At first glance, ethics may sound like a subject for corporate governance, compliance or HR rather than quality management. In practice, however, a QMS depends heavily on what people do when the facts become inconvenient. An inspection result may be outside specification, a customer may report a serious problem, an internal auditor may identify a systemic weakness, a preferred supplier may perform poorly against objective criteria, or a software team may discover a critical defect shortly before a promised release.
In each of these situations, the organization may already have perfectly reasonable procedures. The real test is whether people are able — and expected — to follow them when doing so creates commercial, operational or personal pressure. That is where ethical behaviour becomes relevant to the QMS.
ISO/TC 176 had already identified ethics and integrity among the emerging themes considered in the development of the ISO 9000 family, linking them with leadership, trust, organizational context and management-system effectiveness. In the final draft of the revised ISO 9001, quality culture and ethical behaviour have become more visible in the leadership context.
This does not turn ISO 9001 into a corporate ethics or compliance standard. The connection is much more practical: can the organization trust the information, decisions and behaviours on which its QMS depends?
What does ethical behaviour mean in a quality management system?
There is little value in treating the subject as abstract philosophy. For a QMS, ethical behaviour becomes visible through practical questions about the integrity of information and decision-making:
Can inspection and test results be trusted?
Are known nonconformities reported accurately?
Can employees communicate bad news without inappropriate pressure?
Are customer complaints recorded as they actually occurred?
Can internal auditors report uncomfortable findings?
Are supplier decisions based on relevant evidence?
Are records or performance data altered to protect a KPI?
Does management receive the real picture or a version designed to look better?
These questions fit naturally with established quality management principles, particularly leadership and evidence-based decision-making. If an unfavourable inspection result is deliberately altered, the problem is not only that someone behaved improperly. The organization has also damaged its ability to make sound decisions because the evidence on which those decisions depend can no longer be trusted.
A QMS cannot work effectively if its own data are unreliable.
Case 1: Shipping a product with a known deviation
A manufacturer identifies a deviation shortly before a large shipment is due to leave. Repeating the inspection will delay delivery and may cause the production team to miss its monthly target. The organization is now dealing with a direct conflict between product requirements and commercial pressure.
From a QMS perspective, the relevant issue is whether the nonconforming output is identified and appropriately controlled. If a known deviation is deliberately concealed simply to protect a delivery or performance target, the problem goes beyond one questionable batch. The organization has weakened confidence in the entire control process.
A mature system records the actual condition accurately, allows the appropriate people to assess it and ensures that the decision is made by someone with the necessary authority. The outcome may be commercially inconvenient: additional inspection, rework, delayed delivery or communication with the customer may be necessary. What matters is that the information used to make that decision is not manipulated to produce a more convenient answer.
Case 2: Changing inspection records after the event
A batch has already been released when someone notices that one inspection record contains a value outside the accepted limit. An employee is then asked to amend the record on the basis that “we checked it again but forgot to enter the second result”, even though no documented recheck actually took place.
The immediate problem is clear: the documented information no longer represents what actually happened. But the wider QMS problem is more serious. Inspection and monitoring have value only when their results can be relied upon. If records are changed to conceal an unfavourable result, every later conclusion based on those records becomes questionable.
Management may believe that defect rates are improving, processes are becoming more stable and controls are effective when, in reality, those conclusions are based on inaccurate data.
If a genuine recording error occurs, it can of course be corrected through an appropriate controlled method that preserves the necessary traceability. If the original result was genuine, however, it should remain part of the evidence and the organization should address the actual deviation. The purpose of quality records is not to produce attractive statistics; it is to provide reliable information about what happened.
Case 3: Hiding a customer complaint to protect a KPI
A customer reports a genuine service failure. The issue is resolved quickly, but recording it as a complaint would damage the department’s quarterly customer-satisfaction indicator. The manager therefore suggests classifying it as a “general enquiry”.
