How to Transition from ISO 9001:2015 to ISO 9001:2026 in Malaysia

ISO 9001:2026 was published on 16 September 2026 and replaces ISO 9001:2015 as the current version of the standard. If your organisation is certified to ISO 9001:2015, you have until 30 September 2029 to complete the transition. This guide explains what the transition involves, which specific gaps require the most attention, and how to plan the process without disrupting your current certification.

What Is the ISO 9001:2026 Transition Period and What Is the Deadline?

The transition period runs for three years from the publication date of 16 September 2026. The deadline for all certified organisations to hold a valid ISO 9001:2026 certificate is 30 September 2029. After that date, ISO 9001:2015 certificates are no longer recognised by accreditation bodies or by purchasing organisations and government agencies that specify ISO 9001 as a contractor or supplier requirement.

The International Accreditation Forum (IAF) confirmed the three-year transition. Malaysian certification bodies including SIRIM QAS International, SGS Malaysia, Bureau Veritas Malaysia, TUV SUD Malaysia, and LRQA Malaysia are accredited through IAF-recognised bodies and will issue transition audits within this window. If your certificate expires in 2027 or 2028, your scheduled recertification audit becomes your natural transition point. If your certificate was recently renewed, you will need to schedule a specific transition audit before the 2029 deadline.

For a full explanation of what changed clause by clause in ISO 9001:2026, see our article on ISO 9001:2026 key changes for Malaysian businesses.

Which ISO 9001:2026 Gap Areas Require the Most Attention?

ISO 9001:2026 does not overhaul the QMS structure. Organisations with a well-functioning system will find that most documentation, processes, and controls remain applicable. The gap analysis should concentrate on the following areas, ranked by the likelihood of an audit finding.

Clause 4.2(c) is the most operationally significant new requirement. Organisations must now explicitly document which interested-party requirements their QMS will address and which process and person is responsible for each. A generic stakeholder matrix that lists customers, regulators, and suppliers without mapping their requirements to specific QMS processes will likely draw a nonconformity. This is one requirement where many established 2015 QMS systems will have a genuine gap, not just a documentation update.

Clause 5.1.1 and Clause 7.3 introduce quality culture and ethical behaviour as named, explicit expectations. Leadership must promote and demonstrate quality culture in practice, not just in policy. Awareness training for all personnel must now include understanding of quality culture and ethical behaviour. Management review records and internal communication evidence should reflect that leadership is actively shaping the culture.

Clause 6.1 separates risks and opportunities into distinct subclauses (6.1.2 for risks, 6.1.3 for opportunities), each requiring its own analysis and action cycle. Clause 6.3 on change management expands from four considerations to seven, adding communication of the change, monitoring of how it works, and review of results. Your change management procedure and any associated checklists need to be updated to include a post-implementation effectiveness review.

Clause 7.1.6 on Organisational Knowledge now requires the knowledge needed to achieve the results of the whole QMS, not just operational processes. Retaining, applying, and sharing that knowledge are explicit requirements. Knowledge handover plans, mentoring arrangements, and lessons-learned processes that capture QMS-relevant knowledge become part of what an auditor may examine.

Clause 9.2.2 now requires each internal audit to have a documented objective alongside its scope and criteria. Your audit planning documents and audit reports need to be updated to include this. Clause 9.3.2 on Management Review Inputs adds two new separate items: the effectiveness of actions on risks and the effectiveness of actions on opportunities must now be reviewed independently. Clause 10 has been renumbered: update any QMS references to the former Clause 10.3 (Continual Improvement) to reflect the new Clause 10.1.

For a clause-by-clause explanation of what the ISO 9001 requirements mean in practice, see our guide to ISO 9001 requirements explained.

How Should You Plan Your ISO 9001:2026 Gap Assessment?

A gap assessment maps your current QMS documentation and practices against the ISO 9001:2026 requirements clause by clause. For most organisations transitioning from ISO 9001:2015, it can be completed in a few days by an internal team or an external consultant with knowledge of the revised requirements.

In our work with Malaysian businesses on management system transitions, the most common delays come from documentation updates rather than process changes. The QMS may be functioning correctly, but the documented procedures, context analysis, and internal audit checklists have not been updated to reflect the revised requirements. Starting with documentation allows gaps to be addressed systematically before the transition audit.

