PDCA cycle: how plan-do-check-act works in ISO standards

The PDCA cycle is a four-step model for improvement: plan (decide what you want to achieve and how), do (carry it out), check (measure whether it works) and act (adjust and secure what works). Every ISO management system standard is built around this cycle. ISO 9001:2015 explicitly mentions the model in clause 0.3.2. It states that you can apply it to every process and to the management system as a whole.

For certification, that means the auditor does not check whether you use the word PDCA. They check whether your cycle is closed. Do you have objectives (plan), and do you carry them out (do)? Do you measure them in internal audits and KPIs (check), and do you take decisions in the management review (act)? ISO 14001 and ISO 45001 also describe PDCA in their introductions (clause 0.4).

What do plan, do, check and act mean?

Below, for each phase, is what you do and what evidence an auditor expects. Use the last column as a checklist for your own system.

Phase	What you do	Typical evidence for the auditor
Plan	Set objectives, determine risks and opportunities, choose the approach and resources	Objectives, risk register, planning
Do	Carry out as planned, train people, record the work	Work instructions, records, training certificates
Check	Measure and compare against the objective	KPI report, internal audit report, complaints overview
Act	Adjust: correct, improve, set new objectives	Action list, management review minutes, revised procedures

The cycle does not stop after act. What you decide in act is the input for the next plan. That is why many people draw PDCA as a wheel rolling up a slope: with every round, you climb a little higher.

Is the PDCA cycle mandatory for ISO certification?

No, not as a separate requirement. No ISO standard asks for a document titled “PDCA”. The cycle is built into the requirements themselves, however. Setting objectives (clause 6), measuring and auditing (clause 9) and improving (clause 10) are all mandatory.

If you miss one of those steps, you receive a nonconformity against that specific requirement. For example, no management review means a nonconformity against clause 9.3, not a nonconformity against “PDCA”.

Where does the PDCA cycle come from?

The model goes back to the American statistician Walter Shewhart. W. Edwards Deming made it known from the 1950s onwards, mainly in Japan. That is why it is also called the Deming cycle. Deming later preferred “study” to “check” (PDSA), because in that phase you need to learn, not just tick things off.

For ISO certification, it does not matter whether you say PDCA or PDSA. The standards use PDCA.

PDCA and the clauses of the HLS

All modern ISO standards follow the same High Level Structure (HLS), with clauses 4 to 10. ISO 9001 shows in a figure how those clauses fall into the cycle. A common breakdown looks like this:

HLS clause	Topic	PDCA phase
4 Context	Interested parties, scope, processes	Basis for the cycle
5 Leadership	Policy, roles, top management involvement	The heart of the cycle
6 Planning	Risks and opportunities, objectives	Plan
7 Support	People, resources, competence, documents	Plan and do
8 Operation	The operational processes themselves	Do
9 Evaluation	Measurement, internal audit, management review	Check
10 Improvement	Nonconformities, corrective actions, continual improvement	Act

This is useful at audit time. If the auditor asks “how do you adjust course?”, the answer is in clause 10: your nonconformities and corrective actions.

Example: applying the PDCA cycle to a quality objective

An installation company with 25 employees receives complaints about fitters arriving late. This is what one round of PDCA looks like. You can take this table directly as a template.

Phase	Question	Completed example
Plan	What is the problem and the objective?	18% of appointments start more than 30 minutes late. Target: below 8% within six months.
Plan	What is the cause?	The planning does not account for travel time between jobs (root cause analysis).
Plan	Which measure, who and when?	The planner includes travel time via the route planner. Owner: head of planning. Start 1 March.
Do	How do you carry it out?	Trial with two teams over eight weeks. The planner receives a short instruction.
Check	What do the figures show?	Late starts in the trial teams: 7%. In the other teams: 17%. Complaints about waiting halved.
Act	What do you secure, and what do you adjust?	The way of working is included in the planning procedure and rolled out to all teams. New target for next year: below 5%.

This example shows three things an auditor wants to see: a measurable objective, figures before and after, and a decision that is recorded. Want to formulate your objectives well? Read quality objectives for ISO 9001.

You do not need to keep PDCA as a separate form. If your objectives, measurements, audit reports and management review connect with each other, you already have the cycle. The auditor follows that thread.

At which levels do you use PDCA in your management system?

PDCA works at three levels at once. That explains why the word appears in so many standard texts.

Level	Plan	Do	Check	Act
The whole system (annual cycle)	Policy and annual objectives	Processes run	Internal audit, KPIs	Management review
One process	Process description and standard	Carry out the work	Process indicator	Adjust the process
One problem	Cause and measure	Implement the measure	Test effectiveness	Secure it or repeat

At the lowest level, PDCA looks a lot like an 8D report. That is also a PDCA cycle, just worked out in eight steps for one complaint or problem.

What does the auditor ask about the PDCA cycle?

Auditors rarely ask “do you do PDCA?”. They test whether the cycle closes. Typical questions are:

“What objectives do you have this year, and how are they doing?”
“What did you do with the findings from the previous internal audit?”
“Which decision from the management review has since been carried out?”
“How do you know this corrective action worked?”

The last question is the hardest. Many organisations stop after do. They introduce a measure, but do not check whether the problem stays away afterwards. Then the check is missing, and an auditor can write a minor nonconformity on the effectiveness of corrective actions.

Common mistakes with the PDCA cycle

Plan without a measurement point. “Improve customer satisfaction” is not a plan. Without a number, you cannot compare anything in the check phase.
Check without act. The KPIs sit in a dashboard, but nobody takes a decision when they turn red.
Act without securing it. The improvement works, but it is not written into any procedure or instruction. A year later, everyone has forgotten it.
One round per year. The annual cycle is mandatory, but for problems you do not wait for the management review.

PDCA cycle per standard

The cycle is the same everywhere, but the content differs per standard. With ISO 14001 it is about environmental objectives. With ISO 45001 it is about hazards and risks, and with ISO 27001 about information security risks. With ISO 50001, the energy review forms the plan phase.