ISO 19011:2026: ISO 19011:2026 – Tutorial (about 60 minutes)

ISO 19011 is the international guideline for auditing management systems: how to set up and run a programme of audits, how to plan and carry out a single audit, and how to make sure the people doing the auditing are competent. Internal auditors, supplier auditors, certification-body auditors, quality, environmental, safety and information-security managers all use it, whatever management system standard they audit against. After this tutorial you will be able to explain the principles of auditing, design a risk-based audit programme, run an audit from first contact to follow-up, write sound audit findings and judge what makes an auditor competent.

Free tutorial · about 60 minutes · 7 lessons · 4 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: The current edition is ISO 19011:2026, Guidelines for auditing management systems, the fourth edition. ISO's catalogue lists it as published (stage 60.60) on 27 May 2026, maintained by a group reporting to ISO's Technical Management Board (listed as ISO/TMBG), 46 pages long. It replaces ISO 19011:2018, which is now withdrawn. The revision project was approved in February 2024, the Draft International Standard was registered in January 2025 and the final draft in December 2025. Published summaries, such as the one by the Chartered Quality Institute (CQI | IRCA), describe it as a technical revision that updates and clarifies the existing guidance rather than changing its foundations, with particular attention to remote auditing and digital tools. The DIN Media summary of the European adoption (EN ISO 19011:2026) lists the main changes: remote-audit guidance expanded by bringing in content from ISO/IEC TS 17012, a new defined term for a remote audit method, the seven audit principles restructured, Annex A expanded on remote audits and virtual locations, more guidance on auditing supply chains, and an editorial revision. Because ISO 19011 is a guideline, not a requirements standard, nobody is certified to it and there is no formal transition period; the new edition applies from publication. Where this tutorial describes the detailed layout of the guidance, it follows the long-established structure of the previous edition, which the 2026 edition revises rather than rebuilds; check clause numbers in your own copy. Verified 2026-10-29.

Who this is for: people who are new to auditing and have been asked to become internal auditors, supplier auditors or audit programme managers; managers who will be audited and want to understand what an auditor is doing and why; and engineers, quality, environmental, safety and security professionals who want a common vocabulary for audits across different management system standards.

Prerequisites: none. It helps to know roughly what a management system is (for example one built on ISO 9001 for quality or ISO 14001 for the environment), but every term used here is explained when it first appears.

By the end of this tutorial:

You will be able to explain what ISO 19011 is for, who uses it and why it is guidance rather than a certifiable standard.
You will be able to define the core audit vocabulary, including audit criteria, audit evidence, audit findings and audit conclusions.
You will be able to describe the seven principles of auditing and recognise when one of them is being broken.
You will be able to outline how an audit programme is established, implemented, monitored, reviewed and improved on a risk basis.
You will be able to walk through the stages of a single audit, from initiating it to follow-up, including remote and hybrid methods.
You will be able to describe how auditor competence is defined, evaluated and maintained.
You will be able to place ISO 19011 next to ISO/IEC 17021-1, ISO/IEC 17024 and the management system standards that are audited.

Lesson 1 – Origins, purpose and scope

Why a guideline for auditing is needed

Every modern management system standard, whether for quality, the environment, occupational health and safety, information security, energy or business continuity, asks the organisation to audit itself at planned intervals. Customers audit their suppliers. Certification bodies audit organisations before issuing a certificate and keep auditing them afterwards.

Without a shared method, audits drift towards two failure modes. Some become box-ticking exercises that read checklists aloud and find nothing useful. Others become personal inspections that depend on the auditor's mood and opinions rather than on facts. Both waste time and destroy trust. ISO 19011 exists to give everyone who audits management systems one consistent, evidence-based way of working, regardless of which standard is being audited.

A short history

Before 2002, quality audits and environmental audits had separate guidance: the ISO 10011 series for quality systems and the ISO 14010 to 14012 series for environmental systems. As organisations began to run both systems together, auditing them separately made little sense, so ISO merged the guidance into the first edition of ISO 19011 in 2002. The 2011 edition widened the scope to auditing any management system, brought the idea of risk into audit programme management and added guidance on remote audit methods. The 2018 edition introduced a risk-based approach as a principle, broadened the guidance on audit programme risks and opportunities, and added material on topics such as auditing context, leadership, compliance and virtual locations. The 2026 edition, the fourth, continues that line. It absorbs the remote-auditing guidance of ISO/IEC TS 17012 and expands the guidance on digital evidence, supply chains and auditor skills, while keeping the seven principles.

