ISO 19011:2026: What Changed in the Auditing Guidelines
ISO 19011:2026 was published on 27 May 2026. Six changes auditors and audit programme managers will notice, what stayed the same and what to update now.
Eren İŞMAN · Lead Trainer, MEGADEMİ
Türkçe okuISO 19011:2026 is the fourth edition of Guidelines for auditing management systems. It is the international guidance on planning audit programmes, conducting audits and evaluating auditors for any management system standard, from ISO 9001 to ISO 27001. ISO published it on 27 May 2026, and it replaces ISO 19011:2018, which is now withdrawn (ISO). The structure is the same. The main changes are wider guidance on remote auditing methods, a stronger risk focus in audit programmes, and new expectations on auditor competence in technology and information security.
This guide is for auditors, internal audit leads and people who manage audit programmes. It sets out six changes you will notice, what stayed the same, and what to update in your own procedures and training.
Photographs in this article are illustrative and AI-generated; the diagram is an original MEGADEMİ graphic.
Key takeaways
- Published: ISO 19011:2026, edition 4, was published on 27 May 2026 and withdraws the 2018 edition (ISO).
- Still guidance: ISO 19011 gives recommendations, not certifiable requirements. Because it is guidance, it carries no certification transition deadline, so audit functions and training providers update to it on their own schedule.
- Biggest change: expanded guidance on remote auditing methods, including a new defined term and more Annex A material on remote methods and virtual locations.
- Audit programme: risks and opportunities should now be determined, not just considered, and programme design should consider climate change and the auditee's use of digital tools.
- Auditors: competence now explicitly covers the auditing methods used, emerging technology and information security, including privacy.
What is ISO 19011?
ISO 19011 is the international guideline for auditing management systems. It covers the principles of auditing, managing an audit programme, conducting individual audits, and evaluating the competence of the people involved. It applies to first-party (internal), second-party (supplier) and third-party audits (ISO). Accredited certification bodies must also meet ISO/IEC 17021-1, which sets the requirements for certification audits.
Because it is a guideline, an organization cannot be certified to ISO 19011. Its value is as the shared reference for good auditing practice. Lead auditor and internal auditor courses commonly teach audit technique against it, so a new edition changes what trainees learn and what experienced auditors are expected to know.
ISO 19011:2026 keeps the seven principles of auditing: integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach.
What changed in ISO 19011:2026? The six main changes
The Chartered Quality Institute describes the fourth edition as "evolutionary not revolutionary" (CQI | IRCA). ISO's technical committee for quality management highlights the growing impact of technology, digitization and virtual environments, and an increased focus on risk analysis and mitigation (ISO/TC 176). The changes below are summarized from the CQI's clause-by-clause review.
1. Remote auditing methods are expanded
The Foreword names the expansion of guidance on remote auditing methods as one of the most significant changes. It draws on ISO/IEC TS 17012:2024, the technical specification on remote auditing methods. Clause 3 adds a new defined term, remote auditing method (3.4), which renumbers the terms that follow. Annex A is expanded with guidance on remote methods and virtual locations (CQI | IRCA).
For auditors, this means a remote or hybrid audit is a planned method choice, not a fallback. The programme manager should weigh the relative impact of each auditing method on the organization, and Annex A gives examples (CQI | IRCA).
2. Two principles are reworded
The seven principles keep their meaning but are reformatted. Two changes matter in practice:
- Independence. The 2018 sentence saying internal auditors should be independent of the function audited "if practicable" is removed. The 2018 text already asked smaller organizations to remove bias and encourage objectivity where full independence was not possible; according to the CQI, the 2026 text now states this as the general approach whenever independence is not possible.
- Risk-based approach. The principle now applies to planning and implementing the audit programme, not only to planning, conducting and reporting individual audits (CQI | IRCA).
3. Audit programmes should determine risks, including new ones
Clause 5 makes the programme manager's risk work more explicit. Risks and opportunities to the audit programme should now be determined, which means reviewing evidence and reaching a conclusion, not just considering them. The scope of the management system becomes an input to the extent of the programme (CQI | IRCA).
The examples of programme risk are longer. They now include:
- a lack of auditor independence or impartiality;
- unsuitable auditing methods, or audits not conducted as programmed;
- undue influence on how the programme is delivered;
- a lack of top management sponsorship;
- auditees or audit evidence being unavailable;
- auditing methods that rely on unsecured or ineffective IT tools.
Programme design should also consider whether climate change is a relevant issue for the auditee and how the auditee uses technology or digital tools. The programme should set criteria for observers where relevant, and reports go to "previously determined parties" rather than "relevant interested parties" (CQI | IRCA).
