Local Government Quality Management Systems: ISO 18091 and the 2026 ISO 9001 Revision

Why should local governments consider ISO 9001 and ISO 18091?

Because a council is judged on service delivery, and a quality management system is the only framework that treats service delivery as something you design, measure and improve rather than something you hope for.

There is also a deadline worth knowing about. ISO 9001 is being revised, publication is expected in September 2026, and councils have until September 2029 to transition. The guidance standard written specifically for local government, ISO 18091, is anchored to the 2015 edition of ISO 9001 and is not being revised alongside it. That gap is the thing to understand before you plan any work.

Councils are not just another organisation

Government institutions have traditionally not been held to the same performance benchmarks as the private sector, which has at times led to inefficient and costly service delivery. Ratepayers have noticed. Modern communities expect the money they pay in rates to be spent efficiently and to produce timely, effective services.

Councils also carry a structural problem that private companies mostly do not. Senior leadership changes frequently, through elections, through executive turnover and through machinery of government changes. W. Edwards Deming named exactly this as one of his seven deadly diseases of management: “mobility of top management” (Deming 1982, Out of the Crisis, Chapter 3).

A documented management system is the practical answer to that. When the system holds the knowledge, a change of General Manager or a new council after an election does not reset the organisation’s capability to zero.

What ISO 18091 is, and what it is not

ISO 18091:2019 is titled Quality management systems: Guidelines for the application of ISO 9001 in local government. Two words in that title do a lot of work.

“Guidelines” means it is not a certifiable standard in its own right. Councils certify to ISO 9001. ISO 18091 is the interpretive layer that translates ISO 9001 into council language, and the standard says so explicitly: the guidelines “do not add, change or modify the requirements of ISO 9001”.

“Local government” means it is genuinely written for councils rather than retrofitted. It applies across all council processes at strategic, tactical-managerial and operational levels, and it treats the citizen as the customer.

The two annexes are the parts most consultants actually use. Annex A provides a diagnostic methodology for a council to evaluate the scope and maturity of its processes, products and services, which gives you a defensible baseline before you commit budget. Annex B sets out the processes needed to deliver reliable products and services to citizens. The 2019 edition also links the guidance to the UN Sustainable Development Goals, which is often the hook that gets a council’s strategic planning team interested.

ISO 18091:2019 is the current edition. It was published in March 2019, went through systematic review in January 2024, and was confirmed in July 2024, meaning ISO reviewed it and decided it did not need changing.

The problem: ISO 18091 is anchored to ISO 9001:2015

ISO 18091:2019 gives guidance on implementing a quality management system that meets the requirements of ISO 9001:2015. Its structure, its cross-references and its clause-by-clause interpretation are all built on the 2015 edition.

ISO 9001:2026 is close. The Draft International Standard was published in August 2025, the Final Draft International Standard was approved in April 2026, the FDIS ballot closed on 9 July 2026, and publication is expected in September 2026. Certified organisations, councils included, will have a three year transition period running to September 2029.

ISO 18091 is not being revised in step. Because it was confirmed in 2024 and ISO reviews standards on a roughly five year cycle, the next scheduled look at ISO 18091 is not due until around 2029. It is possible ISO brings that forward, but nothing published suggests it will.

So from September 2026, councils are in this position: the requirements standard they certify against moves to a new edition, while the guidance standard written for their sector continues to point at the previous one.

This is manageable rather than alarming. ISO 18091’s value has never really been its clause mapping. Its value is Annex A, Annex B, and the reframing of citizens as customers, and none of that depends on which edition of ISO 9001 is current. But if your council is building a system now, or your consultant is handing you a clause-by-clause matrix derived from ISO 18091, you need to know that matrix will be one edition behind within weeks.

Why this lands harder in local government than anywhere else

Queensland offers two cautionary cases, and the useful lesson is not the one people usually draw from them.