What the guideline covers

ISO 19011 covers three connected topics. The first is the principles of auditing, the values and habits that make an audit trustworthy. The second is managing an audit programme, the set of audits an organisation plans over a period, typically a year. The third is conducting a management system audit, the individual audit with its planning, fieldwork and reporting. A further section, on the competence and evaluation of auditors, applies to everyone involved, and an annex gives practical tips for auditors, such as how to sample, interview or audit a process.

The guideline applies to all organisations that need to plan and conduct internal or external audits of management systems, or to manage an audit programme. It is written to be used by small organisations with one part-time auditor and by large certification bodies with hundreds of auditors. You apply it in proportion: a ten-person firm does not need an elaborate programme, but it still benefits from clear objectives, objective auditors and evidence-based findings.

Guidance, not requirements

One feature trips up beginners. ISO 19011 is written as guidance. Its text uses "should" (a recommendation) rather than "shall" (a requirement). No one can be certified to ISO 19011, and an organisation is not nonconforming because it has ignored part of it. It becomes binding only when another document makes it so, for example when a customer contract, a sector scheme or an internal procedure says that audits will follow it. Its authority comes from being the internationally agreed description of good audit practice, used as a reference by training courses, sector schemes and auditor certification bodies around the world.

It also helps to know what ISO 19011 does not cover. It does not set the requirements that certification bodies must meet; those are in ISO/IEC 17021-1, which you will meet in Lesson 7. It does not tell you what the audited organisation must do; that is the job of the management system standard being audited. And it does not replace the professional standards of financial or corporate internal audit, although the ideas overlap.

Lesson 2 – Key concepts and vocabulary

Auditing has a precise vocabulary. Many arguments between auditors and auditees come from using the same word for different things, so it is worth learning these terms carefully. The explanations below are paraphrased in plain language.

Audit – a planned check, carried out by people free from conflicts of interest and properly recorded, in which auditors gather facts and judge impartially how well the audit criteria are met. Three qualities matter: it is systematic (planned and methodical), independent (no one checks their own work) and documented (its plan, evidence and results are written down).
Management system – the set of interrelated policies, objectives, processes and responsibilities an organisation uses to achieve its goals in an area such as quality, environment or safety.
Audit criteria – the reference you compare evidence against: the requirements of a standard, the organisation's own policies and procedures, legal requirements, contracts or codes of practice. Without criteria there is nothing to audit against, only opinion.
Audit evidence – any record, factual statement or other information that is relevant to the criteria and that the auditor is able to confirm. An interview answer is information; once it is checked against a record or an observation, it becomes evidence.
Objective evidence – facts showing that something exists or is true, gained by looking, measuring, testing or similar means, not by belief or assumption.
Audit findings – the results of evaluating the evidence against the criteria. A finding can show conformity, nonconformity or an opportunity for improvement, and can also record good practice.
Nonconformity – the non-fulfilment of a requirement. Graded nonconformities (for example major and minor) are common in certification audits.
Audit conclusion – the overall outcome of an audit, reached by the audit team after considering the objectives and all the findings together, for example a statement about whether the system is effectively implemented.
Audit programme – the planned set of audits, with their purpose, timing and resources, that an organisation intends to carry out over a period. An annual internal audit schedule is a simple example.
Audit plan – the description of the activities and arrangements for one audit: what will be audited, by whom, when, where and how.
Audit scope – what the audit covers and where it stops: which sites, processes, activities, functions and period of time are included.
Audit objectives – what the audit is meant to achieve, such as checking conformity with a standard, evaluating the effectiveness of a process or assessing a supplier before awarding a contract.
Audit client – the organisation or person who requests the audit. Auditee – the organisation, or part of it, being audited. They can be the same, as in an internal audit, or different, as in a customer audit of a supplier.
Audit team – one or more auditors conducting an audit, supported if needed by technical experts, who provide specific knowledge but do not act as auditors. One auditor is appointed audit team leader.
Guide and observer – a guide is a person appointed by the auditee to assist the audit team; an observer accompanies the team but does not audit, for example a regulator, a trainee or a representative of the client.
Competence – being able to use what you know and can do to actually get the intended result. It is more than having attended a course.
Risk – in ISO terms, the effect of uncertainty on what you are trying to achieve. In ISO 19011 it appears twice: in the risks to the audit programme achieving its objectives, and in the risk-based approach to deciding what to audit and how deeply.

