management system.

Documented approvals matter, but an audit also examines whether the plan reflects operational needs and clearly defines responsibilities, risks, resources and follow-up. A procedure alone may not show how a change works in practice or whether it achieved its intended results.

This guide explains what auditors look for in change planning, from impact assessments and assigned responsibilities to implementation evidence and post-change review. It also clarifies the practical difference between change control, which governs specific changes, and broader change management, which supports their effective adoption. You’ll see how these elements connect and what a credible, evidence-based process needs to demonstrate.

How Do ISO Auditors Assess Your Change Process?

For ISO 9001, auditors assess change planning under clause 6.3 and examine how planned changes affect the quality management system. During ISO certification audits, they trace change recommendations through approval, implementation, verification and review.

Change Recommendations and Implementation Plans: What Auditors Review

A change recommendation explains the need for a change and its intended outcome, while the implementation plan assigns actions, responsibilities and review points. Auditors compare these records with the change as implemented, such as a revised production step or new software workflow. They assess whether the plan addresses dependencies and defines how success will be measured. This can reveal gaps between an approved proposal and the process in practice.

Resources for Implementing Changes: Audit Considerations

Resource assessment shows whether the organization has allocated what implementation requires, including competent people, knowledge, infrastructure, time and testing. Auditors compare the plan with operational evidence, such as whether staff received relevant training before using a revised procedure. If a change relies on new equipment or external expertise, the assessment examines how those needs were addressed. In certification audits, resource gaps matter when they prevent planned controls or results from being achieved.

Change Approval and Implementation: What Auditors Check

Approval records show who authorized a change, what risks were considered and how implementation was controlled. ISO 9001 clause 8.1 addresses control of planned changes and review of unintended changes, including action to prevent or mitigate adverse effects when necessary. For temporary and emergency changes, auditors examine the justification, approval authority, safeguards and subsequent review. They may trace an urgent equipment adjustment from its initial record through restoration or formal adoption.

Verification tests whether a change achieved its intended result without creating unacceptable effects. Auditors may compare test results, inspection records or service performance before and after implementation. Post-implementation monitoring checks whether controls remain effective in routine operations. If results reveal a problem, the audit follows up on corrective actions and considers whether lessons were identified for future changes.

To plan an audit, define the sample around a complete change record, then trace its recommendation, risk assessment, approval, resources, implementation evidence and review. Include a completed change and, where available, a temporary or emergency example. Ask process owners how effectiveness was evaluated and what changed after a lesson emerged. Auditors also test whether documented arrangements match operational evidence. This structured evidence trail supports an impartial assessment; management system certification evaluates how requirements are applied in practice.

Assessing operational requirements before business changes

Before approval, organizations should determine why a change is needed and assess its operational effects. ISO 9001, ISO 14001 and ISO 45001 include management-of-change requirements.

Operational Requirements and Change Risks

Operational assessment connects a change’s purpose with the processes, people and controls it could affect. This analysis helps decision-makers identify risks before approving a proposal, rather than discovering operational gaps during implementation.

For example, moving a production step to a new location could affect equipment, staff competence, process hand-offs and product conformity. Organizations should consider the impact on customers and stakeholders, alignment with quality objectives, and effects on critical processes. These factors help determine whether a proposed change supports business needs without undermining existing controls.

Risk documentation should record a change’s potential consequences and opportunities before approval. Decision-makers can use the assessment to prioritize actions, assign ownership and identify resources, such as training or equipment. The depth of analysis should reflect the change’s potential effect on operations.

ISO Standards with Change Requirements

ISO standards address change within relevant management systems, so the applicable requirements depend on the system being assessed. ISO 9001 clause 6.3 concerns planning changes, while ISO 45001 clause 8.1.3 addresses management of change.

ISO 14001 also requires organizations to manage changes as part of their environmental management system. The practical focus differs by system: a quality change may affect process conformity, while an environmental change may alter how environmental aspects are controlled. The organization’s scope and the change itself shape the assessment.

For a proposed change affecting several systems, decision-makers should identify each relevant requirement before approval. A revised production process, for instance, may need consideration within quality, environmental and occupational health and safety arrangements. This helps ensure the plan addresses applicable operational controls rather than treating the change as an isolated task.

Auditors examine whether the organization assessed a change’s purpose, impacts and risks against relevant system requirements. They can compare the documented assessment with the approved plan and affected processes. This evidence helps show whether operational needs informed the decision and risks were considered before implementation.

Difference between change control and change management

ISO 9001, ISO 14001 and ISO 45001 address change within their management systems. ISO 9001 covers planning changes in clause 6.3, operational changes in clause 8.1, design changes in clause 8.3.6, and production or service changes in clause 8.5.6. ISO 45001 addresses management of change in clause 8.1.3. Auditing management of change ISO requirements means considering which controls apply to the process being assessed.

Change control governs specific changes and their effects; change management also considers how people adopt and sustain them. This distinction helps auditors assess controlled execution alongside progress toward management system objectives.

