Subchapter 3.1 · Bologna, Italy

At a dark marble reception desk, with a wall of wooden pigeonholes behind it and white orchids at the edge of the frame, Silvia Mattioli, the assistant front office manager now acting as internal auditor, sits with an open document in one hand and her pen resting on a clipboard. The sheet under the pen is still blank. Beside her an older colleague, whom the case does not name, holds up a lined page and points to one of its lines while she explains. Mattioli listens with a slight frown: the evidence is in front of her, and she has nowhere to write it.

The Hotel Mascarella, a hundred and four rooms near the exhibition pavilions of Bologna, was audited in the February fair week, under load. Of the forty rooms on the largest group contract, eleven guests had received a room type other than the one contracted; only two complained. The records were accurate and the allocation had followed the procedure exactly. Yet when Mattioli came to fill in the column for the requirement, she found nothing inside the system. The procedures described activities, not results, and the promise lived only in the contract in the file. An audit is a comparison between what is required and what is happening; without the first term, inventing a criterion, auditing the procedure alone or declaring conformity are all wrong exits.

The plaques at the top record the fact: “Eleven of forty rooms wrong” and “Promise only in the contract”. Those at the bottom draw the lesson: “Criteria before the audit” and “Missing criteria go upward”. In practice every audit plan opens with three lines, written in advance: what the audit is for, what it will be judged against, where it stops. Contracts and public claims are the least contestable ground an internal auditor can stand on. Where a process has no criteria, the absence is not the desk’s failure: it belongs to whoever determines the processes and their criteria, and the person who assigns the audit should state in advance, in writing, that reporting it upward is an expected outcome. Once eleven criteria existed, her April audit found the structural cause: sales contracted by total room count, not by category.

The requirement is precise. ISO 9001:2026, clause 9.2.2, asks the organisation to define objectives, criteria and scope for each audit, not once for the programme. Clause 9.2.1 expects internal audits to inform on conformity both to the organisation’s own requirements and to the standard. Criteria can therefore include applicable ISO 9001 requirements and the property’s own; a contract becomes a criterion where it forms part of the requirements accepted for the audited process, while applicable statutory and regulatory requirements bind regardless. ISO 19011:2026 offers guidance on establishing and using criteria. The auditor does not manufacture a missing requirement; the absence is examined against the requirement to determine process criteria. Collecting one sentence per process, and the upward route, are this book’s method, not the standard’s wording.

Subchapter 3.2 · Osaka, Japan

In a plain meeting room with beige walls, two people sit at a pale wooden table set with green tea cups on dark saucers. On the left the general manager of the Hotel Nakanoshima, grey-haired, in glasses and a dark suit, holds up a single ruled summary page and opens his other hand towards his visitor, as if asking a question he cannot answer himself. On the right Kaori Nishimura, the front office manager from a sister property in Kobe who audits across the group, listens with a troubled look, her hands resting on a thick bound manual lying open in front of her. It is the closing meeting.

The general manager had been polite for two days. Looking at the forty-four findings on the page, he told her that every one of them was true and that he did not know what to do first. Nishimura had conducted eleven audits in two and a half years; she could name only two changes they had ever caused. Her method was faithful to the programme: the grid said housekeeping in the second quarter, so she opened the housekeeping section of a standards manual of over six hundred items and checked twenty-two rooms against it. The result was an inventory, accurate and unrankable, confined to what the manual already covered, while the failures that matter live at its edges.

The plaques at the top record the fact: “Forty-four true findings” and “Six hundred standards”. Those at the bottom draw the lesson: “Ask what it is for first” and “Scope follows the objective”. In practice the auditor’s first act on receiving an assignment is not to prepare but to ask whoever commissioned it what they need to know that they do not know now; it takes about four minutes. The answer usually reaches beyond a department. At the next property, a capability question about a forty-room long-stay contract drew the scope across linen, laundry, roster and the draft specification, and four findings changed two contract terms before signature. Her reports now carry three to eight findings, and observations outside the scope are still reported, with their origin stated.

ISO 9001:2026 requires objectives, criteria and scope to be defined for each internal audit, while the audit programme itself sets frequency, methods, responsibilities, planning requirements and reporting; the programme and the single audit are different levels of planning, and a grid of departments supplies neither the objective nor the scope. ISO 19011:2026, as guidance, treats the objective as the reason for the audit, the criteria as the reference against which evidence is compared, and the scope as its boundaries and extent, which may cross departments, shifts and locations. The division of objectives into conformity, effectiveness and capability is this book’s practical model, not ISO terminology, and neither the standard nor the guidance treats a high count of findings as a measure of rigour.

Subchapter 3.3 · Bogotá, Colombia

In a warm, lamp-lit office, with ring binders on a wooden shelf and potted plants by the wall, Diana Ospina, the quality coordinator of the Hotel Chapinero Alto, stands beside a long timber table. With the tip of her pen she touches the top of the tallest of three stacks of folders, which grow smaller from left to right. Seated next to her, the general manager leans forward on his elbows with his hands clasped beneath his chin and studies the piles without speaking. The gesture is an argument about proportion.

For six years Ospina had run twenty-two audits a year, each half a day, and never missed one. Then she added up the hours: eighty-eight, eleven working days, for a two hundred and forty room property in Bogotá whose management system covers thirty-five processes. That is two and a half hours per process per year, enough for a visit and not for an audit. Listing the processes beside the date each had last been genuinely examined, she could name a date for thirteen; for twenty-two she could not, because they had been covered every year inside a shared half-day under a departmental heading. Even coverage had given the parking arrangement the same attention as the arrival chain handling thirty thousand guests a year, and the programme’s completeness hid its lack of depth.

The plaques at the top record the fact: “Two and a half hours each” and “22 of 35 never examined”. Those at the bottom draw the lesson: “Fewer audits, longer” and “Record what waits, and why”. In practice the property kept the same eighty-eight hours and rebuilt them as seven audits of a day and a half, each carrying its reason: importance, previous results, or change. Nineteen processes were placed at lower frequency for the cycle with written reasons, three of them initialled by the general manager; the remaining nine were reached through narrower audit activities. Five of the seven audits produced findings that changed something, and the long-stay audit found a two-year gap between a signed specification and the operation, corrected by amendment in the property’s favour.

ISO 9001:2026 requires the organisation to plan, establish, implement and maintain an audit programme covering frequency, methods, responsibilities, planning requirements and reporting, and, in establishing it, to consider the importance of the processes concerned, previous audit results and changes affecting the organisation. Annex A clarifies that all QMS processes need to be audited, with frequency set on the organisation’s assessment of risks and of each process’s status and contribution; nothing requires every process, department or clause to be audited every calendar year, yet no QMS process may be left out indefinitely. ISO 19011:2026 offers guidance on managing the programme. Recording the rationale for lower frequency or depth is this book’s control method, not an ISO requirement, and it must never become a way of removing a process from the audit universe.

Subchapter 3.4 · Stavanger, Norway

In a bare grey room beside a black server rack, its cables and status lights visible through the mesh door, Eirik Sandvik, the systems manager of the Hotel Breiavatnet, sits at a white table with his hands on the keyboard of a laptop. He has turned his head to look up at an older man in a tweed jacket, reading glasses pushed up on his forehead and a white mug in one hand, who leans over the screen and points at it with his other hand. The visitor is the peer from another hotel in the city, unnamed in the case. Sandvik looks like a man hearing a question he has never been asked.

Sandvik administers every system in the chain from booking to room assignment and key issue, and he configured most of it. When the general manager, Ingrid Bårdsen, asked him to audit that chain, he pointed out that he would be auditing his own work; she agreed, and asked who else could do it. In a hundred and twenty-eight room hotel with nine managers, nobody could. He accepted on condition that the report state what he was. His two days produced four real findings. The fifth came in May from the visiting peer, who asked in about twenty minutes why the hotel assigns rooms overnight at all. It had never been a question, because a process owner can audit his execution but not his own assumptions.

The plaques at the top record the fact: “Nine managers, one expert” and “Fifth finding from a peer”. Those at the bottom draw the lesson: “Declare the dependency” and “A stranger for assumptions”. In practice the single-owner processes are audited anyway, not left out. Somebody other than the auditor sets the objective and scope; Bårdsen did it in writing in ten minutes. Four lines at the top of the report state who audited, their relationship to the process, who set the objective, and what could not be objectively assessed. And twice a year a peer from a comparable hotel across town comes for half a day to ask why things work as they do. The hotel now assigns at arrival, except for contracted groups, and the overwriting can no longer occur.