4. Nonconformity grading criteria should be defined and communicated
Clause 6 adds that when nonconformities are graded, the auditing organization should define and communicate the criteria it uses. A new paragraph covers the specific risks of joint audits. Significant risks found during an audit, and audit objectives that cannot be achieved, should be reported to the person managing the audit programme as well as to the audit client and the auditee. In Annex A, A.18 adds that the reason the audit criteria were not met should be recorded when a nonconformity is raised (CQI | IRCA).
If your audit procedure says "major" and "minor" without defining them, or your reports state only the requirement and not why it was not met, this is the change to act on first.
5. Auditor competence covers technology and information security
Clause 7 widens what to consider when selecting an auditor for a specific audit. It now covers:
- knowledge and skills in the auditing methods that will be used;
- an understanding of the consequences and appropriateness of emerging technology used in audits;
- the ability to audit processes based on emerging technology;
- an understanding of information security, including privacy.
Programme managers are advised to consider feedback from auditees and other stakeholders when evaluating auditor performance (CQI | IRCA).
6. Terms and Annex A are updated
Smaller wording changes will still show up in audit reports and templates. "Outcome of an audit" becomes "result of an audit", and the definition of observer now makes clear that technical experts are not observers. In Annex A, the most substantive changes are in A.12, with new text on second-party audits, and in A.15 and A.16, where text has been moved, reordered and extended (CQI | IRCA).
What stayed the same?
The fourth edition keeps the overall structure of the 2018 edition: principles in clause 4, managing an audit programme in clause 5, conducting an audit in clause 6, competence and evaluation in clause 7, and additional guidance in Annex A. The seven principles are largely unchanged in substance. The standard is still a guideline that you apply in proportion to the size and complexity of your audit programme.
| Topic | ISO 19011:2018 | ISO 19011:2026 |
|---|---|---|
| Edition and date | 3rd edition, July 2018 | 4th edition, 27 May 2026 |
| Remote auditing | Brief guidance, mainly in Annex A | Defined term (3.4) and expanded Annex A guidance aligned with ISO/IEC TS 17012:2024 |
| Independence of internal auditors | Independent of the function audited "if practicable"; bias guidance framed for smaller organizations | "If practicable" sentence removed; remove bias and encourage objectivity wherever independence is not possible |
| Programme risks | Considered | Determined, with longer list of examples |
| Nonconformity grading | Grading allowed; criteria not specified | Grading criteria defined and communicated |
| Auditor competence | Discipline and sector knowledge, generic skills | Adds auditing methods, emerging technology and information security, including privacy |
| Status | Withdrawn | Current |
Example: grading criteria you can adapt
Step 3 below asks you to write down your grading criteria. The table is a starting template, not text from ISO 19011. The major and minor definitions follow ISO/IEC 17021-1, which certification bodies apply (ISO); the observation row and the example evidence are our own suggested wording.
| Grade | When to use it | Example evidence |
|---|---|---|
| Major nonconformity | The nonconformity affects the capability of the management system to achieve its intended results | No internal audit was held for a whole process during the programme year |
| Minor nonconformity | The nonconformity does not affect that capability | One calibration record is missing from an otherwise controlled equipment list |
| Observation | No requirement is breached, but a risk or improvement point is worth recording | Audit checklists still reference a withdrawn edition of a standard |
Share the table with auditees before the audit; the 2026 edition expects the criteria to be defined and communicated whenever findings are graded (CQI | IRCA).
Templates: remote-audit risk check and updated audit plan
The two tables below are our own starting templates, not text from ISO 19011. They turn the 2026 changes on auditing methods, programme risks and information security into working documents (CQI | IRCA).
| Risk to the audit | Question to answer | Typical control |
|---|---|---|
| Unsecured or unstable IT tool | Has the auditee's IT or security function approved the platform? | Agree the tool in advance and run a connection test |
| Evidence authenticity | Can records be shown live from the source system? | Ask for screen sharing from the live system, not files sent in advance |
| Limited visibility of operations | Can the process be observed on camera? | Plan a guided video walk-through; switch to on-site if a critical process cannot be seen |
| Confidentiality and privacy | Are recordings and screenshots allowed? | Agree recording rules and exclude personal data from screenshots |
| Auditee availability | Are interviewees available in the planned time slots and time zones? | Schedule with buffers and a backup contact |
Record the decision for each activity: remote, hybrid or on-site, and the reason.
| Plan item | What to record |
|---|---|
| Objectives, scope and criteria | Processes, sites and shifts in scope; standard editions and internal procedures used as criteria |
| Method per activity | On-site, remote or hybrid, with the IT tool and the outcome of the remote-audit risk check |
| Grading criteria | Reference to the major, minor and observation definitions shared with the auditee |
| Team and roles | Auditors, technical experts and observers, with the criteria for observers to take part |
| Information security | How documents and recordings are shared, stored and deleted |
| Risks to the audit | Significant risks and how they will be reported to the programme manager |
| Report distribution | The previously determined parties who receive the report |
What should auditors and programme managers do now?