First, second and third party audits

Audits are often classified by who performs them. A first-party audit is an internal audit, carried out by or on behalf of the organisation itself. A second-party audit is carried out by someone with an interest in the organisation, most often a customer auditing a supplier. A third-party audit is carried out by an independent body, such as a certification body or a regulator. ISO 19011 gives guidance useful to all three, although third-party certification audits are also bound by the requirements of ISO/IEC 17021-1.

Combined and joint audits

A combined audit looks at two or more management systems of one auditee together, for example quality and environment in one visit. A joint audit is one auditee audited by two or more auditing organisations together, such as two customers sharing a supplier visit. Both save time, but they need careful planning so that each system or client gets enough attention.

Remote, on-site and hybrid audits

An on-site audit takes place at the auditee's physical location. A remote audit uses information and communication technology, such as video calls, screen sharing and shared document repositories, to gather evidence without being physically present. A hybrid audit mixes the two, for example a remote document review and interviews followed by a shorter site visit to observe operations. The 2026 edition adds a defined term for a remote audit method, meaning a way of gathering and evaluating audit evidence without the auditor being physically present. A virtual location is where work happens in an online environment rather than a physical place, such as a cloud-based system or a distributed team. The 2026 edition, according to published summaries, treats these methods as normal choices to be selected on the basis of risk, scope and the quality of evidence they can provide, not as exceptions.

Lesson 3 – Structure of the guideline

ISO 19011 follows the usual layout of an ISO document: scope, normative references and terms and definitions come first, followed by the guidance itself and an informative annex. The guidance builds up from values, through the management of many audits, down to the conduct of one audit, and finishes with the people who do the auditing. In the 2018 edition this was clause 4 (principles), clause 5 (managing an audit programme), clause 6 (conducting an audit), clause 7 (competence and evaluation of auditors) and Annex A (additional guidance for auditors). The 2026 edition is described as an evolutionary update of the same design.

Figure 1 – How the parts of ISO 19011 fit together: principles underpin everything, the programme drives individual audits, and competence and practical guidance support both.

Principles of auditing

The principles are what make an audit a reliable tool for management decisions rather than a ritual. ISO 19011 describes seven, and summaries of the 2026 edition report that they are retained:

Integrity – the basis of being a professional auditor: auditors work honestly, diligently and responsibly, follow legal requirements, show competence, act impartially and resist pressure that could affect their judgement.
Fair presentation – telling the truth in reporting. Findings, conclusions and reports reflect what was actually found, including significant obstacles met during the audit and unresolved disagreements with the auditee.
Due professional care – auditors take care and use sound judgement in proportion to the importance of the task and the confidence the audit client places in them.
Confidentiality – auditors protect the information they obtain, do not use it for personal gain and handle sensitive information properly.
Independence – what makes impartial, objective conclusions possible. Auditors should be independent of the activity being audited where practicable and free from bias and conflicts of interest. In small organisations full independence may be impossible, but auditors should still not audit their own work.
Evidence-based approach – conclusions rest on facts that can be checked, gathered in a methodical way, so that another competent auditor would reach the same result. Because audits have limited time and resources, evidence is usually based on samples, so sampling must be appropriate to the confidence needed.
Risk-based approach – auditors take risks and opportunities into account in planning, doing and reporting audits, so that effort goes to the matters that are significant for the audit client and for achieving the audit programme's objectives.

Managing an audit programme

This part addresses the person or team responsible for a set of audits. It explains how to set the programme's objectives, determine and evaluate the risks and opportunities affecting it, establish it (roles, extent, resources), implement it (deciding objectives, scope, criteria and methods for each audit, selecting teams, assigning a team leader, managing results and records), monitor it and review and improve it. Lesson 4 covers this in detail.

Conducting an audit

This part addresses the audit team leader and team. It runs in a logical sequence: initiating the audit, preparing audit activities, conducting audit activities (opening meeting, communication, reviewing documented information, collecting and verifying information, generating findings, determining conclusions, closing meeting), preparing and distributing the report, completing the audit and conducting follow-up if it is part of the agreed scope.