ISO 9001:2026 requires auditors to be selected and audits conducted so as to ensure the objectivity and impartiality of the audit process; it does not demand that every internal auditor be organisationally independent of the activity audited. ISO 19011:2026, which is guidance, keeps independence as a principle to be achieved wherever practicable and, where it is not, directs the organisation to manage bias so that conclusions remain objective. Auditing decisions for which one is responsible remains a real impartiality risk that must be addressed. The distinction between execution and assumptions, the four-line declaration and the peer exchange are this book’s method; outsourcing is one option, and the consultant who built the system carries an obvious self-review risk.

Subchapter 3.5 · Gdańsk, Poland

Under the timber beams and bare brick of a converted warehouse, round tables already dressed in white linen fill a function room, with plates stacked on some of them and chairs piled against the far wall. Marta Zielińska, the human resources manager trained as an internal auditor, walks through it in a navy suit, clipboard in one hand and pen in the other, her eyes on the banqueting supervisor. He strides beside her in a black waistcoat and tie, pointing ahead across the room. Behind them two members of staff in white shirts follow, each carrying a stack of folded white linen.

At the Hotel Motława, on Granary Island, Zielińska audited a Saturday changeover from a morning conference to a wedding for a hundred and forty. It finished ahead of time; she wrote three small findings in four hours. Two weeks later the same pattern failed: the conference overran by thirty-five minutes, the room was handed over at ten past five for a ceremony at five, and the bride’s family stood in the corridor for eleven minutes before a hundred and sixty guests. The supervisor then told her the earlier day had been tight too; at three he had gone to find two extra people. She had watched him do it and recorded nothing. Without an expectation an event cannot register, and in a hotel that expectation is tacit knowledge which method training does not supply.

The plaques at the top record the fact: “Three findings in four hours” and “Eleven minutes in a corridor”. Those at the bottom draw the lesson: “Ask what makes them uneasy” and “Borrow where to look”. In practice, before the audit, the auditor asks two people who do the work, and one person downstream, what in the process would make them uneasy, and writes the answers down. In September this took eleven minutes and produced six expectations; two proved structural: a vacate time agreed only by telephone and chairs moved to a store a lift journey away. The schedule was rebuilt at eighty minutes, not seventy. She borrows where to look, never what to conclude, and a three-line competence note records what cannot be audited in house, including the kitchen.

ISO 9001:2026 requires the organisation to determine the competence needed for people whose work affects the quality management system, to ensure it on an appropriate basis, to act where necessary and to retain evidence; applied to internal audit, competence depends on the assignment, and knowledge of audit method alone does not establish it for every subject. ISO 19011:2026 offers guidance on evaluating auditor competence across audit knowledge and the discipline, sector and context concerned. No lead-auditor certificate is required, and none proves competence for every audit; a technical expert may support an auditor who remains responsible for the conclusions. Borrowing an expectation is this book’s own proposal: it prepares the questions and does not by itself make the auditor competent for the assignment.

Subchapter 3.6 · Boston, United States

At the far end of a long marble reception counter, lit warmly from beneath, Devon Marsh, a twenty-four-year-old trainee acting as internal auditor, stands a little apart and writes on a folded sheet with a pencil. Nearer the orchids, a guest in a navy jumper has come back to the desk and holds up a white key card as he speaks; the agent facing him looks up and listens. Between them a second agent, in suit and tie, feeds a card into the key encoder. She is watching a service that cannot be paused or repeated, and counting rather than judging.

The Fort Point, three hundred and ten rooms in the Seaport district, puts a hundred and eighty arrivals through that desk on a convention Monday. Within nineteen minutes of her first attempt the desk was performing for her; she returned at twenty past four and counted forty-one complete arrivals. Nine guests returned to the desk after the key had been issued: six room changes, two key failures, one billing question. The next morning the property management system, examined for the same reservations, showed two room changes. A change made within the shift simply overwrote the assignment, and key re-encodings lived in the door system, which nobody had ever set beside it. For two years the arrival score, the allocation accuracy figure and the desk’s staffing had rested on a record that could not see most of the friction.

The plaques at the top record the fact: “Nine of 41 guests returned” and “The system showed two”. Those at the bottom draw the lesson: “Count, do not characterise” and “Compare against the record”. A number can be contested only by another number. The count becomes evidence only when the same population is reconstructed afterwards from the folio, the key log and the allocation history. Agreement corroborates; a record without an observation is a question; an observation the record does not contain reveals a class of event the property’s own system is blind to. Marsh’s finding therefore described the configuration, twenty-two per cent against five, and named no agent. A stopping rule agreed in advance told her when to leave.

ISO 9001:2026, at clause 9.2, requires internal audits to provide information on whether the quality management system conforms and is effectively implemented, and only evidence sufficient for that conclusion can do so. ISO 19011:2026, which is guidance and not a requirement, recognises review of documented information, interviews and the observation of activities and conditions as ways of collecting audit information; evidence is not confined to records, and an observation made without interfering with the service can be corroborated through records, system data and interviews. “Observe live, verify cold” is the book’s own technique, not a method the standard prescribes. A mystery guest exercise is not an internal audit unless it is planned and conducted as one against defined criteria.

Subchapter 3.7 · Helsinki, Finland

In a basement store lined with metal shelving, white jerrycans of concentrate and stacks of coloured cloths, a stores keeper in a navy tunic holds open a ring binder of issue records across a steel table. Joonas Lehtinen, duty manager and one of the property’s two internal auditors, reaches for the binder with one hand and holds a clipboard against his chest with the other. On the table between them lie a calculator and a pen. The scene is the moment the audit changed direction: the clipboard carries what the property says about its work, the binder what the work actually used.

The Hotel Töölönlahti has two hundred and twelve rooms in central Helsinki and two saunas that nobody staffs. Cleaning happens at quarter past ten, by one person, after the last guest has gone. Lehtinen spent three days on the laminated check sheet, eleven months of signatures with no gaps, and on four honest interviews that described the routine in the same terms. On the fourth day he calculated what the routine, performed as written, must consume, and asked the stores. Under a third of that quantity had been issued. The cause was not dishonesty: one of the sheet’s three lines asked for a mid-period check by a pool attendant whose shift had been abolished in 2021. A door log later showed six signed evenings that nothing explains.

The plaques at the top record the fact: “Eleven months, no gaps” and “Under a third issued”. Those at the bottom draw the lesson: “Begin at the stores” and “Test the form before blame”. Consumption is generated by the work rather than about it, recorded for reordering, and hard to shape for an audit, so an auditor of an unobserved process works down the list of residues: consumption, third-party traces, system logs, physical state, self-made records, recollection. Consumption proves quantity, never quality, and detects impossibility rather than conformity; a gap is a question before it is a finding. When a discrepancy appears, the first explanation to test is the design of the form, which here was requiring an honest person to sign for work that no longer existed.

ISO 9001:2026 requires appropriate documented information where the standard or the organisation’s system calls for it, but a completed record does not by itself prove that the activity occurred as intended. Clause 8.5.1 adds validation and periodic revalidation where outputs cannot be verified by subsequent monitoring or measurement, which is why the property’s second finding, that the sauna routine had never been validated, went to the top of the property rather than to the department. ISO 19011:2026, as guidance, treats audit evidence as information that can be verified and directs the auditor to weigh the reliability and consistency of sources, so stock movements and logs created for another purpose can be legitimate evidence. The ordering of residues is the book’s heuristic, not a ranking the standard contains.

Subchapter 3.8 · Mendoza, Argentina

In a quiet office with dark wooden furniture and a brass lamp, Valentina Ríos, restaurant and events manager and one of the Finca Alameda’s two internal auditors, leans over the desk in a burgundy jacket and points to a ruled sheet laid flat before the owner. He sits with his hands folded, studying the column she indicates, his face serious. A laptop stands open at the edge of the desk, and nothing else is in use. The gesture is the whole of the case: she is not presenting a finding but showing him the sample itself, line by line, and letting the table speak.

The Finca Alameda is a ninety-six room hotel among the vines of Luján de Cuyo, and its year has five populations: contracted tour groups, independent international guests, domestic weekenders, midweek business and a long-stay block. Ríos had audited arrival and stay with thirty stays drawn in September; twenty-nine conformed. Seven months later a tour operator complained about a group of twenty-two. Her sample, she found, held twenty-six domestic weekend stays and no tour group, every arrival fell between two and seven in the afternoon, and every case had been handled by one of the two permanent receptionists. The eleven seasonal receptionists who work the harvest weeks had never appeared in any sample. The tour segment carried about fifteen per cent of room-nights and some seventy per cent of the property’s signed obligations.

The plaques at the top record the fact: “No tour group in thirty” and “Eleven seasonal staff unseen”. Those at the bottom draw the lesson: “Sample by obligation” and “A floor in every stratum”. Convenience selects in one direction on segment, season and shift at once, towards the quiet month, the afternoon and the most experienced staff. The March re-audit kept thirty cases but set a floor of twelve tour group stays and twelve early arrivals, and found that the seasonal induction never mentioned operator specifications and that a truncated reservation field hid room configurations. In practice the objective picks two dimensions, and four lines written before extraction name the population, its variation, the coverage with its floor, and what the sample will not support, said plainly.

