What is the PDCA cycle?
The PDCA Cycle (Plan-Do-Check-Act) is a simple yet powerful methodology organisations use to achieve continuous improvement and operational excellence. It is the engine inside every ISO management system — if you have read the clauses of ISO 27001, ISO 22301 or ISO 9001, you have seen PDCA wearing a suit.
- Plan — establish objectives and the processes necessary to deliver results in accordance with requirements
- Do — implement the plan and execute the processes
- Check — monitor and measure processes against policies, objectives and requirements; report the results
- Act — take actions to continually improve process performance
*PDCA turns plans into action, action into insight, and insight into continuous improvement.*
Purpose of the PDCA cycle
- Drives continuous improvement in processes, products and services
- Helps organisations adapt to changes effectively
- Enhances efficiency, reduces risks and waste
- Improves customer satisfaction
- Supports a culture of learning and accountability
- Ensures alignment with organisational objectives and compliance requirements
PDCA in action: four management systems
| Plan | Do | Check | Act | |
|---|---|---|---|---|
| Information security (ISO 27001) | Identify security risks and controls | Implement security controls | Monitor and review control effectiveness | Address gaps and improve security measures |
| Business continuity (ISO 22301) | Conduct BIA and define recovery strategies | Implement BC plans and processes | Test, monitor and evaluate effectiveness | Improve plans based on lessons learned |
| Quality management (ISO 9001) | Define quality objectives and processes | Deliver products/services as per the plan | Measure performance and gather feedback | Take corrective actions and drive improvements |
| IT service management (ISO 20000-1) | Identify service requirements and plan improvements | Deliver and support IT services | Monitor service performance and SLAs | Improve service quality and efficiency |
Where can PDCA be used?
- In all management systems — ISO 9001, ISO 27001, ISO 22301, ISO 45001 and more
- In daily operations and process improvements
- In project management and service delivery
- In risk management and compliance activities
- In resolving issues and implementing corrective actions
PDCA is universal and can be applied at all levels of an organisation — from a single team's process fix to the board's annual management review.
Why PDCA matters
- Creates a structured approach to problem solving
- Encourages data-driven decision making
- Promotes consistency and standardisation
- Builds resilience and long-term success
- Helps achieve and maintain certification standards
Continuous improvement is not a one-time effort — it is a continuous cycle. This is also why auditors ask for evidence from *multiple* cycles: a single internal audit shows you ran Check once; corrective actions from that audit, reviewed by management, show the full loop turning.
See PDCA operating inside real audit work in our ISO 27001 audit checklist and ISO 22301 implementation roadmap.