Most nonconformities I see around change control don't come from organizations that have no change process. They come from organizations that have one for the changes everybody recognizes (a new machine, a new software release) and none for the quiet ones: a supplier swaps a raw material grade, a night-shift lead adjusts a setting that "works better," a customer service team starts using a new email template for order confirmations. Those quiet changes are where conformity slips, and clause 8.5.6 exists to catch them.
This guide walks through what the clause actually requires, how it connects to the other change-related clauses in ISO 9001:2015, and a working checklist you can adapt. If you want the broader picture first, the risk-based thinking implementation guide explains the logic that sits underneath all of this.
What does ISO 9001 clause 8.5.6 require?
Clause 8.5.6 (Control of changes) is short. It contains two sentences of requirement:
- The organization shall review and control changes for production or service provision, to the extent necessary to ensure continuing conformity with requirements.
- The organization shall retain documented information describing the results of the review of changes, the persons authorizing the change, and any necessary actions arising from the review.
The test running through both sentences is continuing conformity with requirements. The clause doesn't ask you to freeze your processes, and it doesn't ask for approval signatures on everything. It asks you to know what changed, to think about whether the output still meets requirements, and to keep a record showing who said yes and what follow-up was needed.
The phrase "to the extent necessary" gives you real latitude. A change to the font on an internal training slide does not need the same review as a change to a heat-treat cycle. Deciding where that line sits, and being able to explain it to an auditor, is most of the work.
What is in scope: production or service provision
Clause 8.5.6 applies to changes in "production or service provision," which means the activities covered by clause 8.5 as a whole. Think of anything that touches how you make the product or deliver the service:
- People (a new operator, a new contractor, a change in staffing levels on a line)
- Equipment, tooling, software, and facilities
- Materials and components, including changes by external providers
- Methods, work instructions, process parameters, and sequence
- Environment (temperature, cleanliness, location of work)
- Measurement and monitoring methods
Many practitioners use the shorthand "4M" or "5M" (man, machine, material, method, measurement) as a prompt list. The standard doesn't use that language, but it's a handy way to make sure your change trigger list isn't limited to equipment.
How does clause 8.5.6 fit with the other change clauses?
This is where people get tangled. ISO 9001:2015 mentions change in several places, and each one covers a different kind of change. Auditors will sometimes cite 8.5.6 when the real gap is in a neighboring clause, so it helps to know the map.
| Clause | What it covers | Key requirement | Records required |
|---|---|---|---|
| 6.3 Planning of changes | Changes to the quality management system itself | Carry out changes in a planned manner, considering purpose, potential consequences, QMS integrity, resource availability, and allocation of responsibilities | No specific documented information named |
| 8.1 Operational planning and control | Planned changes and unintended changes in operations | Control planned changes and review the consequences of unintended changes, taking action to mitigate adverse effects | Documented information to the extent needed for confidence that processes were carried out as planned |
| 8.2.4 Changes to requirements for products and services | Changes to customer or product requirements | Amend relevant documented information and make relevant persons aware | Documented information as applicable under 8.2.3 and 8.2.4 |
| 8.3.6 Design and development changes | Changes made during or after design and development | Identify, review, and control changes to the extent necessary to ensure no adverse impact on conformity | Documented information on changes, review results, authorization, and actions to prevent adverse impacts |
| 8.5.6 Control of changes | Changes in production or service provision | Review and control changes to ensure continuing conformity | Results of review, persons authorizing the change, necessary actions |
Two things stand out when you lay them side by side. First, 8.1 is the only clause that explicitly talks about unintended changes, which is the drift and surprise category. Second, the change records requirements in 8.3.6 and 8.5.6 are nearly parallel, so if you already have a design change process, you can often extend it rather than build a second one.
In my view, the cleanest approach for most small and mid-sized organizations is a single change procedure with a short classification step at the front, one that routes design changes, production or service changes, and QMS changes to the right level of review. Three separate procedures usually means three separate places for things to fall through.
What counts as a "change" under clause 8.5.6?