ISO 9001:2026 sets no universal sample size or percentage for internal audit; under clause 9.2 the organisation must obtain enough appropriate evidence to support its conclusions within the declared scope. ISO 19011:2026, which is guidance and not a requirement, recognises both judgement-based and statistical sampling and treats sampling risk as something to be understood and managed: a defensible sample begins with the population and the objective, then considers variation such as season, shift and customer segment. Random selection alone does not ensure that relevant strata appear, and a clean sample supports a conclusion only within its own limits, which the report should make clear. Sampling in proportion to obligation rather than to volume, with stated floors, is the author’s method, offered as such and not as an ISO requirement.

Subchapter 3.9 · Calgary, Canada

In a back office of grey shelving, box files and plain desks, Nadia Chaudhry, accounts receivable supervisor and newly trained internal auditor, sits on the telephone with a corded handset at her ear, an open binder before her. Beside her desk a tray overflows with unsorted paper. A colleague in a dark jacket leans in from behind her chair, clipboard in hand, following the call closely. There is no guest anywhere in the room, and that absence is the subject: this is the part of the hotel that no audit programme had ever entered.

The Bow Crescent has two hundred and eighty rooms in downtown Calgary and lives on corporate and convention business. Reading six years of audit schedules, Chaudhry found fourteen departments audited repeatedly and six functions never touched: accounts receivable, the night audit, the shared reservations inbox, sales administration, accounts payable and procurement. Nobody had excluded them; the programme had been copied in 2018 from a brand template built around guest-facing departments. When accounts receivable was finally audited, by a rooms auditor using twenty-three criteria extracted from corporate agreements, the shared mailbox held four hundred and twelve items older than thirty days, sixty-one of them disputes, and seventy-one per cent of credit notes were coded “other”. The largest client had corrected the hotel’s invoices by hand for two years, then begun rejecting them; one telephone call explained everything in eleven minutes.

The plaques at the top record the fact: “Six functions never audited” and “412 items over thirty days”. Those at the bottom draw the lesson: “Begin at the queue” and “Criteria in signed contracts”. Audit attention follows failure speed: operational failures announce themselves within a shift, while back-office failures surface weeks later, outside the building, to somebody who can move the account. In a back-office function the queue is the evidence, a physical record of work not done that cannot be tidied without doing the work. The criteria are often already written in agreements the property signed, covering format, timing, disputes and contacts. Auditors swap across the operational boundary and the opening meeting states that a quality audit is not an investigation of anyone’s honesty.

ISO 9001:2026 applies internal audit to the quality management system as a whole: clause 9.2 requires information on its conformity and effective implementation, and the system’s scope follows from the organisation’s context, requirements, products, services and processes. Billing, credit control, shared mailboxes and post-delivery activities can therefore fall within the audit universe when they affect requirements or service conformity, and contract terms the organisation has accepted can serve as audit criteria. A financial audit has different objectives and does not automatically replace a quality-system audit of controls performed by finance. A brand template may contribute criteria but is not, by itself, the organisation’s audit programme, and the auditor needs competence suited to the assignment rather than the same professional background. The two-column list, the swap and starting at the queue are the book’s practical method.

Subchapter 3.10 · Bilbao, Spain

At a wood-panelled concierge desk under brass lamps, Itziar Larrañaga, head concierge for twenty-two years and the Hotel Abando’s internal auditor, smiles as she hands a pen across the counter to a young waiter in a black waistcoat and apron. He still holds a glass water jug in his other hand, as if he has come straight from service. Her other hand rests on a blank sheet lying on the counter between them. The problem he has brought her is not going to be solved quietly at the desk, but written down, by him, with her help.

The Abando has a hundred and forty-eight rooms near the station in Bilbao, and Larrañaga was asked to work out how to audit quality culture and ethical behaviour before the certifier did. She drafted eleven interview questions, recognised that she had written a survey, and went to the records instead. In eighteen months the property had raised three internal nonconformities against forty-seven guest complaints of substance; all three came from managers, two from one department. Forty-one per cent of complaints sat under a generic category, and the feedback request, sent by hand at the end of a shift, went out mostly on shifts that had gone well. Then she declared her own position: at least nine problems brought to her in that period had been handled informally and recorded nowhere.

The plaques at the top record the fact: “Three found, 47 received” and “Nine fixes, none recorded”. Those at the bottom draw the lesson: “Divide found by received” and “Judge conditions, not people”. Values and attitudes cannot be verified as convictions; practices and actions leave traces in records the property already holds: the ratio of found to received, who reports, what happened to early reports, near misses, the integrity of the evidence chain, and the outward account against the inward one. Interviews start from a named occasion. The finding describes the organisation’s visibility of its own failures, never anybody’s courage. With a category for problems fixed internally and the rule that whoever brings a problem writes it down, the following year recorded a hundred and thirty-one, ninety-four of them unknown to any guest.

ISO 9001:2026 strengthens leadership and awareness around quality culture and ethical behaviour, and internal audit under clause 9.2 examines whether such requirements are implemented. The requirement does not mandate a particular survey, culture programme, code of conduct or the application of ISO 10010, which is guidance. An auditor therefore looks for objective evidence that leadership promotes the required culture and that relevant people know what the system requires of them; surveys, incident records, escalation behaviour, decisions and interviews can all contribute, but no single artefact proves conformity. A supported finding can be raised on culture where evidence shows a requirement unmet, yet the audit is no licence to diagnose personalities. The six traces and the boundary sentence written into the audit plan are the book’s own method, offered as practice rather than as requirement.

Subchapter 3.11 · Siem Reap, Cambodia

In the lobby of the Hotel Wat Bo, under low lamps and dark wood panelling, Sopheak, the front office manager acting as one of the property’s three internal auditors, stands behind the stone counter and hands a white envelope across it. The man who takes it, a guest in a linen jacket with a bag on his shoulder, smiles and accepts it without a glance at the name. Behind the desk the night receptionist watches with her hands resting on the counter, calm, because she knew what was coming. On a table behind them stand the hot-water urns, paper cups and rows of packed breakfast boxes for the sunrise departure.

At ten past four in the morning Sopheak handed an envelope marked for a Mrs Lindqvist to a man from Lyon, and nothing stopped it. The envelope held a non-transferable temple pass bearing her photograph, which would have been refused at the Angkor checkpoint forty minutes later, with no way back before sunrise. The property had identified the error and answered it with a line in the night induction, a seasonal briefing and a laminated card saying, in three languages, check the name. None of these created a moment at which a name was matched to a face. Asked afterwards, the excursions coordinator recalled two earlier occasions in three years, both rescued by a driver who knew the guests, neither recorded.

The plaques at the top record the fact: “Wrong envelope, unchallenged” and “Two past errors, unrecorded”. Those at the bottom draw the lesson: “Attempt the error, agreed” and “Audit at the hour of error”. The book proposes the mirror of re-performance: the auditor performs the incorrect action, openly, agreed in advance at supervisor level, never where it could reach a guest or carry a safety, hygiene, security or legal consequence, on a test case where one exists, and stops it if nothing else does. Where the attempt is not permissible, the department is asked to name the moment of detection. The audit happens when the error is likely, here at a quarter past four, because an office-hours walkthrough examines the conditions under which it does not occur.

ISO 9001:2026 keeps, within controlled production and service provision, the requirement for actions to prevent human error as applicable. It prescribes no separate programme and does not reduce the requirement to training or awareness: controls may be designed into the process, sequence, interface, verification or work environment, and the organisation need not catalogue every conceivable mistake, only apply controls appropriate to the process and its risks. Training records evidence training, not prevention. Testing a control is legitimate where it is safe, authorised and does not turn into consultancy. The three families of action, the error inventory and the attempted error are the book’s method, not the standard’s wording. The property’s remedy, a manifest read aloud and signed, took eleven days and cost nothing.

Subchapter 3.12 · Sofia, Bulgaria

In a small office at the Lozenets, with a desk lamp lit, a plant by the wall and a grey filing cabinet behind, Ralitsa Dimitrova, deputy general manager and head of the property’s audit programme, leans over the desk and presses her finger on one cell of a large ruled grid. Seated beside her, a colleague in a pale blue shirt and tie, whom the photo does not identify, turns his open palm towards the sheet with a half-smile, mid-explanation. A coffee cup and a closed black binder frame the page.