The problem is not merely one of terminology. The organization is changing the classification because the real information is inconvenient. Since customer feedback is an important source of information about QMS performance, deliberately removing genuine complaints from the data gives management a distorted picture of customer experience.
The KPI may improve on paper while actual customer performance remains unchanged.
A mature system records the complaint accurately and then asks a second question: does our performance system create an incentive for employees to hide complaints? Sometimes the underlying problem is not an individual employee’s behaviour but the way the KPI itself has been designed.
A metric that people are encouraged to manipulate eventually stops measuring what management thinks it measures.
Case 4: Pressure on an internal auditor
An internal auditor identifies a systemic issue, but the process manager asks for the finding to be softened: “Can you call it an observation rather than a nonconformity? We’ll fix it after the audit.”
Internal audit is one of the mechanisms through which top management receives information about how effectively the QMS is operating. If an audit conclusion is changed because the person responsible for the audited area dislikes it, rather than because the evidence or audit criteria support a different conclusion, the audit loses much of its value.
This does not mean audit findings can never be challenged. Auditors can misunderstand evidence, interpret criteria incorrectly or simply make mistakes. A finding should therefore be open to evidence-based discussion. The important distinction is that the basis for changing it should be better evidence or a corrected interpretation — not the seniority or influence of the person affected.
ISO 19011 reflects the same underlying logic through principles such as integrity, fair presentation, independence and an evidence-based approach.
Case 5: Supplier selection and conflicts of interest
An organization is selecting a supplier for a critical component. One candidate performs worse in terms of quality, delivery and technical capability, but a senior manager has a personal interest in that supplier being selected.
ISO 9001 should not be turned into an anti-bribery or corporate compliance standard; other standards and management systems deal much more directly with bribery, corruption and conflicts of interest. For the QMS, the issue is narrower: is the supplier selection and evaluation process capable of ensuring that externally provided products and services meet the organization’s requirements?
If objective supplier-performance information is knowingly ignored for reasons unrelated to those requirements, the effectiveness of the purchasing and supplier-control process can be compromised.
A mature organization therefore applies its supplier criteria consistently. Where a potential conflict of interest exists, existing corporate governance or compliance mechanisms can be used to protect the objectivity of the decision. ISO 9001 does not have to prescribe the exact mechanism for the issue to matter from a quality perspective.
Case 6: A software team knows about a critical defect
A software team identifies a significant defect one day before release. The date has already been promised to a major customer and communicated internally, so schedule pressure begins to influence the discussion.
The presence of a defect is not, by itself, an ethical issue. The ethical dimension appears when information about that defect is deliberately minimised, concealed or prevented from reaching the person responsible for the release decision.
Depending on the circumstances, several responses may be reasonable:
delay the release;
issue a limited release;
introduce a temporary workaround;
communicate the issue to the customer;
accept a defined level of risk where appropriate.
The critical point is that the decision must be based on accurate information. A mature system ensures that the defect and its likely consequences are communicated clearly so that the authorised person can make an informed decision rather than one based on an artificially improved version of reality.
Leadership is where ethical behaviour becomes real
Ethical behaviour cannot be introduced simply by training employees or adding another policy. Management behaviour sends much stronger signals.
Consider a manager who repeatedly tells employees to report every quality problem but then blames people whenever a reported deviation damages the monthly KPI. The organization has effectively created two competing rules: the written rule says “report the issue”, while management behaviour says “do not bring me bad news”. Employees usually learn the second rule very quickly.
The opposite is also true. When leaders support employees who escalate legitimate quality concerns — even where the result is a delayed shipment, missed target or additional cost — they establish a very different operating environment. The practical message becomes: bad news is acceptable; hidden bad news is not.
This is why the stronger connection between leadership, quality culture and ethical behaviour in the ISO 9001 revision is important. Leadership is demonstrated not only by approving a quality policy or attending management review. It is also demonstrated through the decisions made when quality becomes inconvenient.