A practical working definition: a change is anything that alters how an output is produced or delivered, compared with the state you last validated or relied on to meet requirements.
That definition is mine, not the standard's, but it holds up well in audits because it ties back to the continuing conformity language in the clause.
Examples that usually get missed
- Supplier-originated changes. A supplier changes a coating, a sub-tier source, or a manufacturing location and tells you in a line on an invoice, or doesn't tell you at all. Clause 8.4.3 requires you to communicate your requirements to external providers, and your purchasing terms are the best place to require advance notice of changes. For more on this side, see the guidance on outsourced process control.
- Software and configuration changes. An ERP update that changes how lot numbers are generated, or a firmware update on a test station.
- Personnel changes. A key operator leaves and a replacement takes over a process that depends on tacit skill. Competence under clause 7.2 and change control under 8.5.6 meet here.
- Temporary changes. A deviation "just for this order." Temporary is still a change, and it frequently becomes permanent without anyone deciding that it should.
- Process drift. Operators gradually adjust parameters. This one is an unintended change under clause 8.1, but once you discover it, 8.5.6 logic applies to how you review and correct it.
- Service-side changes. A new script in a call center, a new subcontracted delivery partner, a revised onboarding sequence for clients.
The ISO 9001 clause 8.5.6 control of changes checklist
Here is the working checklist. I've grouped it into the stages a change goes through, and each item is something an auditor could reasonably ask to see.
1. Define the triggers
- [ ] You have a written list (or procedure section) of what types of change require review, covering people, equipment, materials, methods, software, environment, and external providers.
- [ ] The list names who can propose a change, and how (form, ticket, email to a named mailbox).
- [ ] Temporary changes, deviations, and concessions are explicitly addressed.
- [ ] There is a defined threshold: which changes need full review, and which are low-risk and can be handled by a supervisor with a simple record.
- [ ] Supplier change notification requirements are in your purchase orders, quality agreements, or supplier manual.
2. Describe the change
- [ ] The request states what is changing, from what, to what, and why.
- [ ] The request identifies which products, services, processes, or customers are affected.
- [ ] The proposed effective date or effective lot/serial/order is stated.
- [ ] The request identifies whether any customer or regulatory requirement addresses the change (some customers require formal approval before you change certain processes; check your contracts).
3. Review the effect on conformity
This is the heart of the clause. The review has to answer one question: after this change, will the output still meet requirements?
- [ ] Reviewers are the right people, meaning someone who understands the process, someone who understands the requirement, and where relevant, someone from quality.
- [ ] The review considers product or service requirements (including those from clause 8.2.3 reviews), process validation status (clause 8.5.1 f), and monitoring and measurement.
- [ ] Risks and opportunities are considered, consistent with clause 6.1.
- [ ] The review determines what verification or validation is needed before and after the change (first-article inspection, trial run, pilot, re-qualification of the process).
- [ ] The review considers effects on other processes, such as downstream steps, inspection methods, packaging, or traceability under clause 8.5.2.
- [ ] Training or competence needs are identified (clause 7.2).
- [ ] Documented information that must be updated is identified (work instructions, control plans, drawings, specifications).
4. Authorize
- [ ] A named person with the right authority approves, rejects, or conditionally approves the change.
- [ ] Authorization is recorded with a name and date (the clause requires you to retain a record of "the persons authorizing the change").
- [ ] The authorization is obtained before implementation, except for emergency changes handled under a defined emergency route with after-the-fact review.
- [ ] Where customer approval is required, it's obtained and recorded before release of affected product.
5. Implement and verify
- [ ] Actions arising from the review have owners and due dates.
- [ ] Affected documents are revised, and obsolete versions are removed from points of use (clause 7.5.3).
- [ ] Affected personnel are trained or informed, and the record shows it.
- [ ] Verification activities identified in the review are performed and recorded.
- [ ] The point of change is identifiable in product records so that traceability is preserved (for example, "units built after serial 4521 use the new fixture").
- [ ] Release of product made under the changed process follows clause 8.6.
6. Close out and learn
- [ ] The change record is closed only after the actions are complete and effectiveness is checked.
