What the clause requires
When the company decides to change the quality management system, by reorganising processes, replacing the management software, outsourcing an activity or changing the structure, clause 6.3 asks for the change to be carried out in a planned manner. Before execution, the company considers the purpose of the change and its potential consequences, the integrity of the quality management system, the availability of resources, and the allocation or reallocation of responsibilities and authorities. Those are four questions asked before the change rather than after it, and the standard does not prescribe a form: a short record of the discussion is acceptable for a small change.
The purpose is to stop a well-intentioned change from breaking controls that were working. Replacing the ERP is the classic example: if nobody planned how the inspection records and the traceability data would migrate, the company finds out during the audit that six months of evidence are gone. The same happens with a restructuring that leaves a process without an owner, or with an outsourcing decision that moves an activity outside the building and forgets to move the controls with it. None of this is exotic; it is the predictable consequence of changing one part of a system without looking at the parts attached to it.
Clause 6.3 deals with changes to the system. Changes in the operation, such as a change of material, a change to the production process or a change to a design, are handled by the operational controls, mainly in clauses 8.1 and 8.5.6. In practice many companies use the same change management form for both situations, with a simple risk assessment, a list of the documents and records affected and an action plan. That is usually enough, provided the form is filled in before the change and reviewed afterwards.
What the auditor asks to see
- A record of the relevant changes to the system, with the purpose and the consequences assessed
- A plan for the change naming the people responsible, the deadlines and the resources
- An assessment of the impact on processes, documents, records and competence
- Verification after the change that the controls are still working as intended
Where companies most often get it wrong
- Replacing a computer system with no plan for migrating the quality records
- A restructuring that leaves a process without a defined owner or a defined indicator
- Documents and forms left out of date after the change was implemented
- A change known only to the department that made it, and discovered by the others later
Example of a nonconformity
- Requirement
- ISO 9001, 6.3: changes to the quality management system shall be carried out in a planned manner, considering the integrity of the system.
- Evidence
- In 03/2026 the company replaced its management software. There is no plan for the change, and the incoming inspection records from 01 to 03/2026 remained in the old system, with no current access to them.
- Finding
- The change to the system was not planned and compromised the availability of documented information.
How to comply using PrismaBiz
Ready-made templates for this clause
Frequently asked questions
Does every change need a form?
No. The standard asks for planning that is proportionate. Simple changes can be planned in a recorded meeting; large ones deserve a risk assessment and an action plan.
What is the difference between 6.3 and 8.5.6?
Clause 6.3 covers changes to the quality management system. Clause 8.5.6 covers changes in production or service provision, such as a change of process or of material.
How do I evidence that a change was planned?
With the record of what was decided beforehand: purpose, risks assessed, people responsible, deadlines and resources, plus the verification afterwards.