Product and Service Change Control

Product and service change control reviews and governs modifications that could affect conformity with requirements. It matters because a change can introduce defects if its effects aren’t assessed or controlled.

Under ISO 9001 clause 8.3.6, identified design and development changes must be reviewed and controlled to prevent adverse impacts on conformity. For example, a revised product specification should have evidence of review, approval and any necessary action before release. Clause 8.5.6 covers changes to production or service provision, with review and control as needed to maintain conformity. Auditors can trace a change to the affected output and assess its controls.

IT change management is part of IT general controls for service organizations. A software update, for example, may need documented authorization, testing and an implementation record. These controls address technical changes; a broader change management process also considers communication, training and whether affected personnel understand new practices. In this context, auditing management of change ISO controls can examine both technical records and their connection to the management system.

Formal Systems and Common Audit Findings

ISO management of change means controlling changes within relevant management system processes; a formal change management system is a broader approach to organizational adoption. The distinction matters because certification audits assess applicable standard requirements, not simply whether a separate framework exists.

Common findings include missing approval records, incomplete risk assessments, undocumented controls or absent post-change reviews. A 2010 FISMA audit found local change-control processes for Active Directory updates were not documented in the Division of IT’s policies and procedures, according to the Office of Inspector General, Board of Governors of the Federal Reserve System. Such gaps can obscure how changes were authorised and controlled.

An effective audit trail connects a change request, approval, impact assessment and implementation evidence. Auditors can compare these records with the affected process, such as a revised service workflow, to determine whether documented controls match practice.

How ISO Certification Auditors Gather Evidence Through Interviews and Observation

Auditors combine interviews, observation and records to assess whether a change process works as intended. They compare what managers and employees describe with workplace evidence, such as a revised procedure in use or a training record.

Interviews help establish how stakeholders understand a change’s purpose, responsibilities and controls. An auditor might ask a supervisor how a revised workflow was introduced, then speak with an employee who performs it. Differences in their accounts can indicate unclear communication or inconsistent implementation. Auditors may then examine the approved change record, training evidence and monitoring results to establish what happened.

Observation tests whether documented arrangements match operational practice. For example, during a production visit, an auditor may compare the current work instruction with the version staff use at the workstation. They can follow a process hand-off between teams and ask how staff identify an unintended effect. Auditors consider these observations alongside records and interview evidence, rather than treating them as isolated conclusions.

The certification audit also examines the internal audit programme. Auditors consider how its scope, timing and methods address processes, changes and relevant risks. They may sample internal audit reports to see whether findings were recorded, communicated and followed through. For instance, a report identifying a change-related issue should connect to its corrective action and subsequent review.

Internal auditor competence is assessed against assigned audit responsibilities. Evidence may include relevant training, experience, knowledge of audit methods and familiarity with the processes being assessed. Auditors can review training records and observe how an internal auditor interviews staff, samples records and reports findings. ISO 19011 provides guidance on audit principles, programme management, audit conduct and auditor competence.

A useful audit trail links the programme to completed internal audits and resulting actions. Auditors may select a change-related finding, then trace its evidence, assigned action and closure. They also consider whether internal audits remain suitable when processes or operational risks change. This helps assess whether the programme provides relevant oversight, rather than relying only on a schedule or completed forms.

For organizations, the practical test is consistency: interview answers, workplace observations and internal audit records should describe the same process. If staff describe different approval routes, or a work instruction conflicts with actual practice, auditors investigate the gap and its effect. This evidence-led approach supports an objective assessment of how change controls operate across the management system.

Identifying risks and improvement opportunities

A structured review connects each proposed change to its possible effects and intended benefits. Auditors assess whether organizations use that analysis to support decisions and refine controls.

Risks in Change Management

Change-related risks are possible adverse effects on operations, conformity or control effectiveness. Identifying them before implementation helps decision-makers select safeguards suited to the change.

Consider a company replacing a manual order-entry process with software. The assessment could examine incorrect data transfer, staff readiness, system access and delays affecting customer orders. Auditors can compare those risks with the selected controls, then assess whether process owners understand their responsibilities.

The review should also consider effects across process boundaries. A new inspection method, for example, may change how production staff release work to the next department. If acceptance criteria or responsibilities become unclear, errors may pass between teams. Reviewing hand-offs helps reveal risks that an assessment limited to one department could miss.

Organizations can make the assessment more useful by linking each risk to its potential consequence and planned response. Auditors then have a traceable basis for assessing whether controls address the issue. If operational evidence shows a different effect, the assessment can be updated to reflect the process in practice.

Improvement Opportunities

Improvement opportunities are practical ways to make a process more effective while addressing a gap or inefficiency. Identifying them helps organizations prioritize actions with a clear operational benefit.

A gap analysis can compare current and intended process arrangements, then identify actions needed to close the difference. For example, repeated clarification requests at a hand-off may indicate that instructions or ownership need to be clearer. The resulting improvement should address the cause, not merely add another record or approval step.