Competence and evaluation of auditors

This part explains how to decide what competence auditors and audit team leaders need, how to set evaluation criteria, how to choose and apply evaluation methods, and how auditors maintain and improve their competence over time. It also covers the competence of the person managing the audit programme.

The annex of practical guidance

The informative annex is a toolbox for auditors. It covers topics such as choosing audit methods (with or without human interaction, on-site or remote), applying the process approach to auditing, using professional judgement, sampling, auditing legal compliance, context, leadership, risks and opportunities, life-cycle and supply-chain considerations, preparing work documents, interviewing people, auditing virtual activities and locations, and writing findings.

Lesson 4 – How it works in practice

Managing the audit programme as a cycle

An audit programme is managed with the same Plan-Do-Check-Act logic as the management systems it audits. The individual managing the audit programme, sometimes called the audit programme manager, does not need to perform audits personally but must understand audit principles, methods, the management system standards involved, the auditee's context and the risks to the programme.

Figure 2 – The audit programme runs as a Plan-Do-Check-Act cycle, and the review of one cycle sets the objectives of the next.

Plan: objectives

Programme objectives say why the organisation is auditing. Typical objectives include confirming conformity with ISO 9001 before a certification visit, checking that legal requirements are met, evaluating supplier capability, finding opportunities to improve a process, or giving top management confidence that a new system is working. Objectives should take into account the needs and expectations of interested parties, the organisation's strategic direction, the characteristics and risks of the processes, the level of performance and maturity of the system, and the results of previous audits.

Plan: risks and opportunities for the programme

The programme itself can fail. Common risks are poor planning (for example too little time for complex processes), insufficient or unsuitable resources, auditors without the right competence, bad communication with auditees, unavailable people or records, and poor follow-up of findings. Opportunities might include combining audits to reduce disruption, using remote methods to reach distant sites cheaply, or aligning audit dates with the organisation's planning cycle. The programme manager identifies these and plans how to deal with them.

Plan: establishing the programme

Establishing the programme means deciding roles and responsibilities, the competence needed, the extent of the programme (how many audits, how long, how often, which sites and processes) and the resources: auditors, technical experts, time, travel, tools and technology. Frequency and depth should follow risk. A process that has caused customer complaints, changed significantly or has never been audited deserves more attention than one that is stable and well controlled.

Do: implementing the programme

For each audit, the programme manager defines its objectives, scope and criteria, chooses the audit methods, selects the audit team members and appoints a team leader, and then communicates with the auditee and the team. When the audit is done, the programme manager makes sure the report is reviewed and distributed, that findings are acted on when required, and that records are kept. Records typically include the programme itself, audit plans and reports, nonconformity reports, corrective action and follow-up records, and evidence of auditor competence and evaluation.

Selecting audit methods

Choosing the audit method is now a central planning decision. ISO 19011 has long organised methods along two dimensions: whether there is human interaction (interviews, observation with the auditee present) or not (reviewing records, analysing data), and whether the auditor is on-site or remote. A remote interview by video call, an on-site walk through a warehouse, a remote analysis of exported records and an on-site check of calibration labels are all different methods. Published summaries of the 2026 edition stress choosing among on-site, remote and hybrid methods according to risk, scope and the quality of evidence each can provide, not according to habit or cost alone. Practical points include whether the auditee's technology is reliable, whether information security and privacy can be protected during screen sharing, whether a physical process can be properly observed through a camera, and how the auditor will verify that a document shown on screen is the current, genuine version.

Check and Act: monitoring and reviewing

The programme manager monitors whether audits happen as planned, whether objectives are being met, how auditors perform and what feedback auditees and the audit client give. Periodically the programme is reviewed as a whole: did it achieve its objectives, were the risks handled, did findings lead to real improvement, do methods and competence need updating? The output of the review goes to top management and shapes the next programme.

Conducting a single audit

Once the programme has defined an audit, the audit team leader takes responsibility for running it. The sequence below is the backbone of every audit, from a two-hour internal process audit to a week-long multi-site certification audit; the depth changes, the logic does not.

Figure 3 – The stages of conducting one audit, from first contact with the auditee to follow-up of agreed actions.

Initiating the audit

The team leader makes first contact with the auditee to confirm the audit's objectives, scope, criteria and methods, agree dates and logistics, request access to documented information, discuss any safety, security or confidentiality arrangements, and confirm whether guides or observers will be present. The leader also checks feasibility: is there enough information, enough cooperation from the auditee, and enough time and resources to meet the objectives? If not, the leader raises it with the programme manager before the audit starts, not after.