Dimitrova was handed an opportunity register of fourteen entries, all plausible, all dated the same afternoon, none with a source, a target or a way of judging effectiveness. She had views on several and set them aside: whether an opportunity is a good one is commercial judgement, not an audit matter. She then audited backwards, from management review minutes, capital approvals and the marketing calendar, and found seven actions in two years; only two had a stated purpose before they began, and only one had been evaluated. Eleven rooms rebuilt for a stated reason had never been reported separately. Then, looking for a favourable variance herself, she found one in forty minutes: Sunday occupancy well above the competitive set for two years, the product of an unwritten arrangement by one reservations supervisor.

The plaques at the top record the fact: “Fourteen entries, no target” and “Two years of better Sundays”. Those at the bottom draw the lesson: “Audit discipline, not merit” and “Investigate the good numbers”. In practice the auditor asks five questions of each entry: its source, whether it was analysed and evaluated, its target, the evaluation method fixed in advance, and the evaluation actually done. An initiative evaluated and found not to work is the clause working, never a nonconformity. Dimitrova reported the missing variance process as an observation, not a finding, because no requirement prescribes that check.

ISO 9001:2026 separates opportunities from risks more clearly than before. The organisation determines the opportunities that need to be addressed, plans actions, integrates them into its processes and evaluates the effectiveness of those actions; that evaluation is required, not recommended. No register, scoring matrix or prioritisation method is prescribed, the property need not pursue every opportunity, and commercial growth by itself is not evidence of conformity. A finding needs a requirement and evidence of a gap, never the auditor’s dislike of an idea, and clause 6 opportunities are distinct from clause 10 improvement. The five questions, the backward audit and the favourable-variance question are the book’s method. Dimitrova’s single finding rested on the requirement to plan how effectiveness will be evaluated, and said nothing about any of the fourteen ideas.

Subchapter 3.13 · Durban, South Africa

At a round wooden table in a quiet meeting room of the Point Waterfront, glasses of water and loose papers between them, the closing meeting is under way. Thandeka Mkhize, learning and development manager and internal auditor, in a mustard jacket, holds a sheet up to read it again, a hand at her chin. Across from her an older man in a dark cardigan, the shop steward present for the bargaining unit member whose work the finding touches, leans in and speaks, both hands flat on two pages. Between them two managers in dark suits listen, one with clasped hands, the other with a fist under her chin.

A contracted group of eighteen delegates from a provincial department arrived on a Tuesday; six were accommodated in a lower category on floors three and four instead of seven to eleven. Mkhize’s draft was accurate, evidenced, correctly graded and written in three parts, and its third sentence placed the allocation at the Monday night audit, where there is one night auditor. The steward asked whether she had seen two messages sent that Monday evening. At 21:40 and 22:15 the night auditor had reported the shortfall and asked what to do; at 23:02 he was told, in five words, to allocate what was available. The draft had described the last link in a chain of four.

The plaques at the top record the fact: “Six of eighteen rooms wrong” and “Two escalations before 23:02”. Those at the bottom draw the lesson: “The process is the subject” and “Walk the chain backwards”. In practice the condition is the finding and the instance is the evidence; failures are located by moment, not by role; and before drafting, the auditor asks what reached the person and whether they raised anything. A finding is withdrawn only for a wrong fact, a wrong criterion or an unsupported extent. Mkhize neither defended nor withdrew: she took two days and reissued a finding naming nobody, stating that the process lets a conflict be raised and requires nobody to resolve it or tell the customer.

ISO 9001:2026 requires audit results to be reported to relevant managers. ISO 19011:2026 is guidance, not a requirement: it advises formulating findings from criteria and evidence and reviewing them with the auditee so that evidence is accurate and findings understood, with unresolved differences recorded rather than bargained away. Auditee agreement is therefore not a precondition, and a single instance can support a finding where it demonstrates a failure to meet a requirement. The auditor does not prescribe the corrective action; management does. Identity is omitted where unnecessary, though not as an absolute rule. Stating the condition, locating by moment, the backward walk and the nine-second sentence naming the identification problem at the closing meeting are the book’s own disciplines.

Subchapter 3.14 · Cork, Ireland

In a green-walled office at the Lapp’s Quay, with shelves of folded linen behind and a desk lamp lit, Aoife Barry, executive housekeeper and internal auditor, stands at a long wooden desk. One hand rests on a stack of forms; the other lies flat beside a row of nine single sheets laid out edge to edge along the desk. Seated beside her in a grey jacket, a senior colleague the photo does not identify looks down at the row with his arms folded, unconvinced. A black tray and an open folder sit at the edges of the desk.

Barry audited the audit programme itself. Over eighteen months the corrective action log held twenty-four actions, all closed and signed, twenty-one inside thirty days. Twenty-three findings had been graded minor; the single major concerned the one occasion a guest complained, and a property that recovers well and grades by outcome ends up measuring its own luck. Nine actions concerned processes that only run between May and September, and all nine were closed between November and February with a signature and the words no recurrence. Re-opened and verified the following summer, two of those nine proved ineffective; five linked minors turned out to be one condition, late rooming lists, met with three reminders and two documents.

The plaques at the top record the fact: “21 of 24 closed in 30 days” and “Nine closed out of season”. Those at the bottom draw the lesson: “Grade control, not outcome” and “Verify to the condition”. In practice the grade asks what would have had to be true for the failure not to happen. The log separates implemented, a fact about the property, from verified, a fact about the world; the criterion of effectiveness is written when the action is agreed; verification waits for the next cruise turnaround, the next night, the next peak; and a link field connects actions addressing the same condition.

ISO 9001:2026 requires correction and corrective action without undue delay and, under clause 10.2, evaluation of the effectiveness of corrective action taken. It imposes no thirty-day limit, does not require internal nonconformities to be graded major or minor, and prescribes no observation category; ISO 19011:2026, as guidance, permits grading criteria that the organisation defines and communicates, and the duty to evaluate causes attaches to the nonconformity, not its grade. Implementation is not demonstrated effectiveness. A certification body grades its own findings under ISO/IEC 17021-1 and sets its own deadlines; scheduling verification to the condition is the book’s discipline for the internal log and moves no external deadline, so for a seasonal process what can be verified later is agreed with the certification body, not assumed.

Subchapter 3.15 · Kochi, India

In the records room of the Marine Drive, among metal shelves of box files and archive cartons, Susan Varghese, quality manager for eleven years and four months from leaving, hands a thin document across a wooden table to a younger man in a white shirt, her successor, who takes it in both hands and looks at her rather than at the pages. Her other hand rests on a large sheet ruled into two columns. Beside it lie open ring binders, the archive of the programme she has run.

The Marine Drive has a hundred and fifty-two rooms on the waterfront at Ernakulam, a monsoon that closes its outdoor areas for three months, and staff who leave for better wages abroad. Varghese began a manual, stopped at fourteen pages, and read the programme instead: two hundred and thirty-one audits across eighteen headings. Against nine changes in eleven years, among them a system migration, outsourced housekeeping, a new wing, a change of ownership and the end of a brand affiliation, the programme moved once, in 2019, adding a line for the contractor. Housekeeping was then audited four times against a 2016 procedure describing a department the hotel no longer employed, and every audit was clean. After 2022 the audits cited only her own checklist.

The plaques at the top record the fact: “Nine changes, one response” and “231 audits, eleven years”. Those at the bottom draw the lesson: “Did the criteria follow?” and “Read before handing over”. In practice the property lays its own history of change beside the programme, year by year, and asks of each change whether an audit moved and whether the criteria followed; the second question yields the worse finding, a clean audit against obsolete criteria. The reading is done by the newest competent person or by the one about to leave, because what transfers is not what they know but what they decided. Her eleven pages replaced the manual, and her successor inherited twelve headings, four of them new.

ISO 9001:2026 requires documented information to be retained as evidence of the audit programme and its results, and the programme to be established considering process importance, previous audit results and changes affecting the organisation. It prescribes neither a three-year retention period nor an annual review date, and a programme completed exactly as scheduled can still be ineffective or nonconforming. ISO 19011:2026, as guidance, advises monitoring, reviewing and improving the programme using results, trends, records and lessons learned. Changes matter to management review and also, separately, to the audit programme. The change reading on two columns is the book’s method, recommended at least once per certification cycle and whenever the person who has run the programme leaves; it does not replace shorter rolling reviews.

Subchapter 4.1 · Bath, United Kingdom

In a panelled room with tall windows behind sheer curtains, at a polished round mahogany table, the certification auditor sits with a tablet held up in one hand and her other hand resting on an open ring binder. Across from her Rowan Fitzgerald, general manager and part owner of the Pulteney Rooms, leans forward with both hands open, smiling as he explains. A cup of coffee stands at her elbow; a lamp and white flowers glow behind her. She listens. He is answering the question she has just asked: who decided what a guest on the Georgian Christmas programme receives, and against what.