When KPIs compete with quality
Many problematic decisions inside a QMS are not caused by inherently dishonest people. They can be encouraged by badly designed management systems.
Consider an organization where:
production is rewarded almost entirely for output volume;
customer service is assessed mainly on the number of tickets closed;
purchasing is rewarded primarily for cost reduction;
a project team receives its bonus only if the launch date is achieved.
None of these indicators is automatically inappropriate. Problems arise when one measure becomes so dominant that the rational way to protect personal or departmental performance is to hide or minimise a quality problem.
Reporting a defect may threaten the production bonus. Recording a genuine complaint may reduce the service team’s score. Rejecting the cheapest supplier may damage purchasing savings. Escalating a software defect may delay a launch.
A useful question for management is therefore: what behaviour would a rational employee adopt if they wanted to maximise the KPI we have given them?
If the answer is “hide the problem”, the measurement system itself may be working against quality.
A good QMS must be able to handle bad news
An organization with very few complaints, nonconformities or negative audit findings is not necessarily performing exceptionally well. Another possibility is that problems are not reaching the system.
A mature organization is not one in which nothing ever goes wrong. It is one where problems are:
detected;
reported accurately;
escalated appropriately;
analysed;
acted upon.
The quality of management information is therefore central to the effectiveness of a QMS. If senior management sees almost nothing but green dashboards, it is worth asking whether performance really is exceptional or whether information is being softened, reclassified or filtered as it moves through the organization.
The ability to receive bad news is not a sign of a weak system. In many cases, it is evidence that the system is capable of detecting its own weaknesses.
Does ISO 9001:2026 require a separate Code of Ethics?
There is no reason to assume that every organization needs a new stand-alone Code of Ethics simply because ethical behaviour has become more visible in the ISO 9001 revision.
A code can certainly be useful. Larger organizations may already have corporate ethics policies, conflict-of-interest rules, whistleblowing arrangements, compliance programmes or supplier codes of conduct. Where relevant, these mechanisms can support the QMS.
The existence of a document, however, does not prove the existence of appropriate behaviour. A company can have a sophisticated ethics code and still pressure internal auditors, hide customer complaints, alter inspection records or ignore known defects. Conversely, a smaller organization may have no document called a Code of Ethics but still demonstrate appropriate behaviour through reliable records, consistent supplier criteria, clear escalation routes, objective audits and management decisions based on accurate information.
The relevant question is therefore not “Do we have an ethics document?” but “Does our management system support the behaviour needed to make reliable quality decisions?”
What evidence may be relevant during an audit?
Until the final ISO 9001:2026 text is published, it would be premature to invent a fixed “ethical behaviour audit checklist”. Even after publication, this topic should not be reduced to a search for one specific document.
Depending on the organization and the applicable requirements, relevant evidence could include:
interviews with employees and managers;
actual decisions involving nonconformities;
reliability and traceability of inspection and test records;
customer complaint handling;
treatment of negative performance information;
internal-audit independence;
supplier selection and evaluation decisions;
examples where quality conflicted with delivery or financial pressure;
employees’ ability to escalate concerns.
The important point is that conclusions should remain evidence-based. A certification auditor is not there to judge the personal morality of managers or employees. The relevant question is whether behaviour affects the conformity, effectiveness or integrity of the management system.
Self-assessment checklist
The following questions can be used as a practical starting point. They are not an ISO 9001 conformity checklist, and a difficult answer does not automatically mean that a nonconformity exists.
Can an employee report a serious defect even if doing so will cause a missed target?
Are there incentives to under-report complaints, defects or negative inspection results?
Can changes to inspection and test records be traced and explained?
Can internal auditors report uncomfortable findings without inappropriate pressure?
When quality conflicts with delivery, who makes the decision and what information is used?
Does senior management receive the real performance picture or mainly “cleaned-up” indicators?
Are supplier evaluation criteria applied consistently?
Can employees escalate a concern if their immediate manager does not want it recorded?