Because ISO 19011 is guidance that no one is certified against, there is no certification transition period, so the practical question is when your own documents and training catch up. A five-step update covers most audit functions:
- Get the standard. Buy ISO 19011:2026 from ISO or your national standards body and compare it with your audit procedure. The CQI notes there are changes beyond those in its summary (CQI | IRCA).
- Update the audit programme. Record how you determine programme risks and opportunities, and check that your risk register covers the expanded examples, including the new ones on unsecured IT tools, top management sponsorship and undue influence.
- Define your grading criteria. Write down what makes a nonconformity major or minor and share it with auditees before the audit.
- Set rules for remote audits. Decide when remote or hybrid methods are acceptable, which IT tools are secure enough, and how evidence is captured and retained.
- Close competence gaps. Check each auditor against the new expectations on auditing methods, emerging technology and information security, and plan refresher training where needed.
For certification body auditors, ISO 19011 sits alongside ISO/IEC 17021-1 and the accreditation and scheme rules that apply to them. Check with your certification body or personnel certification body which edition they reference in their own procedures.
ISO 19011 auditor training at MEGADEMİ
If you run or take part in internal audits, the ISO 19011 auditor training covers programme management, audit methods and reporting across management system standards; the course page lists the edition it follows. For third-party audit technique, see the lead auditor training hub. For internal audit teams, the internal auditor training hub lists courses by standard.
If you are also preparing for the new quality standard, our guide to ISO 9001:2026 changes for auditors summarizes the ISO 9001:2026 transition timeline.
Frequently asked questions
When was ISO 19011:2026 published?
ISO published ISO 19011:2026, the fourth edition, on 27 May 2026. It replaced ISO 19011:2018, which ISO lists as withdrawn (ISO).
Is ISO 19011:2018 still valid?
ISO has withdrawn it, so it is no longer the current edition. Because ISO 19011 is guidance, nothing becomes invalid overnight, but audit procedures and courses that cite the 2018 edition should be updated to the 2026 edition.
Can an organization be certified to ISO 19011?
No. ISO 19011 is a guideline, not a requirements standard. Organizations use it to run audit programmes, and auditors are trained against it, but there is no ISO 19011 certificate for organizations.
What is the difference between ISO 19011 and ISO/IEC 17021-1?
ISO 19011 gives guidance for all types of management system audits. ISO/IEC 17021-1 sets requirements for bodies that certify management systems, including how they plan and conduct certification audits. Certification body auditors work to ISO/IEC 17021-1 and use ISO 19011 as guidance on audit technique.
Summary
ISO 19011:2026 keeps the familiar audit process but raises expectations in four places: remote methods are planned choices, programme risks are determined and documented, nonconformity grading criteria are defined and shared, and auditors are expected to understand technology and information security. Because it is guidance, there is no certification deadline; start with the grading criteria and the remote-audit rules, then update your audit plan template and auditor competence records.
About this guide
- Author: Eren İŞMAN, Lead Trainer, MEGADEMİ; mechanical engineer and lead auditor with more than 25 years of experience.
- Method: prepared with AI assistance; the photo-style images, including the cover, are AI-generated and illustrative. The publication date and status were checked on iso.org; the clause-level changes are summarized from the CQI | IRCA review of the fourth edition, because the standard itself is copyrighted. Read the published standard for the exact wording. Last reviewed: 20 October 2026.
- Disclosure: MEGADEMİ provides ISO auditor training, including the courses mentioned in this article.
- Editorial standards and corrections: we cite ISO and named secondary sources only, mark templates and examples as our own, and update this guide when ISO publishes changes. Send corrections or questions through our contact page.
Sources
- ISO 19011:2026 Guidelines for auditing management systems, ISO, edition 4, published 27 May 2026.
- ISO 19011:2018 Guidelines for auditing management systems, ISO, edition 3, withdrawn.
- Revision of ISO 19011: what you need to know, CQI | IRCA Knowledge Hub, 2026.
- ISO 19011:2026 Released!, ISO/TC 176, 2026.