The Pulteney Rooms, sixty-four rooms in three joined Georgian houses in Bath, had held a quality certificate since 2016. Beneath its one-line scope sat a sentence declaring clause 8.3 not applicable because the organisation does not undertake design and development activities. Six surveillance audits and two recertifications had passed over it. The auditor spent her first forty minutes reading the property’s website, and that reading was the audit: the Christmas programme had been built over eight months, costed, trialled on two paying weekends and revised. Three more services had followed. Her minor nonconformity concerned not design but the justification, unreviewed since 2016. The programme’s first-year failure, a dinner designed for forty that sold sixty-two, had been absorbed and forgotten because nobody had written what it was for.

The plaques at the top record the fact: “8.3 excluded since 2016” and “Four services since then”. Those at the bottom draw the lesson: “An exclusion is live” and “Justify the property itself”. In practice an exclusion accepted at an earlier audit settles nothing; the property changes more often than the sentence does, and the duty to review the determination sits with the property. A justification that says hotels do not design describes an industry and verifies nothing; one that describes what this property does can be checked against its brochure, its packages and its proposals. The fastest self-test is a four-minute list of everything created this cycle that guests now buy, and declaring a failed exclusion before the audit shows that the review of changes works.

The requirement sits in ISO 9001:2026: the scope must define its boundaries and applicability, identify the types of products and services covered and be available as documented information. A requirement may be determined not applicable only where this does not affect the ability or responsibility to ensure conforming products and services and to enhance customer satisfaction, and the justification must be supportable from the organisation’s actual activities; a hotel is not exempt from clause 8.3 by sector. On the certification side, ISO/IEC 17021-1 governs how the certification body defines and records the certification scope: the organisation defines its scope, the body verifies it and does not invent it. The certificate attests a system within a scope at a date, not every service. The two readings, the four-minute list and the two-page sheet that replaced the exclusion are this book’s method, not requirements.

Subchapter 4.2 · Guadalajara, Mexico

In an office warmed by a table lamp, with box files ranged on a cabinet behind, Mariana Cisneros, quality manager of the Hotel Minerva Real, leans over the desk and presses one finger to the third of three ruled sheets laid side by side. Seated beside her, the finance director, whom the case does not name, rests his chin on one hand and holds another sheet in the other, looking at her doubtfully through his glasses. A calculator and a closed laptop lie at his elbow. She is making a case for spending more, and he has not yet been persuaded.

The Minerva Real, two hundred and forty rooms in Guadalajara, put its certificate out to tender after two cycles under an incumbent auditing five days a year. Cisneros asked all three bodies for the calculation behind their number. Two sent it within a day and agreed with each other; the third called its method commercially confidential, which decided that quotation. Then she counted her processes: thirty-one, against two hundred and eighteen people at peak. Audit time starts from headcount, and a hotel is process-dense and headcount-light. In three years no auditor had seen the conference floor during an event or spoken to the outsourced housekeeping contractor, both inside the scope, because there had never been time. When the extra day and a half bought that time, both produced findings.

The plaques at the top record the fact: “31 processes, 218 people” and “Event floor never audited”. Those at the bottom draw the lesson: “Ask for the calculation” and “Say what extra days are for”. In practice two arithmetics can be compared where two totals cannot, and a refusal answers a different question about the body. Increase factors sit in the same document as reductions: process diversity, shift working, outsourced processes and contracted customer requirements. A written case that names them, and asks for the time to go to the night, the contractor and the event floor, is coverage; a request for more days in the abstract is simply a request to be audited more, and persuades nobody.

For accredited certification, ISO/IEC 17021-1 requires the certification body to determine sufficient audit time and a competent audit team, and the mandatory document Global ACI TECH-3-004 (formerly IAF MD 5) supplies the calculation framework: a starting point from the effective number of personnel within the scope, counted to reflect the activity actually within it, then adjusted within limits by factors in both directions, each documented and justified. Where shifts operate, the body must take them into account and justify and record the extent to which they are audited; days are not reduced by planning longer hours. The client may ask how the time was determined and who will audit, while competence and impartiality remain the body’s decisions. Counting processes and the four-line list of unreachable activities are this book’s method.

Subchapter 4.3 · Rotterdam, Netherlands

In a plain grey office lined with shelves of box files, Marieke de Wit, bid coordinator at the Wilhelminakade, sits at a light wooden desk with one hand on her laptop and holds a black frame out at arm’s length in the other, studying it with a frown. On the wall behind her a paler rectangle and two small fixings show where a frame has hung. A closed navy binder and a pen lie on the desk. She is looking at a document she has seen every day for six years as if for the first time.

The Wilhelminakade, two hundred and forty rooms on the Kop van Zuid in Rotterdam, lost a framework tender on question 6.4. It asked whether the quality system was certified by a body accredited for that scheme by a national accreditation body recognised through the international arrangement. De Wit had answered yes four times before, reading the second logo on the certificate as the accreditation. The buyer checked and excluded the submission because the answer could not be substantiated. The logo was a trade association mark. Everything else was sound: the body was accredited for quality management systems by the Dutch national accreditation body, a signatory, and the certificate sat in the public register. The property lost a two-year place, a mid six-figure sum in euros of revenue, because nobody inside could describe its own chain.

The plaques at the top record the fact: “Excluded on question 6.4” and “Second logo: a subscription”. Those at the bottom draw the lesson: “Accredited for which scheme?” and “Never inherit a yes”. In practice knowing that a certification body is accredited means nothing until the scheme is named, and marks that look alike on paper mean different things. Three public facts close the gap: who accredited the body, for which scheme, through which arrangement, with the register entry and its search term. De Wit’s six-line sheet took half a morning; compliance questions are now answered from it alone, never from the last submission, and it has twice turned a reflexive yes into an honest no.

ISO/IEC 17021-1:2015 sets the requirements for bodies certifying management systems, ISO/IEC 17021-3:2017 adds competence requirements for quality system auditing, and ISO/IEC 17011:2017 governs accreditation bodies. Accreditation is granted for defined scopes and schemes, maintained through continuing assessment, and can be reduced, suspended or withdrawn. Since 1 January 2026 Global Accreditation Cooperation Incorporated operates the single multilateral arrangement succeeding the IAF and ILAC structures, with existing accreditations unaffected; its TECH documents are replacing the IAF mandatory documents, and accreditation is still performed by national bodies, in the European Union one per member state under Regulation (EC) No 765/2008. Accreditation raises confidence in the certification system; it does not guarantee a flawless audit. The one-page sheet and the rule for tender answers are this book’s method, not requirements.

Subchapter 4.4 · Nairobi, Kenya

In a quiet meeting room, with a water jug and glasses on the sideboard behind, Wanjiru Kamau, who left finance to run the Hotel Karura’s certification project, sits at a pale round table with both hands on an open ring binder, its ruled pages turned towards the man beside her. He is the certification body’s auditor, chin resting on his fist and a pen in his other hand, reading the page in silence. A cup of tea stands in front of him and a second binder lies closed at the edge of the table. She waits, composed, for the question she already knows is coming.

The Karura, a hundred and sixty-eight rooms off Limuru Road in Nairobi, had built in six months a quality system that was documented, understood, staffed and running, aimed at a November framework window with the next one two years away. At Stage 1 in September the auditor asked to see the trends and found twelve measures each with one number. He asked four questions and the property could answer none, all for the same reason: some evidence accumulates only with use. Customer satisfaction data existed for four months but had never been analysed, because analysis had been set at annual. The opportunity register held four entries, all in progress, none with a method of evaluation. Stage 2 was postponed, the window was missed, and the property reached Stage 2 the following June with two minor nonconformities.

The plaques at the top record the fact: “Twelve measures, one number” and “Four questions, no answers”. Those at the bottom draw the lesson: “Build the calendar backwards” and “Postponement is cheapest”. In practice a project is planned from what must already have run, not forwards from when the documents can be finished. Kamau’s table, one row per dependency with its duration, its predecessor and its start date, showed that a February start could not support a defensible Stage 2 before June; the longest chain, determine, plan, implement, wait, evaluate, contains a waiting period that effort cannot shorten. Postponement lost no fee. What was expensive was seven months aimed at a date nobody had checked, and the buyer should be told before the closing date.

ISO/IEC 17021-1 treats Stage 1 as more than a document review: it examines management system information, site conditions and readiness, the client and the scope, resources for Stage 2, and whether internal audits and management review show readiness. Concerns are documented and communicated, and the interval to Stage 2 reflects the client’s needs and the time required to resolve them, not simply a preferred date. ISO 9001:2026 keeps trends among the performance inputs to management review, as the 2015 edition did, and asks for the effectiveness of actions on risks and, now separately, on opportunities to be evaluated. Neither ISO 9001 nor ISO/IEC 17021-1 sets a minimum number of months of records or a single internal audit as the threshold. The backwards table and the readiness check are this book’s method.