Can the organization identify a recent case where it preserved data integrity despite commercial consequences?
Do any KPIs make hiding a problem personally more attractive than reporting it?
If several questions are difficult to answer, the organization should look more closely at whether its management system protects the integrity of quality information and decision-making.
Key takeaway
Ethical behaviour in ISO 9001 should not be reduced to a broad statement that “companies must behave ethically”. For a QMS, the subject is much more concrete: can the data be trusted, are known nonconformities reported, does management receive accurate information, can internal auditors remain objective, and do KPIs encourage people to report problems rather than conceal them?
This is why ethical behaviour has a legitimate connection to quality management. A QMS can function effectively only when the information used to operate it is sufficiently reliable and management decisions do not undermine the organization’s own controls.
Quality culture is the broader environment — the shared habits, expectations and behaviours surrounding quality. Ethical behaviour is one aspect of that environment: how people and leaders act when they face a choice between accurate information and a more convenient outcome.
For organizations preparing for ISO 9001:2026, the best starting point may therefore not be drafting another policy. A more useful exercise is to review several real situations from the past year and ask:
What happened when the truth about quality was inconvenient?
The answer may reveal more about the effectiveness of the QMS than any policy document.
This article is part of Audit Advisor’s dedicated resource covering the revised standard and the transition to ISO 9001:2026.
FAQ
Is ethical behaviour really part of ISO 9001:2026?
The final draft makes the subject more explicit, particularly in connection with leadership and quality culture. As of 15 September 2026, however, the sixth edition is still under publication, so FDIS wording should not yet be treated as the final published requirement. ISO has scheduled publication for 16 September 2026.
Does this mean ISO 9001 is becoming a corporate ethics standard?
No. ISO 9001 remains a quality management system standard. Ethical behaviour is relevant where behaviour affects reliable information, fulfilment of requirements, process effectiveness and management decisions.
Do we need a separate Code of Ethics?
Not automatically. A code may be useful, particularly where the organization already operates broader governance or compliance systems, but a stand-alone document should not be treated as evidence that the QMS addresses the issue effectively.
Is pressure on an internal auditor relevant?
Potentially, yes. Internal audit should provide reliable feedback about the management system. Pressure to change an evidence-based conclusion for reasons unrelated to the audit evidence can undermine the usefulness and credibility of the audit process.
Why is hiding a customer complaint a QMS issue?
Because customer feedback helps the organization evaluate performance. If genuine complaints are deliberately removed or reclassified to protect a KPI, management receives distorted information and may fail to identify recurring problems.
How should an organization prepare for this topic?
Start with real management practices rather than new paperwork. Review the integrity of records, complaint handling, internal-audit independence, supplier decisions, escalation routes and actual situations where quality has conflicted with schedule, cost or performance targets.
Official and Authoritative Sources
ISO — ISO 9001, Quality management systems — Requirements. Official publication status of the sixth edition.
ISO/TC 176/SC 2 — ISO 9001 Revision Update. Confirmation that ISO/FDIS 9001 was approved and publication was scheduled for 16 September 2026.
ISO/TC 176 — Updated Summary of Emerging Themes. Official material identifying ethics and integrity as themes relevant to the development of the ISO 9000 family.
BSI — ISO 9001:2026 Key Changes and Guidance. Guidance on the FDIS identifying quality culture and ethical behaviour within the stronger leadership emphasis of the revision.
ISO — Quality Management Principles. Used for the connection with leadership and evidence-based decision-making.
ISO 9001 Auditing Practices Group — Auditing Top Management. Guidance on evaluating leadership through actual management decisions and QMS performance.
ISO 9001 Auditing Practices Group — Customer Complaints / Customer Feedback. Guidance supporting the importance of reliable customer feedback and complaint data.
ISO 19011:2026 — Guidelines for auditing management systems. Used for the principles of integrity, fair presentation, independence and evidence-based auditing.