Ipswich City Council. Mayor Paul Pisasale resigned in June 2017 after the Crime and Corruption Commission raided his office. He was convicted of two counts of extortion in July 2019 and later pleaded guilty to a long list of further offences including official corruption, 27 counts of fraud and secret commission by an agent. In August 2018, before any of that had been tested at trial, the Queensland Parliament passed the Local Government (Dissolution of Ipswich City Council) Act 2018 and dismissed the mayor and all ten councillors, replacing the elected body with a single administrator.

Logan City Council. In April 2019 the mayor and seven councillors were charged with fraud over the dismissal of the council’s chief executive. On 2 May 2019 the Minister for Local Government sacked the council and appointed an administrator until the March 2020 elections. In April 2021 the Office of the Director of Public Prosecutions discontinued the fraud charges against all of them, telling the court there was insufficient evidence. There were subsequent calls for compensation and a public apology.

Now put those side by side, because this is the point. At Ipswich, Pisasale was convicted, but his successor as mayor was charged, convicted at first instance, then acquitted on appeal in December 2020 with findings of innocence substituted on every count. The Court of Appeal later refused police leave to appeal that result. At Logan, the charges that triggered the dissolution of an entire council were dropped in full.

Both councils were dissolved anyway. Every councillor lost their seat, including those who were never accused of anything and those later found innocent.

That is the governance risk in local government, and it is not simply that somebody might be corrupt. It is that an allegation, on its own, can remove an entire elected body, and the consequence falls on people who did nothing wrong. Guilt is not a precondition.

This is why the ISO 9001:2026 emphasis on demonstrable culture, integrity and ethical behaviour matters more in this sector than in most. A documented control framework does two jobs. It deters and detects misconduct, which is the job everyone thinks of. It also lets a council demonstrate probity in advance and on the record, which is the job that protects the honest majority when something goes wrong around them. Observed behaviours, shared values and documented decisions are exactly what the revised standard asks you to be able to evidence, and exactly what is impossible to reconstruct after the CCC arrives.

What changes in ISO 9001:2026, and why councils should care more than most

The core requirements are largely unchanged. This is an evolutionary revision, not a rebuild, and an organisation already running a healthy ISO 9001:2015 system will not face a major overhaul. What is striking, though, is that almost every area being strengthened is an area where councils are most exposed.

Quality culture, integrity and ethical behaviour. Top management will be required to demonstrate leadership and commitment by actively promoting a quality culture, integrity and ethical behaviour, and a new note explains that culture and ethics can be evidenced through shared values, attitudes and observed behaviours. Clause 7.3 awareness is extended so that personnel must understand quality culture and ethical behaviour too. For a sector that carries genuine fraud, corruption and probity risk, this is the most significant change in the revision.

Organisational culture aligned to strategic direction. Top management must develop a quality culture that takes account of the organisation’s context and supports its strategic direction. Councils already produce community strategic plans, delivery programs and operational plans. This change pushes the quality system to connect to those documents rather than sit beside them.

A clearer split between risks and opportunities. Clause 6.1 is broken into sub-clauses so that actions addressing risks are distinguished from actions pursuing opportunities. Most councils we see treat clause 6.1 as a risk register and stop there. The revision makes the opportunity side harder to skip.

Climate change. This one already applies. Amendment 1:2024 to ISO 9001:2015 requires an organisation to determine whether climate change is relevant to its management system, and it took effect immediately when published in early 2024. The revision carries it forward. If your council has not addressed climate relevance in its context analysis, that is a current gap, not a future one, and for councils managing roads, drainage, coastal assets and disaster recovery it is difficult to argue climate change is not relevant.

Harmonized Structure. The revision adopts the Harmonized Structure, the successor to the High-Level Structure. This keeps ISO 9001 aligned with ISO 14001, ISO 45001 and the newer management system standards, which matters if your council runs more than one.

Quality objectives. Objectives must be measurable, but only where practical, and planning of changes must now consider how the effectiveness of a change will be verified and evaluated and how the results will be reviewed.