Subchapter 4.5 · Adelaide, Australia

In a function room at the Torrens Parade, banqueting chairs stacked against the wall and pendant lamps overhead, the certification auditor sits at a polished table with an open ring binder, pen on the page, looking up at Tomas Oyelaran. He supervised the conference dinner, works perhaps twelve shifts a year through an agency, and stands in waistcoat and tie with a few sheets of paper in one hand, explaining with the other. Between them Bianca Fenech, the quality and compliance manager who built the system, stands with her hands clasped and listens. She does not intervene. The answer is his to give.

On the second morning of the Stage 2 at the Torrens Parade, two hundred and twenty-four rooms in central Adelaide, the auditor stopped questioning Fenech and asked for a customer: a scientific conference of a hundred and forty delegates and eighty-one room-nights, followed from first enquiry to closed account. The file led to eleven conversations; nine people had never spoken to an auditor and two did not work for the hotel. Four steps went cleanly. Then the changes: nine amendments, seven recorded, and the unrecorded two included the dinner venue, moved for the weather, agreed verbally and never documented. Oyelaran described what he does when something goes wrong, with a real example. His answer became positive evidence, while the principal finding was that awareness of culture and ethics never reached agency and casual staff.

The plaques at the top record the fact: “Nine changes, two unrecorded” and “Forty-minute induction only”. Those at the bottom draw the lesson: “Walk one customer through” and “Occasional staff are audited”. In practice nobody can rehearse the whole operation, and the only preparation that scales is a practice that is real. A property can walk one file through the seven steps of a customer trace in most of a day, in a week of its choosing, and find the changes agreed and never recorded before a stranger does. Casuals, agency staff and contractors’ people perform the service in the weeks that matter most; what they were told is the property’s responsibility, and a wrong answer is corrected at the closing meeting, not rescued in the room.

ISO/IEC 17021-1 requires Stage 2 to evaluate the implementation and effectiveness of the management system against the certification requirements, and requires the certification decision to be taken independently of the audit team, which reports findings and a recommendation. ISO 9001:2026 adds quality culture and ethical behaviour to awareness, but has never required staff to recite the policy. People doing work under the organisation’s control remain relevant whatever their employment status or hours; TECH-3-004 (formerly IAF MD 5) requires shift work to be considered in planning and the extent audited justified, and remote methods under TECH-3-003 (formerly IAF MD 4) do not remove the need to see the actual operation. The rehearsed customer trace and the one-page inventory of what occasional workers are told are this book’s method, not requirements.

Subchapter 4.6 · Zagreb, Croatia

In a back office with grey-green walls, a key cabinet on the wall and a printer on the sideboard, the surveillance auditor, an older man with a grey beard and a corduroy jacket, sits at a laptop with one hand on the trackpad, reading the screen. Standing at his shoulder, Lana Horvat, the front office duty manager sent to accompany him, writes in a small notebook while she follows what he is doing. Across the front of the desk lie separate sheets set out in a row, a thicker stack and a closed dark folder.

At the Zrinjevac, a hundred and ninety rooms in the lower town of Zagreb, Horvat’s notes record nine documents in ninety minutes; after the scope statement came four things written for somebody else: its three largest customer agreements, the meetings and events pages of its website, twelve months of complaints exported to a spreadsheet he sorted himself, and the list of providers who deliver something to a guest. The process determination came sixth. A process map is flat, sixteen processes all the same size, so the certifier builds the ranking himself from what the property promised others. The sorted log put sixty-one per cent of complaints in three categories of nineteen, with room readiness concentrated in the four weeks of Advent; two of the three agreements contracted check-in times for delegations arriving in exactly those weeks. No review before commitment had compared the two.

The plaques at the top record the fact: “Nine documents, map sixth” and “61% in three of nineteen”. Those at the bottom draw the lesson: “Rank by promises, complaints” and “Hold the ranking yourself”. In practice a property should hold four entry points because it needs them, not because an auditor will ask: one page listing which agreements carry service undertakings, the complaint log kept as a distribution rather than a queue, a current list of the providers who reach a guest, and a short list of the processes whose failure recovery cannot reach, all filtered by what has changed in the cycle. As Horvat saw, the auditor knew nothing the hotel did not already know.

The requirement itself is modest. ISO 9001:2026 asks the organisation to determine the processes of its quality management system, their sequence and interaction, the criteria and methods for their operation and control, and the resources, responsibilities, risks, opportunities and evaluation needed to manage them. It does not require a ranked process register equivalent to an environmental aspects register, nor a numerical score for every process. Certification auditors plan from the scope, the applicable requirements, the importance of processes, changes, previous performance and the evidence available, not from clause order. Contracts, complaints, external-provider arrangements and published claims can all be relevant evidence where they bear on requirements. The four entry points, and irreversibility as a filter, are this book’s method, not the standard’s wording.

Subchapter 4.7 · Malacca, Malaysia

Under a woven rattan lamp, before a dark wooden cabinet stacked with boxes, Adeline Tan, the revenue manager, stands at a wooden table and points at a large sheet ruled into vertical columns. Red dots crowd the columns on the left; every other column is empty. Seated beside her, Nurul Hashim, the quality manager, holds a tablet against her chest and looks at the sheet with her lips parted, not yet speaking. A closed laptop and a glass of iced tea on a rattan coaster sit at the edge of the table.

The Heeren Court has a hundred and eighteen rooms in the old quarter of Malacca, twenty-two of them in restored Peranakan shophouses on Heeren Street. In nine years every external audit, the initial one in 2017, six surveillances and two recertifications, had fallen between early May and mid-June. Placed on a seven-day grid, all eighteen audit days were Tuesdays and Wednesdays, in a weekend city where midweek occupancy averaged forty-four per cent and Friday to Sunday ninety-three, and where sixty-four of seventy-one weddings fell on a Saturday. No outsider had seen a wedding served by fifty-one casual staff. The satisfaction index of 8.9 was accurate, yet split by arrival day it read 9.2 midweek and 8.5 at weekends. Each scheduling decision was reasonable; internal audits and review had simply been chained to the external date.

The plaques at the top record the fact: “Nine audits, eighteen days” and “All Tuesdays or Wednesdays”. Those at the bottom draw the lesson: “Same questions, moving dates” and “Ask for a date in writing”. Surveillance is the audit of the interval: its questions rightly recur each year, but its vantage point should move. In practice the property plots every audit and review twice, by month and by weekday, asks its certification body for a different date early and in writing, considers splitting the visit between a quiet day for records and a peak day for delivery, rotates its internal programme and disaggregates data it already holds. The rule is never always at the same point.

ISO 9001:2026 says nothing about surveillance; it governs the internal half. Under clause 9.2 the programme is planned taking into consideration the importance of processes, changes and previous results, with criteria and scope defined for each audit; customer perception data are to be analysed and evaluated, review inputs are expressed as trends, and controlled conditions carry no qualification by weekday. ISO/IEC 17021-1:2015 fixes the minimum content of each surveillance, requires surveillance at least once each calendar year outside recertification years, and places the first one no later than twelve months from the certification decision; the body sets the dates, normally in agreement with the client. Audit time follows Global ACI TECH-3-004, formerly IAF MD 5, cannot be compressed into longer days, and must consider shift work. Plotting and splitting are this book’s method.

Subchapter 4.8 · Asunción, Paraguay

In a dim office lit by a single desk lamp, with server cabinets behind, Derlis Villalba, the IT coordinator, sits in a grey hooded jacket and runs a finger along a long printout spread across the desk. Rocío Benítez, the quality manager, stands beside him in a camel coat and lifts the far end of the same sheet into the light. Beneath the printout lie three stacks of paper side by side. At the left stand a monitor, a steel thermos and a mate gourd with its metal straw.

Mapping legacy tables for a system migration at the Hotel Villa Morra, a hundred and forty-two corporate rooms in Asunción three months from recertification, Villalba found the same guest in two tables under different closure codes. The condition was rooms not ready. Delegations from the morning São Paulo flight reached the hotel around one; sales had sold early access, housekeeping worked to a fifteen-hundred standard. On eleven or twelve days a year the front desk logged an incident, guest relations answered a survey dip and sales credited an escalating account: three departments, three systems, every record closed correctly. Exported into one spreadsheet and sorted by date, they became one pattern over three years: same months, same flight, same corridor. The second strand was drift: four approved changes since 2019 had left the hotel sharing only nine of its fourteen documented processes with the hotel certified in 2019.

The plaques at the top record the fact: “Eleven or twelve days a year” and “Three systems, all closed”. Those at the bottom draw the lesson: “One condition, not eleven” and “Read the cycle yourself”. Recurrence and drift both look like ordinary work at a focal length of one year. In practice, three months before the audit, the property exports every customer signal channel for the whole period into one pseudonymised file, within the applicable data-protection rules, sorts it by date and area, and re-reads its determination of processes against the business as it now is. The test is mechanism, not frequency: eleven events with one mechanism are a finding; eleven with eleven mechanisms are a hotel.