Preparing audit activities

Preparation starts with reviewing the auditee's relevant documented information, such as policies, process descriptions, previous audit reports and performance data. This helps the team understand the system, spot gaps early and decide where to focus. The team leader then writes the audit plan, using a risk-based approach: more time for processes that are critical, changing or performing poorly, less for stable, low-risk areas. The plan covers objectives, scope, criteria, locations (physical and virtual), dates and times, methods, team roles and arrangements for guides. Work is then assigned to team members, and they prepare work documents such as checklists, sampling plans and forms for recording evidence. A good checklist is a memory aid, not a script; it should never stop an auditor from following an important trail.

Conducting audit activities

The opening meeting confirms the plan with the auditee, introduces the team, explains how findings will be reported and graded, and agrees communication channels. It can be informal in a small internal audit.

The heart of the audit is collecting and verifying information. Auditors gather information by interviewing people, observing activities, reviewing records and examining products, systems and data. They follow the work as it really happens, often tracing a single order, change or incident through several processes to see how they connect; this is called the process approach to auditing. Only information that can be verified becomes audit evidence. Because time is limited, auditors use sampling: either judgement-based sampling, where the auditor's knowledge and the risk picture determine what to look at, or statistical sampling, where items are selected by a defined statistical method so that conclusions can be stated with a known confidence.

Figure 4 – From information to conclusions: only verified information becomes evidence, findings come from comparing evidence with criteria, and conclusions weigh all findings against the audit objectives.

When generating findings, the team compares evidence with criteria. A nonconformity statement should be clear and supported: it names the requirement, states what was observed and points to the evidence, so that the auditee can understand it and fix the cause. Findings are reviewed with the auditee so that the facts are understood; disagreements are recorded rather than hidden. Before the closing meeting the team meets privately to review all findings, agree the audit conclusions against the objectives, and consider any recommendations if these are within the agreed scope.

The closing meeting presents findings and conclusions to the auditee's management in a way they can understand and accept. It explains that audit evidence is based on samples, discusses timeframes for corrective action if these are expected, and records any divergent opinions that could not be resolved.

Reporting, completion and follow-up

The audit report gives a complete, accurate, concise and clear record of the audit: objectives, scope, criteria, client, team, dates and locations, methods, findings and evidence, conclusions and any obstacles that affected the reliability of the results. It is distributed to the recipients defined in the audit programme or audit plan, and confidentiality applies. The audit is completed when all planned activities are done and the report is issued; documents are kept or disposed of as agreed. Follow-up, when it is part of the audit or programme, verifies that the auditee has taken the actions it committed to and that they were effective. The auditee owns the corrections and corrective actions; the auditor checks them but does not design them, because auditing your own solutions would undermine independence.

Lesson 5 – Assessment, certification and competence

No certification to ISO 19011

It bears repeating: organisations cannot be certified to ISO 19011, and a certificate that claims otherwise is meaningless. ISO's own catalogue entry makes the point that using the guideline does not lead to certification on its own; it supports audits against certifiable standards such as ISO 9001 and ISO 14001. What can be assessed is how well an audit or an audit programme follows the guidance. An organisation's certification body will look at whether its internal audit programme meets the internal-audit clause of the management system standard (clause 9.2 in standards built on the ISO Harmonized Structure), and many organisations use ISO 19011 to design that programme.

Where formal assessment does happen

Three forms of formal assessment surround ISO 19011:

Certification bodies that audit and certify management systems are accredited against ISO/IEC 17021-1, which sets binding requirements for their impartiality, competence and audit process. Its audit process is consistent with the ISO 19011 approach, but it is ISO/IEC 17021-1, not ISO 19011, that accreditation bodies assess against. The International Accreditation Forum (IAF) also publishes mandatory documents for accredited certification, including one on the use of information and communication technology for auditing.
Auditor certification is offered by personnel certification bodies, such as CQI | IRCA and Exemplar Global, which register individual auditors at grades such as internal auditor, auditor and lead auditor. Such bodies may be accredited against ISO/IEC 17024. Their training courses are typically based on ISO 19011 for audit technique and on the relevant management system standard for content.
Auditor evaluation inside organisations – any organisation running an audit programme should evaluate its auditors against criteria it has set, which is exactly what ISO 19011's competence guidance describes.