- [ ] Changes that produced problems feed into nonconformity and corrective action (clauses 8.7 and 10.2).
- [ ] Change history is a periodic input to management review (clause 9.3.2 includes process performance and conformity of products and services, and changes affecting the QMS are a standing input).
- [ ] Your internal audit program samples change records, not just the procedure.
What documented information does clause 8.5.6 require?
The standard names exactly three things to retain:
- The results of the review of changes
- The persons authorizing the change
- Any necessary actions arising from the review
That's the full list. ISO 9001:2015 does not require a specific form, a specific number of signatures, or a change control board. An auditor who tells you otherwise is adding to the standard, and you're entitled to ask which clause the expectation comes from. Customer-specific or sector standards may add requirements (aerospace and automotive customers often do), so check what your contracts flow down.
A practical minimum change record usually includes:
| Field | Why it's there |
|---|---|
| Unique change ID and date | Retrievability and sequence |
| Description of change (from/to) | Defines scope |
| Reason for change | Shows intent |
| Products, processes, or customers affected | Scope of review |
| Review summary and conclusion | Satisfies "results of the review" |
| Verification or validation required | Links to evidence of continuing conformity |
| Approver name, role, date | Satisfies "persons authorizing" |
| Actions, owners, due dates, completion | Satisfies "necessary actions arising" |
| Effective point (date, lot, serial) | Supports traceability |
| Closure and effectiveness check | Shows the loop actually closed |
For a ten-person shop, this can be a single page or a row in a shared tracker. For a larger company, it'll be a workflow in your QMS software. Either is fine as long as the three required records are there and retrievable.
A worked example
Take a contract machine shop that makes brackets for a customer. The shop wants to switch from a carbide insert supplied by Vendor A to a lower-cost equivalent from Vendor B.
Trigger and description. The tooling engineer opens a change request: new insert, same geometry, different grade and coating, effective for the next work order.
Review. Quality, the lead machinist, and the engineer meet for fifteen minutes. They look at the drawing tolerance on the bore, the surface finish requirement, and the current process capability data. They decide the finish and tool wear rate could differ. The conclusion: approve conditionally, with a trial run of 30 parts, 100% inspection of the bore and surface finish on those parts, and a tool-life check at the first shift change.
Authorization. The quality manager signs off with the condition recorded.
Implementation. The trial runs, results are recorded, tool-life data is noted, and the work instruction is updated with the new insert number and revised feed rate. The operators on all shifts are briefed, and the briefing is recorded.
Close out. The trial passes. The change is closed. The effective work order is recorded so the parts are traceable to the new tooling.
That's the whole thing. It took maybe an hour of total effort, and every element of the clause is satisfied: review results, authorizing person, and actions arising. Compare that with the same change made informally, where the purchasing agent switches vendors to save money and nobody tells the floor. Six weeks later the customer rejects a lot for surface finish, and nobody can say when the change happened.
How do auditors check clause 8.5.6?
Based on how auditors typically work, expect these lines of inquiry. This is a pattern I've seen rather than a fixed rule in the standard.
- Pick a change and trace it. They'll ask for a recent change record, then follow it to the updated documents, the training records, and the product made afterward.
- Start from the floor. They'll notice a fixture, a software version, or a supplier on the shop floor, then ask how that was introduced. If there's no change record, you have a gap.
- Ask about unplanned change. "What happens when a machine goes down and you have to run the job on a different one?" Your answer should point to a defined route, not to individual judgment.
- Check supplier notification. They'll look at how you learn about changes by external providers, referencing clause 8.4.
- Look at the three records. Review results, authorizer, actions. If any one is missing, that's a likely finding.
Change control also shows up repeatedly among the issues covered in common ISO 9001 audit nonconformities and how to avoid them, usually in combination with document control and training gaps, since a change that isn't reflected in the work instruction or in what people were taught is a change that wasn't controlled.
Common mistakes with clause 8.5.6
Treating it as an engineering-only process. Service organizations, staffing firms, and software companies have production or service provision too. Their changes just look different: a new intake process, a new subcontractor, a new template.