ISO 9001:2026 already asks most of this of the hotel: it determines its processes and their interactions and keeps them supported by documented information; where a nonconformity occurs it determines whether similar ones exist or could occur elsewhere (10.2); review inputs are expressed as trends. Changes are carried out in a planned manner, but that clause governs each change, not their sum; reading it otherwise is the author’s inference. Under ISO/IEC 17021-1:2015 recertification is planned on the whole period of certification, examines the system as a whole, and must be completed, with any major nonconformity verified, before expiry; otherwise certification is not renewed, restoration is possible within six months, and beyond that at least a stage 2 audit is needed. Under Global ACI TECH-3-004 audit time reflects today’s organisation. A cycle review in one management review is this book’s method, not a requirement.

Subchapter 4.9 · Denver, United States

In an office of exposed red brick crossed by a black steel beam, under a hanging metal lamp, Dana Whitlock, the quality manager, sits at a heavy wooden desk with a telephone receiver held to her ear, its coiled cord running to the desk set. With her other hand she traces a circle in pen on one of two gridded sheets laid side by side in leather folders; each sheet carries a single circle. A thick grey binder lies closed at her left, and reading glasses and a white mug wait at her right.

The Wazee House is two hundred and forty rooms in a converted warehouse in Lower Downtown Denver, with three airline crew contracts holding forty rooms a night. Its gap analysis ran to forty-one pages: eleven ambers, three reds and a four-month documentation project. Whitlock then called her certification body with a scheduling question, and learned that it could not audit against the new edition at her February surveillance, because its own transition was not complete. Set beside her audit calendar, the transition period to 30 September 2029 shrank to two scheduled dates, the second being her recertification, eleven weeks before the end. Recertifying late to the outgoing edition would buy a certificate ending with the transition, and two airline contracts required current certification at renewal, one of them in that same quarter.

The plaques at the top record the fact: “Forty-one pages, three reds” and “Two usable audit dates”. Those at the bottom draw the lesson: “Count audits, not months” and “Ask the body, in writing”. A transition is a scheduling problem wearing the costume of a technical one. In practice the property lists every audit up to the deadline, strikes out those its body cannot yet perform, adds any separate transition audit it could agree, and sends three dated questions in one email: from when, how much additional time, and what happens if it recertifies to the old edition. It then triages the changes, starts the genuinely new ones early enough to leave records, and checks contracts for the edition number. Early or late is a strategic choice; the error is to drift into it.

The standard contains no transition rules. Its foreword summarises what changed and the clauses are the authority; the book’s three themes are a teaching selection, and preventing human error has been required since 2015. The arrangements sit in Global ACI TECH-3-TR-2029-09-30, applicable from 16 September 2026: accreditation bodies ready by 31 March 2027, certification body declarations by 30 June 2027, initial certification only to the 2026 edition from 31 March 2028, and certified clients transitioned by 30 September 2029, after which a 2015 certificate is not valid. Transition may occur at a surveillance, a recertification or a separate audit, with any extra time determined and justified by the body. Counting usable audits is this book’s method; the dates are perishable and must be checked against the current document.

Subchapter 4.10 · Lyon, France

At a stainless steel counter in a hotel kitchen, among white tiles and shelves of pans, Karim Belhadj, the food and beverage director, wears a white chef’s jacket and holds open a worn logbook with ruled pages, turning it towards the auditor as he speaks. Marguerite Sorel, the certification auditor, grey-haired, in glasses and a navy blazer, leans in to look, her hand resting on two neat stacks of paper on the steel. Between them lies a pair of kitchen tongs.

After twenty-two years of auditing, Sorel faced at the Hôtel des Brotteaux in Lyon three themes the profession had no settled way to audit: two new in the edition, and the prevention of human error, carried over from 2015 but rarely examined. Belhadj had two documents ready, both from the previous six weeks: a four-page code of ethical conduct signed by every employee, and a consultant’s allergen procedure in force for eleven days. She set them aside and asked when somebody had last reported a mistake nobody else had noticed. In March a commis had admitted, a day late, using one pair of tongs on a coeliac plate and a bread service; Belhadj stopped the next service for eleven minutes. The kitchen log, kept since 2021, held nineteen entries in twelve months, six self-reported. Yet the guest was never told, and a log shows that something was reported, not that what followed was safe.

The plaques at the top record the fact: “Six errors self-reported” and “Procedure eleven days old”. Those at the bottom draw the lesson: “Records over artefacts” and “Bring your own account”. In a hotel the three themes converge on one fact: what happens to the person who speaks. In practice the property finds the logs it already keeps, writes one page before the audit on what it thinks demonstrates each requirement and where it has nothing yet, tests each human error action against the design of the work rather than exhortation, and writes an opportunity’s success criterion before acting: the bistro opened to non-residents had never been evaluated, because no criterion existed. A finding that cannot be written as requirement, evidence and gap is contested on structure, not tone.

Here ISO 9001:2026 carries the weight: top management actively promotes a culture of quality and ethical behaviour, and people are aware of it; actions to prevent human error remain among the controlled conditions of service provision, pointing at the design of the work; risks and opportunities are treated distinctly, with the effectiveness of actions on each evaluated separately (9.1.3, 9.3.2). The note linking the process environment to culture is a note, not a requirement. ISO/IEC 17021-1:2015 requires conclusions resting on objective evidence and grades nonconformities as major or minor by their effect on the system; ISO/IEC 17021-3:2017 sets auditor competence. Neither licenses grading a culture by impression. ISO 19011:2026 offers guidance that recognises interviews, corroborated before use; ISO 10010:2022 is guidance on culture, never a criterion unless adopted. The one-page account is this book’s method.

Subchapter 4.11 · Brno, Czech Republic

In a plain back office, with a printer on a cabinet, a plant and a lamp at the edge of the desk, Tereza Machálková, who owns the hotel’s satisfaction survey, sits at a laptop with her hand pressed to her mouth, staring at the screen. Behind her stands Jakub Souček, the front office manager, holding a large bound register open in one hand and a pen in the other, frowning at the same screen. To the right the certification auditor, an older man in glasses and a dark jumper, waits with a pen above a closed notebook. Nobody is writing yet.

The Hotel Lužánky has a hundred and sixty rooms ten minutes from the Brno exhibition grounds, and in fair weeks it oversells deliberately, as signed revenue policy. When a guest with a confirmed reservation found no room, the night team relocated him: a partner hotel, the first night paid, a taxi, a voucher, a call the next morning. Two hundred and fourteen guests the previous year, and not one recorded as nonconforming service. The cost sat in a budget line with an owner; the system had never been told the event existed. Then Machálková saw the second half. The survey was triggered by departure, a relocated guest never departs, and for four years the index of 8.6 had silently excluded the hotel’s worst outcomes. The finding was graded major that afternoon.

The plaques at the top record the fact: “214 relocations unrecorded” and “Index of 8.6 missed them all”. Those at the bottom draw the lesson: “A log is only a correction” and “Ask what else sits outside”. Within nine days the hotel built and backfilled a relocation log and proposed closure; that repaired the record, not the condition. The corrective action is what would have put the event inside the system: here one field that routes a relocated reservation into the nonconforming output log, names the authorising duty manager and triggers the survey, together with a review of which other failures are handled well and recorded nowhere, checked on a stated date.

Grading is a certification rule. ISO/IEC 17021-1 treats as major a nonconformity that affects the capability of the management system to achieve its intended results, so the absence of harm is no defence. For a major the body requires cause analysis, correction and corrective action within a time it sets, and verifies them on evidence or at an additional visit; at recertification an unverified major prevents renewal. The client may contest facts, criterion, extent or classification with evidence, through the team leader and then the body’s appeal or complaint process, while still responding. ISO 9001:2026 supplies the breached requirements: nonconforming outputs identified and controlled, with actions and any concession authority recorded; a determination of what is monitored and measured, itself auditable; reaction, action on the cause, including whether similar nonconformities exist elsewhere, and review of effectiveness. It does not prohibit overselling. The field and the review are the book’s method.

Subchapter 4.12 · Jeju, South Korea

In an office panelled in pale wood, with a lamp, a plant and a row of binders on the shelves, Han Ji-woo, who is building the resort’s largest bid, sits at an open laptop with a thick folder held against her chest and turns to look up, visibly worried. Beside her stands Baek Seung-ho, the quality manager, in a dark suit and glasses, reading a single printed sheet with a heavy frown. A small green cup rests on its saucer next to the laptop.