Determining auditor competence

ISO 19011 treats competence as a combination of personal behaviour, knowledge and skills, acquired through education, work experience, auditor training and audit experience. When deciding the competence needed, the programme manager considers the size and complexity of the audits, the methods used (including remote methods), the management system disciplines, the sector and the risks.

Personal behaviour comes first because it is the hardest to train. The guideline describes desirable qualities such as being ethical, open-minded, diplomatic, observant, perceptive, versatile, tenacious, decisive, self-reliant, able to act with fortitude, open to improvement, culturally sensitive and collaborative. An auditor who is technically brilliant but cannot listen, or who gives in under pressure from a senior manager, will not produce reliable findings.

Knowledge and skills fall into broad groups. Generic knowledge and skills apply to every auditor: audit principles, processes and methods, the relevant management system standards and reference documents, the organisation and its context, and applicable legal requirements. Discipline and sector-specific knowledge covers, for example, environmental aspects for an environmental auditor or information security risks for a security auditor. Audit team leaders also need to plan audits, lead and communicate with teams, manage conflict, prevent and resolve problems, and present conclusions. The 2026 edition, according to published summaries, adds emphasis on digital skills, such as working with online systems and digital evidence, and on communicating effectively during remote audits.

Evaluating auditors

Evaluation should be planned, documented and repeated, not a one-off check at appointment. The process has four parts: define the criteria (what competence is needed for each role), select evaluation methods, conduct the evaluation, and use the results to decide on appointment, development or further training. Useful methods include reviewing records of education, training and audit experience; collecting positive and negative feedback from auditees and team members; interviewing the auditor; observing them during a real audit, often called a witnessed audit; testing knowledge; and reviewing their audit reports after the event. Combining methods gives a fairer picture than any one alone.

Maintaining and improving competence

Competence fades if it is not used. Auditors maintain it through regular audit practice and continual professional development, such as training on revised standards, learning new audit technologies, studying the sector, and receiving and acting on feedback. The programme manager should periodically re-evaluate auditors, especially when standards change, as many did in 2026 with new editions of ISO 9001 and ISO 14001.

Lesson 6 – Worked example

To see how the pieces fit, follow a fictional but realistic organisation through one audit year.

The organisation

Harbourline Components makes metal and plastic parts for agricultural machinery. It has 320 people at two factories, a small warehouse, and a design team of eight engineers who work mostly from home using a cloud-based product data system. It runs one integrated management system certified to ISO 9001 and ISO 14001 and is preparing to add ISO 45001 for occupational health and safety. It has six trained part-time internal auditors and a quality and environment manager, Priya, who is appointed to manage the internal audit programme.

Step 1 – Setting programme objectives

Priya meets the managing director and agrees four objectives for the year: confirm that the integrated system conforms to ISO 9001 and ISO 14001 and the company's own procedures; check that the new health and safety arrangements are ready for an ISO 45001 certification audit within nine months; evaluate the three suppliers of surface treatment, which caused two customer complaints last year; and identify improvements in the engineering change process, where late changes have caused scrap.

Step 2 – Risks and opportunities for the programme

Priya lists what could stop the programme succeeding. Only two auditors know the plastics moulding process well. The design team is rarely in the office. Production peaks in spring, when people will not be available. Previous audit reports had vague findings that were never closed. As opportunities, she notes that combined audits could cover quality, environment and safety in one visit, and that remote methods could reach the design team and one distant supplier cheaply.

Step 3 – Establishing the programme

She builds a twelve-month programme. High-risk processes, namely engineering change, surface treatment purchasing and the new safety processes, are audited twice; stable processes such as document control once. Spring is kept free of large audits. Each audit is a combined audit of all three disciplines where the process touches them. She books a moulding specialist from the parent company as a technical expert for the moulding audit, and budgets time for two auditors to attend a refresher course on the 2026 editions of ISO 9001 and ISO 14001.

Step 4 – Defining one audit

Take the engineering change audit in March. Priya defines its objective: evaluate whether engineering changes are controlled and communicated so that production uses the right revision. Scope: the change process from request to release, at both factories and in the cloud-based product data system, covering the last six months. Criteria: the relevant ISO 9001 requirements on design changes and control of changes, the company's change procedure and the customer's contractual requirement to notify changes. Method: hybrid, with a remote review of change records and remote interviews with two design engineers, followed by an on-site day at the main factory. Team: Tom, an experienced internal auditor from logistics, as team leader, and Ana, a trainee auditor from finance. Neither works in engineering, so independence is protected.