Key documents and records to review include: the context of the organisation document (add climate change relevance assessment and Clause 4.2(c) interested-party requirement mapping); leadership commitment and management review records (quality culture and ethics evidence, separate risk and opportunity effectiveness review); risk and opportunity register (separate into distinct cycles for 6.1.2 and 6.1.3); change management procedure (add communication, monitoring, and effectiveness review steps for Clause 6.3); knowledge retention plan or handover records (Clause 7.1.6); awareness training materials (add quality culture and ethical behaviour content); internal audit plan and report templates (add audit objectives for Clause 9.2.2); and any documents referencing old clause numbering in Clause 10.

How Does the Transition Audit Work in Malaysia?

A transition audit is conducted by your existing certification body or another body accredited by STANDARDS MALAYSIA (Department of Standards Malaysia). SIRIM QAS International, SGS Malaysia, Bureau Veritas Malaysia, TUV SUD Malaysia, and LRQA Malaysia are among the accredited bodies currently offering ISO 9001:2026 transition services.

For most organisations, the transition audit is integrated into a scheduled surveillance or recertification audit rather than conducted as a standalone event. The auditor will verify that your QMS has been updated to address the ISO 9001:2026 changes and that the new requirements are implemented, not just documented. If nonconformities are found, minor ones typically allow 30 to 90 days for corrective action and evidence submission. Major nonconformities may require a follow-up visit before the new certificate is issued.

Organisations considering adding environmental management to their scope may find that the Clause 4 context changes in ISO 9001:2026 align well with ISO 14001 requirements, making an integrated transition audit more efficient.

What Happens If Your Organisation Does Not Transition by September 2029?

Organisations that have not completed a transition audit and received a new ISO 9001:2026 certificate by 30 September 2029 will have their certification lapsed. The practical consequences depend on how your ISO 9001 certification is used.

If ISO 9001 certification is a contractual requirement from customers or a condition of government or GLC procurement qualification, a lapsed certificate will immediately affect your ability to tender for contracts or maintain approved supplier status. In Malaysia, government procurement processes through ePerolehan and GLC supplier panels frequently list ISO 9001 as a mandatory supplier requirement. Loss of certification in this context has direct commercial impact.

Recertifying after a lapse requires a full initial certification audit rather than the shorter transition audit, taking longer and costing more. The organisations that will face this scenario are those that underestimate the documentation update work and leave transition planning to the final year of the window.

Transitioning from ISO 9001:2015 to ISO 9001:2026 is a managed process, not a crisis response. The three-year window gives your organisation time to conduct a gap assessment, update your documentation systematically, and schedule a transition audit without disrupting operations. The key is to start with the areas most likely to produce an audit finding, particularly Clause 4.2(c), Clause 6.1, and Clause 7.1.6, rather than leaving the assessment until the year before the deadline.

Contact Connext to discuss your ISO 9001:2026 gap assessment and transition plan. Our team works with Malaysian businesses on ISO certification across manufacturing, services, and supply chain industries.

Frequently Asked Questions

Do we need to pay for a completely new certification audit to transition?

No. A transition audit is less extensive than a full initial certification audit and is typically integrated into your existing surveillance or recertification audit cycle. It focuses on the gaps between your current QMS and the ISO 9001:2026 requirements rather than auditing the entire system from scratch.

Can we transition to ISO 9001:2026 before our current certificate expires?

Yes. You can request a transition audit at any point during the three-year transition period. Transitioning early provides more scheduling flexibility and avoids the deadline pressure that will build as September 2029 approaches.

Does our entire QMS documentation need to be rewritten?

No. The primary updates are to the context of the organisation document (Clause 4.2c), the risk and opportunity register (Clauses 6.1.2 and 6.1.3 separated), the change management procedure (Clause 6.3), knowledge retention records (Clause 7.1.6), awareness training (Clause 7.3), and internal audit plans and reports (Clause 9.2.2 objectives).

How long does a transition audit typically take for a Malaysian SME?

For an organisation already certified to ISO 9001:2015, a transition audit is typically one to two audit days depending on organisation size and QMS scope. Your certification body will confirm the specific duration when you schedule the transition.

What is the most important thing to fix before the transition audit?

Clause 4.2(c) is the most common gap: ensure your stakeholder analysis explicitly documents which interested-party requirements your QMS will address and assigns process ownership for each. Auditors will probe this specifically because it is a genuinely new obligation, not just a restatement of the 2015 requirement.