Auditors can assess whether an opportunity is supported by evidence, assigned to a responsible role and followed through. A proposed change to reduce duplicate data entry, for instance, should be assessed for its effects on accuracy and downstream users. This clarifies the improvement objective and gives the organization a basis for reviewing its effect.

In the 2010 FISMA audit, local change-control processes for Active Directory updates were found undocumented in the Division of IT’s policies and procedures, according to the Office of Inspector General, Board of Governors of the Federal Reserve System. This example illustrates why documented responsibilities and process controls matter during change.

For an audit, evidence can be traced from an identified issue to its analysis, selected response and follow-up. Comparing those records with process hand-offs and employee accounts helps determine whether planned improvements address operational needs. The result is a structured view of risks and opportunities that can inform future decisions.

International Associates Limited

International Associates Limited provides independent assessment and certification for organizations seeking evidence that their management systems meet applicable ISO requirements. Its certification audits can be a practical next step when a business is preparing for certification, has introduced operational changes, or needs an impartial assessment of how its management system is implemented. The audit examines evidence against the relevant standard, including how changes are planned and controlled.

For organisations working to ISO 9001, the assessment considers the quality management system and its processes. ISO 14001 certification focuses on the environmental management system, while ISO 45001 addresses occupational health and safety. These standards relate to different management system responsibilities, so the applicable certification depends on the organisation’s needs and the system it intends to have assessed.

Audit preparation is most useful when the organization can identify relevant changes and provide evidence of how they were handled. This may include records showing how a change affected processes, responsibilities, operational controls or review activities. During an independent assessment, auditors examine how documented arrangements relate to implementation and whether the management system meets applicable requirements. Findings can clarify where evidence demonstrates conformity and where action may be needed.

International Associates Limited also provides Social Accountability Audits. This is relevant when an organization needs an assessment focused on social accountability rather than ISO management system certification. Selecting the appropriate audit or certification scope helps ensure the assessment addresses the organization’s intended requirements, rather than treating every management system or audit type as interchangeable.

Businesses may consider certification when they need independent assessment of a management system against a recognised standard. International Associates Limited’s certification services include ISO 9001 Quality Management System Certification, ISO 14001 Environmental Management System Certification and ISO 45001 Occupational Health and Safety. Each assessment is focused on the applicable requirements and evidence presented for the organisation’s system.

For an impartial assessment of your management system, contact International Associates Limited.

Frequently Asked Questions

What is Change Management?

Change management is the coordinated support that helps people understand and adopt an organizational change. It can include explaining why a new process is being introduced, clarifying who is affected and preparing teams for different responsibilities. For example, introducing a new customer-service platform involves more than installing software; staff also need to understand how customer enquiries will be handled through the new system.

What Does the Clause Say?

A clause sets out requirements or guidance relevant to a specific topic within a standard. Its meaning depends on the standard and edition being used, so the clause number alone isn’t enough to establish the audit criteria. In practice, organizations should identify the applicable standard, read the complete clause in context and relate its wording to processes within the management system’s scope.

What is ISO 19011:2018?

ISO 19011:2018 is guidance for auditing management systems. It addresses audit principles, audit programme management, audit conduct and auditor competence. Unlike a management system standard used for certification, it provides guidance on how audits can be organized and carried out. This distinction helps organizations use it to structure internal auditing without treating its guidance as a separate certification requirement.

What is Planning of Changes in ISO 9001?

Planning changes in ISO 9001 means considering the quality management system as a whole when a proposed change could affect it. A practical example is changing a process owner: related responsibilities, approvals and reporting arrangements may also need attention. Considering these connections helps prevent a local adjustment from creating inconsistencies elsewhere in the system or leaving important decisions without clear ownership.

Where Do Auditors Focus?

Auditors focus on the agreed audit scope and the processes that provide relevant evidence. For a change affecting several departments, they may examine where responsibilities or information pass between teams. For example, a new order-handling process could affect sales, scheduling and delivery. Looking across these interfaces helps establish whether the change is understood beyond the team that introduced it.

What does ISO require for management of change?

ISO requirements depend on the standard and management system being assessed. The relevant clauses and their application should be considered in context, including the organization’s scope and the processes affected. A change may be relevant to more than one management system, such as when a new production method has quality and environmental implications. The organization’s audit criteria should reflect the applicable requirements.

What Does an ISO Auditor Check in a Management of Change Process?

An auditor considers whether the process provides a clear, traceable account of how a change was handled. A useful record might connect the business reason for a change with the affected process owner and the resulting revision to a work instruction. This helps establish how the change relates to the management system, rather than leaving individual documents disconnected from the decision they support.

How do ISO auditors assess risks before an organization implements a change?

Auditors consider whether the organization’s risk analysis reflects how the proposed change could affect interconnected activities. For example, a revised order process may alter the information available to production staff or delivery teams. Examining these dependencies helps reveal effects that a review limited to the initiating department might overlook. Auditors can then consider whether the analysis addresses relevant interfaces and intended outcomes.