Setting up a quality system: not more procedures but more coherence

The golden rules

1. Start with goals and risks Let business operations be the starting point, not the numbering of standard paragraphs.
    
2. Make coherence visible Link policies, processes, risks, measures, KPIs, documents, audits and actions.
    
3. Establish ownership in the lineProcess and action owners bear the substantive responsibility; The quality manager monitors the coherence.
    
4. Work from one up-to-date source Avoid local copies, duplicate lists, and conflicting information.
    
5. Make it part of everyday work The system should help employees and not only become visible around audits.
    
6. Send with up-to-date information Use dashboards, trends, alerts and personal task overviews.
    
7. Assess demonstrable effect Make visible what has been carried out, by whom, with what evidence and with what result.
    
8. Purposeful growthChoose a maturity level that suits strategy, risks, size and supply chain responsibility.
    

The five levels of maturity

Ad hoc

Limited formalization; Knowledge is in heads and personal files.

Level 2

Reactive

Procedures exist, but actions mainly follow from complaints, incidents and audits.

Level 3

Controlled

Processes have owners, audits are planned, and KPIs and actions are tracked.

Level 4

Proactive

Trends and increasing risks become visible at an early stage; Steering is preventive.

Level 5

Integrated

Furnish to the desired level

• Determine starting level: assess structure, ownership, coherence, topicality and room for improvement.
• Choose ambition level: align this with strategy, risks, customer expectations and certification.
• Centralize the basics: bring together documents, roles, registrations, and actions.
• Make connections: link goals, processes, risks, measures, evidence and KPIs.
• Trigger workflows: Automate review, approval, alerting, tasks, and escalations.
• Organize management information: show current performance, trends, complaints, audits and actions.
• Periodic recalibration: assess whether the chosen level still fits context and strategy.

Key building blocks

Strategy and objectives

Translate strategic and operational goals into processes, indicators, responsibilities and actions.

Process management

Show processes, owners, documents, risks and KPIs in cohesiveness.

Risk management

Link risks to goals, processes and measures and reassess them periodically.

Document and knowledge management

Centrally manage information with versions, approval, read receipt, and revision deadlines.

Audit and improvement management

Give findings and actions an owner, deadline and status and assess effectiveness.

Dashboards

Shift the focus from manual reporting to actual steering.
 

Preparing for ISO 9001:2026

ISO expects the new edition to replace ISO 9001:2015 in September 2026. Therefore, only use the final text as a normative basis after publication.

What can already be taken into account

• Stronger link between context, stakeholders, strategy and the quality system.
• Clearer management of risks, opportunities and organizational changes.
• More attention to quality culture, leadership, ethical conduct and shared ownership.
• Better assurance of knowledge, competencies and traceable documented information.
• Data-driven monitoring, trend analysis and future-oriented management assessment.
• Attention to digitization, AI, information security, sustainability, climate and chain dependencies where relevant.

Please note: treat this as a preparatory direction until the final standard text is available and a formal gap analysis can be carried out.
 

Conclusion

A mature quality system is not a document collection, but a coherent operating system. By applying the golden rules and growing purposefully to an appropriate level, less administrative ballast, more ownership and a stronger improvement cycle are created.