The Jungmun Coast Resort, two hundred and sixty-eight rooms on Jeju and one of seven properties in its group, had been certified since 2016. Question fourteen of a large tender asked for the certificate number, so that the client could check the public register. Han Ji-woo checked it first, and the entry said suspended. In March a major had been raised against the control of externally provided services: housekeeping had gone to a labour supply company in 2024 without any performance criteria. Baek answered with a signed service level agreement dated eleven days after the audit. The body rejected it as a document rather than a demonstration of control, the second submission came late, and the certificate was suspended in June. Meanwhile the group was moving seven properties from three bodies to one: six transfers were routine, the seventh impossible.

The plaques at the top record the fact: “Register entry: suspended” and “One of seven untransferable”. Those at the bottom draw the lesson: “Suspended means not portable” and “Inventory every live claim”. A suspension changes nothing in the building and everything about the truth of what the hotel has published. Changing body or pausing by agreement are choices for a year without trouble; once suspended, the main instrument left is the corrective action, with the current body, inside its time. The cycle does not stop. And the claim must be traced to where it lives: channels the property controls, channels it only influences, and documents beyond recall, such as a submitted tender. Largest accounts should hear of a change before the register tells them.

None of this is in ISO 9001:2026. Under ISO/IEC 17021-1 a suspended certification is temporarily invalid; the body suspends for persistent or serious failure to meet certification requirements, refusal of surveillance or recertification at the required frequency, or a voluntary request it decides on. It sets the time for resolution, after which withdrawal or reduction of scope follows, states the true status when asked, and records it publicly; terms sit in its rules and the agreement; decisions can be appealed. Under Global ACI TECH-3-002, formerly IAF MD 2, only a valid accredited certification can be transferred, after a pre-transfer review normally made on records. After expiry, restoration within six months requires completing the outstanding recertification activities. The quality standard reaches the conduct through external communication, customer requirements and corrective action. The three-column inventory is the book’s method.

Subchapter 4.13 · Christchurch, New Zealand

In a quiet boardroom with a long polished table, beige chairs, a brass lamp and a plant on the sideboard, Ngaire Whitfield, the group’s company secretary, stands reading a large bound volume she holds open, one finger following a line on the page. On the table lie two stacks of dark bound volumes, three on each side, with her glasses and a cup between them. With the one in her hands there are seven volumes, as many as the hotels in the group.

Braided Rivers Hotels held seven properties across the South Island, two of them in Christchurch, and seven separate certificates. Multi-site certification would sample the sites, and the finance director had already put a saving of seventy-one thousand New Zealand dollars over three years into the September board pack. The application asked Whitfield whether the central function could require corrective action at each site. Three hotels were owned and operated outright; two were run by an operator under management agreements reserving operating decisions to it; one was a franchise; one a joint venture in which the group held forty-nine per cent. On the balance sheet a group of seven; as an entity able to compel a change, a group of three. And under one certificate a major at Tekapo, fifty-two rooms, would fall on the certificate Christchurch quoted in its tenders.

The plaques at the top record the fact: “NZ$71,000 saving announced” and “Three of seven under control”. Those at the bottom draw the lesson: “Authority before similarity” and “Price the pooled exposure”. A shared manual proves that sites resemble each other, which only decides whether they may be sampled; eligibility turns first on whether the centre can compel. A hotel run by somebody else is honestly treated as an externally provided process. The group certified the three sites it controlled, kept four on their own certificates, resourced the central function, minuted the pooled exposure and accepted a saving of about thirty thousand dollars. The decision belonged to the board, made with both numbers in front of it.

The quality standard does not count buildings. Multi-site schemes belong to ISO/IEC 17021-1 and Global ACI TECH-3-001, formerly IAF MD 1, with audit time under TECH-3-004, formerly IAF MD 5. The first test is one management system under a central function with authority to require corrective action at every site; the second is whether processes are substantially similar enough to sample. The central function is audited every time; at least a quarter of the sample is random, the rest chosen on risk, with roughly the square root of the number of sites at initial certification, 0.6 of it at surveillance and 0.8 at recertification, rounded up. A finding at one site is investigated across all; adding a site is a scope extension the body evaluates. ISO 9001:2026 supplies scope, assigned authorities, control of external providers and an internal audit programme covering every site. The one-page authority table is the book’s method.

Subchapter 4.14 · Manama, Bahrain

In a general manager’s office of dark wood, with a lamp, a plant and shelves of binders behind, Yousif Fakhro sits at his desk holding a single printed sheet, a pen raised in his other hand but kept away from the paper, reading with a deep frown. A glass of tea stands on its saucer beside a closed laptop. Next to him stands Amina Darwish, who is building the bid, a dark folio held against her, watching him read and waiting for a signature that does not come.

A multinational bank was re-tendering its Bahrain accommodation programme, and question twenty-two asked the supplier to confirm that its ISO 9001 certification evidenced a guest satisfaction level of 8.5 or above. The Manama Bay Hotel, a hundred and ninety rooms on the waterfront with two thirds of its room nights from corporate programmes, was certified and stood at 8.7. Darwish wanted to answer yes to both parts, and everything in the question was true. Fakhro read it four times and did not sign, because it asked whether the first fact proved the second. His answer said plainly that it does not, then gave the figure with its method, population and trend, and the three latest corrective actions on service failures. A more senior reply came within four days. The spa concession, the contracted transfers and the leased restaurant lay outside the scope altogether.

The plaques at the top record the fact: “Read four times, not signed” and “Three services outside scope”. Those at the bottom draw the lesson: “Certifies system, not level” and “Send the evidence alongside”. Hospitality is especially exposed, because a star rating already grades the level, and a second certificate on the same wall is read as more of the same. The certificate says that the hotel does what it says it does; it does not say that what it says is good. A bare correction reads as refusal, a bare yes overclaims; the honest correction and better evidence travel in the same message, written so that a non-specialist can score it.

ISO/IEC 17021-1 has the certification documents identify the organisation, the standard and its edition, and the scope, and requires the body to set rules on marks and references to certification, which the client accepts in its agreement. Those rules forbid presenting a management system certification as a product or service certification, and their use is examined at surveillance. ISO 9001:2026 itself aims at consistent provision of conforming services and the enhancement of satisfaction, which names no level. The organisation determines its own requirements above the statutory and regulatory floor it must identify; it monitors customer perception with methods it determines and no threshold; its scope is a limit as well as a description; continual improvement concerns direction, not position. The certificate rests on sampled audits on particular days, so between visits assurance comes from the hotel’s own monitoring. No clause requires the three-column page; that is the book’s method.

Subchapter 4.15 · Seattle, United States

In a meeting room with dark walls, a plant and a glass wall streaked with rain, Karin Solberg, the asset manager who works for the owner, leans over the table and rests her finger on a single sheet of paper laid beside a thick open ring binder. Seated next to her, a grey-haired man in a dark suit, whom the case does not name, holds a pen and follows where she is pointing. Two cups of coffee and a closed laptop complete the table.

The proposal was one line in a budget pack: discontinue ISO 9001 certification, saving twenty-one thousand four hundred dollars. The Elliott Bay Hotel, three hundred and twelve rooms in Belltown, is owned by a fund and run by an operator of forty-one hotels, and a 2016 clause required the owner’s approval. Solberg asked what it actually cost: about four hundred and ten internal hours in a certification year and a hundred and sixty in a surveillance year, across eleven managers, near fifty-eight thousand dollars a year, around a hundred and eighty-six per available room, modelled rather than benchmarked. Then she asked what share of revenue came through doors where certification was asked for: thirty-one per cent of room nights. With a refinancing due in eighteen months, eight years of verified records mattered. Cost and benefit sat across three boundaries: time, department and legal entity.

The plaques at the top record the fact: “Fee $21,400 of about $58,000” and “31% of room nights exposed”. Those at the bottom draw the lesson: “Measure exposure, not ROI” and “Owner of exposure decides”. The return cannot be measured, though it can be estimated as a range with stated assumptions; exposure can be extracted from the sales system in days. The certificate is the receipt, the asset the capability the system leaves behind. The hotel kept it, named the hours in departmental budgets, reported it to the owner as an asset item and stopped rehearsing for audits. For a leisure property with zero exposure, letting it lapse is an honest answer.

ISO 9001:2026 presents adopting a quality management system as a strategic decision and its benefits as capabilities; it does not require certification, although internal audits remain required of any conforming system, and top management must ensure the resources the system needs. The fee is set by the certification body under Global ACI TECH-3-004, formerly IAF MD 5, from effective personnel adjusted for complexity, with shift work taken into account and no shortening by longer audit days; the body records its reasons. Internal hours, cost per available room and exposure are the hotel’s own estimates. Who may discontinue is settled by the management agreement, not the standard. Re-entry has conditions: restoration within six months of expiry if outstanding recertification activities are completed, otherwise at least a stage 2, and from 31 March 2028 new initial accredited certification is to the 2026 edition. The one page is the book’s method.