Step 5 – Preparing

Tom contacts the engineering manager, confirms dates, and asks for read access to the product data system and the change procedure. He checks feasibility: the engineers can join video calls, but the screen-sharing tool must not expose customer drawings outside the company, so the IT team sets up a secure session. Reviewing the documented information, Tom finds that the procedure was updated in January and that the system tracks 64 changes in the period. He writes an audit plan with two hours for remote interviews, three hours on the shop floor and an hour for the team to review findings. He decides on a judgement-based sample: ten changes, weighted towards urgent ones and those affecting customer-visible features, because that is where the complaints came from.

Step 6 – Conducting the audit

The remote session begins with a short opening meeting. In interviews, the design engineers explain the process confidently. Tom asks them to share their screens and walk through three of the sampled changes in the live system rather than describing them, so that the information can be verified. Two of the three show full approval records. One urgent change was released by email before approval was recorded. On site the next week, Ana traces all ten sampled changes to the shop floor. At one moulding press she finds an operator using a printed drawing one revision behind the current one; the change record shows that the factory was notified, but no one removed the old print.

Step 7 – Findings and conclusions

The team writes two findings. The first is a nonconformity: the company's procedure requires approval before release, but one of ten sampled urgent changes was released by email before approval, as shown in the change record and the email trail. The second is a nonconformity: superseded documents were not prevented from unintended use, as shown by the outdated drawing at press 4 against the current revision in the system. They also record an opportunity for improvement: the system could automatically flag printed copies when a revision is released. They note good practice too: change requests are well described and risk-assessed. The conclusion, against the objective, is that the change process is designed well and mostly followed, but controls weaken under time pressure and at the point of use.

At the closing meeting, the engineering and production managers accept both findings. The production manager first argues that the old drawing was "just a spare", but Tom shows the photograph taken with permission and the note of the operator's statement, and the fact is accepted. Tom reminds everyone that the audit sampled ten of 64 changes, so other cases could exist.

Step 8 – Report, follow-up and programme review

Tom issues the report within a week. The managers analyse the causes and decide on actions: a release step that cannot be completed without recorded approval, and a weekly check that removes superseded prints. Priya schedules a follow-up in June, where an auditor verifies that the system change is live and samples five new changes, all compliant. Priya also evaluates the auditors: she reviews Ana's notes and Tom's feedback and decides Ana can lead a small audit in autumn under observation. At year end she reviews the whole programme with the managing director. Most objectives were met, the supplier audits showed one supplier needed development, and remote interviews with the design team worked well. For the next year she changes the frequency of engineering change audits to once, because of the improvement, and adds an audit of the cloud system's access controls, which emerged as a new risk.

Lesson 7 – Relationship to other standards and frameworks

ISO 19011 sits in a family of documents that together make management system auditing work. Knowing who does what avoids common confusion, for example believing that a certification body is "certified to ISO 19011" or that an internal audit must follow ISO/IEC 17021-1.

Standard or framework	What it is	Relationship to ISO 19011
ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001 and other management system standards	Requirements standards that organisations implement and can be certified to	They require internal audits (clause 9.2 in the Harmonized Structure) and are the most common audit criteria; ISO 19011 explains how to audit against them.
ISO/IEC 17021-1	Requirements for bodies providing audit and certification of management systems	Binding for accredited certification bodies; its audit process is aligned with ISO 19011 but adds requirements on impartiality, audit time, certification decisions and surveillance.
ISO/IEC 17024	Requirements for bodies certifying persons	Used by bodies that certify auditors as competent; their schemes draw on ISO 19011 competence guidance.
ISO/IEC 27007	Guidelines for auditing information security management systems	Adds information-security-specific guidance on top of ISO 19011 for ISO/IEC 27001 audits.
ISO/IEC 17000	Vocabulary and general principles of conformity assessment	Defines the wider conformity assessment terms (certification, accreditation, attestation) in which audits sit.
IIA Global Internal Audit Standards	Professional standards for the internal audit function, issued by the Institute of Internal Auditors	Cover risk, governance and control auditing across the whole organisation; overlap with ISO 19011 on independence, evidence and reporting, but serve a different profession.
ISO/IEC TS 17012	Technical specification (2024) giving guidelines for using remote auditing methods in management system audits	Its content was brought into the 2026 edition of ISO 19011, so ISO 19011 now carries the main remote-audit guidance itself.
IAF mandatory documents	Rules set by the International Accreditation Forum for accredited certification	Include binding rules on using information and communication technology in audits, which complement ISO 19011's remote audit guidance for certification bodies.