What to do now

If your council is certified, do not wait for September. Use the time to run a gap analysis against the current system and look specifically at culture, ethics, the risk and opportunity split, and climate relevance. The existing system is the right foundation, not something to be discarded.

If your council is not yet certified, there is no reason to delay. The revision is evolutionary, so a system built to ISO 9001:2015 today transitions to the 2026 edition without drama, and you get the operational benefit three years earlier. Waiting for a standard to publish before starting is how councils end up doing the whole thing under time pressure in 2029.

Either way, do not build your system as a clause-by-clause copy of ISO 18091. Use Annex A for the maturity baseline, use Annex B to identify the processes, then build against ISO 9001 itself. That way the September publication is a document review, not a redesign.

The wider system councils need

A quality management system on its own does not cover the risks a council carries. In practice we recommend a council’s system is designed to align with:

• AS 8001:2021 Fraud and Corruption Control. Note the year. The third edition was published in June 2021 and superseded AS 8001:2008. It replaced the old Fraud and Corruption Control Plan with a Fraud and Corruption Control System, added requirements that allow an organisation to claim conformance, and added guidance on the roles of governing bodies and top management and on whistleblower protection. It also requires an information security management system consistent with ISO/IEC 27001.
• ISO 31000:2018 Risk Management for the risk framework that clause 6.1 sits inside.
• ISO/IEC 27001:2022 information security, which AS 8001:2021 now effectively points you towards, and which councils increasingly need on their own merits given the volume of citizen data they hold.
• ISO 42001 AI management where the council is deploying AI in service delivery, planning assessment or customer contact.

These do not need to be four separate systems. One integrated management system is cheaper to run and easier to audit than four parallel ones. Across all of them, the same fundamentals apply that any council system needs to get right:

1. Training, competency and knowledge of personnel
2. Process formalisation and optimisation
3. Customer focus, including complaints and compliments
4. Risk management: identification, analysis, evaluation, treatment, implementation, communication, monitoring and reporting
5. Fraud and corruption control, including policies, procedures and quality objectives
6. Strategic planning, including goals and supporting objectives
7. Senior leadership change management
8. Corrective action and continual improvement

Summary

ISO 18091:2019 remains the best sector-specific guidance available for council quality management systems, and Annex A is worth the price of the standard on its own. But it is guidance for applying ISO 9001:2015, and ISO 9001:2026 is expected in September with transition running to September 2029.

The practical answer is to build against ISO 9001 itself, use ISO 18091 for the diagnostic and the process map, and treat the culture, ethics, risk and opportunity, and climate change changes as the areas to focus on. For councils, those are not incidental additions. They are the parts of the standard that speak most directly to the risks the sector actually carries.

Certification to ISO 9001 Quality Management Systems demonstrates that a council is committed to delivering the best possible services to its ratepayers and community, and that it has robust systems in place to manage changes in leadership, address risk and drive continual improvement.

Frequently asked questions

Can a council be certified to ISO 18091?

No. ISO 18091 is a guidance standard and explicitly does not add, change or modify the requirements of ISO 9001. Councils certify to ISO 9001 and use ISO 18091 to interpret it.

Is ISO 18091:2019 still current?

Yes. It was published in March 2019 and confirmed following systematic review in July 2024.

When does ISO 9001:2026 publish, and how long is the transition?

Publication is expected in September 2026, with a three year transition period to September 2029.

Should we wait for ISO 9001:2026 before starting?

No. The revision is evolutionary rather than a rebuild, so a system built to the current edition transitions without significant rework, and you get three extra years of operational benefit.

Does the climate change requirement apply to us now?

Amendment 1:2024 took effect on publication in early 2024, so if you are certified you should already have determined whether climate change is relevant to your quality management system. For most councils it will be.

How Streamline can help

Streamline ISO consultants can help councils design, implement and internally audit a quality management system that complies with ISO 9001 and follows ISO 18091. Our systems are built to certify first time, and certification is awarded by a JAS-ANZ accredited certification body.