Over-building it. A twelve-signature form for every change guarantees people will work around it. If everything is "critical," nothing gets real attention. Scale the review to the risk.
Approvals with no review content. A signature with no review notes doesn't demonstrate that anyone considered continuing conformity. The record should show what was looked at and what was concluded.
No effective point. If you can't say which units were made before and after the change, then when a problem surfaces, your containment is a guess.
Forgetting temporary changes. Deviations and concessions that run for months without review are common. Put an expiry date on them.
Skipping the loop back to training. The procedure is changed, the people aren't told. This is one of the most frequent real-world failure points.
Ignoring supplier changes. If your contracts don't require notice, you'll only find out when something breaks.
Frequently asked implementation questions
Do I need a separate procedure for clause 8.5.6?
No. ISO 9001:2015 doesn't require documented procedures for this clause, only the three retained records. Many organizations fold change control into one procedure that covers 6.3, 8.2.4, 8.3.6, and 8.5.6 together, which tends to be easier to maintain.
Does every change need a formal change request?
No. The clause says to review and control changes "to the extent necessary to ensure continuing conformity." Define a low-risk category (for example, like-for-like replacement of a consumable with the same part number) that can be handled by a simple log entry or by no record at all, and document that threshold in your procedure so it's applied consistently.
How do emergency changes fit?
Define an emergency route in advance: who can authorize verbally, what must be recorded afterward, and how soon the full review happens. An auditor generally reacts better to a defined emergency path than to a rule that pretends emergencies don't happen.
Who should authorize changes?
Whoever holds the authority and competence to judge the effect on conformity, which depends on your organization. Clause 5.3 requires top management to assign responsibilities and authorities, so your change authorization levels should be consistent with that assignment.
A short implementation plan
If you're building or tightening this process, I would work in this order:
- List the last ten changes your organization made, including ones nobody formally recorded. This shows you where the real process is.
- Write your trigger list and your low-risk threshold.
- Build a one-page change record with the fields in the table above.
- Pick one product line or service and run changes through the new process for a month.
- Add a supplier change notification clause to your purchasing terms.
- Sample five change records in your next internal audit and trace each one to training and document updates.
- Bring a summary of changes and any resulting nonconformities to management review.
The first step is the one people skip, and it's the most revealing. In my experience, most organizations discover that their informal change handling is better than they feared in some areas and worse than they hoped in others, and that's a much more honest starting place than a clean procedure that nobody follows.
Last updated: 2026-10-27
Jared Clark, JD, MBA, PMP, CMQ-OE, CQA, CPGP, is Principal Consultant at Certify Consulting (https://certify.consulting).
Frequently Asked Questions
What does ISO 9001 clause 8.5.6 require?
Clause 8.5.6 requires an organization to review and control changes for production or service provision to the extent necessary to ensure continuing conformity with requirements. It also requires retained documented information on the results of the review, the persons authorizing the change, and any necessary actions arising from the review.
What records are required for control of changes under ISO 9001?
Three things must be retained under clause 8.5.6: the results of the review of changes, the persons authorizing the change, and any necessary actions arising from the review. The standard does not prescribe a form, a signature count, or a change control board.
What is the difference between clause 8.5.6 and clause 8.3.6?
Clause 8.3.6 covers changes made during or after design and development, while clause 8.5.6 covers changes to production or service provision. Their record requirements are similar, so many organizations use one change process for both.
Does clause 8.5.6 apply to service organizations?
Yes. Clause 8.5 covers production and service provision, so changes to scripts, subcontractors, onboarding sequences, or delivery methods are in scope if they could affect conformity of the service.
Do I need a documented procedure for control of changes?
ISO 9001:2015 does not require a documented procedure for clause 8.5.6. It requires the three retained records. A written procedure is still useful for consistency, especially for trigger criteria and authorization levels.
Jared Clark
Principal Consultant, Certify Consulting
Jared Clark is the founder of Certify Consulting, helping organizations achieve and maintain compliance with international standards and regulatory requirements.