The short version
An ISRC identifies a specific sound recording. A UPC identifies the commercial release package that contains one or more recordings. A single can therefore have a UPC for the release and an ISRC for the track. An album has one UPC and multiple ISRCs — one for each recording.
When an ISRC should stay the same
If you move the exact same recording between distributors, keeping the existing ISRC helps stores recognize that it is the same recording. If you create a genuinely different recording — for example a new live version or materially different master — it may require a different identifier.
Why UPCs can change
A UPC belongs to the release package. A new edition, a different track list or another commercial configuration can be a different release even when some recordings are reused. That is why UPC and ISRC should be treated as separate layers of catalog identity.