Sector and discipline guidance

Many sectors build their own audit guidance on ISO 19011 rather than repeating it. Automotive process audit schemes and cybersecurity management system audit guidance, for example, refer to it for the general audit process and add sector content. The ISO 9001 Auditing Practices Group, an informal group of experts from ISO/TC 176 and the IAF, publishes free papers on practical auditing topics such as audit planning, evidence collection and remote audits, which are a useful companion to the guideline.

Common pitfalls and best practices

Common pitfalls

Checklist auditing – reading out a list of questions taken from the standard instead of following how work actually flows; the audit finds paperwork gaps and misses real risks.
Same programme every year – auditing every process with the same frequency and depth regardless of risk, changes or past performance.
Auditing your own work – a process owner auditing their own area, which breaks independence and rarely uncovers uncomfortable facts.
Findings without evidence – vague statements such as "training is weak" that name no requirement and point to no verifiable record, so the auditee cannot act and may rightly reject them.
Accepting statements as evidence – recording what someone says without checking it against records or observation.
Remote by default – choosing remote audits only to save money, even where physical processes cannot be observed properly or documents cannot be verified on screen.
Auditor as consultant – the auditor designing the corrective action and then auditing it later, which compromises objectivity.
No follow-up or programme review – findings are issued and forgotten, and the programme never learns from its own results.

Best practices

Start from objectives and risk – write clear programme and audit objectives, then let risk decide where to spend audit time.
Follow the work – trace real transactions, orders, changes or incidents across processes and interfaces; that is where systems fail.
Verify, then write – confirm information through a second source before treating it as evidence, and write every nonconformity with requirement, observation and evidence.
Choose methods deliberately – decide between on-site, remote and hybrid methods based on what evidence is needed, and plan security and verification for remote sessions.
Protect independence and confidentiality – assign auditors who are not responsible for the area, and handle the auditee's information carefully.
Report fairly – include good practice and obstacles as well as nonconformities, and record disagreements honestly.
Develop auditors continuously – evaluate them with several methods, use witnessed audits for trainees, and refresh their knowledge when standards and technology change.
Close the loop – follow up actions, review the programme each cycle and report its effectiveness to top management.

Summary and key takeaways

ISO 19011:2026, the fourth edition published in May 2026, is the international guideline for auditing any management system; it replaces the 2018 edition and is guidance, so nobody is certified to it.
An audit is a systematic, independent and documented process: verified evidence is compared with defined criteria to produce findings, and findings are weighed against objectives to reach conclusions.
Seven principles underpin audits: integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach.
An audit programme is managed as a Plan-Do-Check-Act cycle: objectives, risks and opportunities, establishment, implementation, monitoring, and review and improvement.
A single audit runs from initiation and feasibility, through preparation and a risk-based plan, to evidence collection, findings, conclusions, reporting, completion and, where agreed, follow-up.
On-site, remote and hybrid methods are all legitimate; the 2026 edition stresses choosing among them on the basis of risk, scope and the quality of evidence.
Auditor competence combines personal behaviour, knowledge and skills, and is evaluated with several methods and maintained through practice and development.
ISO/IEC 17021-1 binds certification bodies, ISO/IEC 17024 governs auditor certification bodies, and management system standards supply the criteria; ISO 19011 is the shared method underneath.

Reflection questions

Think of a process in your organisation that has changed in the last year. How would you adjust the frequency, depth and method of auditing it, and why?
Your organisation has only three people. How could you still protect the independence of internal audits in practice?
Pick a remote audit you have attended or can imagine. Which evidence could be verified well remotely, and which would need someone on site?
Rewrite a vague finding you have seen, such as "document control needs improvement", so that it names a requirement, an observation and verifiable evidence.
Which personal behaviours from the competence guidance do you find hardest in yourself, and how would you develop them before leading an audit?