ISO 19011:2026: What Has Changed for Internal Audits, Remote Audits and Auditor Competence?

Internal auditing has changed. But has your audit programme changed with it?

Organizations increasingly operate across multiple locations, digital platforms, outsourced processes and virtual environments. Evidence may exist in cloud systems rather than filing cabinets. Interviews may take place through video calls. Important processes may be performed by teams that rarely work in the same physical location.

Yet many internal audit programmes still follow methods designed primarily around physical site visits, fixed annual schedules and document-based verification.

ISO 19011:2026, published on 27 May 2026, addresses this evolving environment through updated guidelines for auditing management systems.

The fourth edition replaces ISO 19011:2018 and places particular attention on remote auditing methods, virtual locations and the changing risks associated with modern auditing.

However, the revision should not be misunderstood as a complete redesign of management system auditing.

The established principles of evidence-based auditing, independence, professional judgement and risk-based thinking remain fundamental.

The real question for organizations is how to apply these principles effectively when audit evidence, processes and people are increasingly distributed across physical and digital environments.

This article explains the confirmed changes in ISO 19011:2026, their practical implications for internal audit programmes, and the skills auditors should develop to remain effective.

What Is ISO 19011:2026?

ISO 19011:2026 is the fourth edition of the international standard titled Guidelines for auditing management systems.

It provides guidance for organizations and professionals involved in:

• Establishing and managing audit programmes
• Applying auditing principles
• Planning and conducting management system audits
• Collecting and evaluating audit evidence
• Reporting audit findings
• Evaluating auditor competence
• Improving audit programme effectiveness

The guidance is relevant to management systems such as ISO 9001, ISO 14001 and ISO 45001, as well as organizations operating integrated management systems.

Importantly, ISO 19011 is a guidance standard. It does not independently establish a certifiable management system.

Organizations should distinguish its guidance from the mandatory requirements of the management system standards they are auditing.

When Was ISO 19011:2026 Published?

ISO 19011:2026 was published on 27 May 2026.

It replaces ISO 19011:2018, the previous third edition.

The official ISO publication information identifies the 2026 document as Edition 4.

The revision reflects changes in how organizations operate, particularly the growing importance of technology, digitization and virtual environments.

Organizations can review the published edition through the official ISO 19011 standard page.

ISO 19011:2026 vs ISO 19011:2018: What Actually Changed?

The revision is best understood as an evolution of established auditing guidance rather than a replacement of its fundamental principles.

The foreword of ISO 19011:2026 identifies two main changes:

1. Expanded guidance on remote auditing methods through the introduction of guidance contained in ISO/IEC TS 17012.
2. Expanded Annex A guidance concerning remote auditing methods and virtual locations.

ISO’s accompanying publication communication also highlights the changing impact of technology, digitization and virtual environments, alongside increased attention to risk analysis and mitigation.

Important distinction: Risk-based auditing and auditor competence are not new concepts introduced for the first time in 2026. The revision updates the guidance within a changing operating environment.

1. Remote Auditing: The Most Significant Confirmed Development

Remote auditing is not simply an on-site audit conducted through a video call.

It requires deliberate consideration of how evidence will be obtained, verified and evaluated when the auditor is not physically present at the audited location.

ISO 19011:2026 expands guidance on remote auditing methods, incorporating relevant guidance from ISO/IEC TS 17012.

This is particularly relevant for organizations with multiple facilities, distributed teams, digital operations or processes performed in virtual environments.

What Can Remote Auditing Include?

Depending on the audit objectives, scope, risks and available technology, remote methods may include:

• Video-based interviews with process owners
• Remote review of management system records
• Screen sharing to demonstrate digital workflows
• Live video observation of selected activities
• Review of electronic approval histories
• Examination of system-generated records
• Remote access to relevant management system information

However, the availability of technology does not automatically establish the suitability of remote auditing.

The selected method must still allow the audit team to obtain sufficient and reliable evidence for the intended audit objectives.

2. Remote Audit Suitability: When Is a Virtual Audit Appropriate?

One of the most important practical decisions is determining whether a process can be audited effectively through remote methods.

Consider two different activities.

Scenario A: Document-controlled purchasing process

A purchasing team uses a cloud-based system for supplier evaluation, purchase approvals and performance monitoring.

Relevant records, approvals and transaction histories are accessible electronically.

Remote auditing may provide an effective way to evaluate significant aspects of the process.

Scenario B: Physical manufacturing operation

An auditor needs to evaluate equipment conditions, product handling, physical segregation and shop-floor implementation.

A remote camera may reveal selected activities, but it may not provide sufficient visibility of the entire operational environment.

In this situation, an on-site or combined audit approach may be more appropriate.

The correct choice depends on the audit objectives and the ability of the selected method to provide dependable evidence.

Questions to Consider Before Choosing Remote Auditing

• Can the required activities be observed adequately?
• Can relevant records be accessed securely?
• Can the auditor verify the authenticity and context of evidence?
• Are important physical conditions difficult to evaluate remotely?
• Does the audit team have the necessary technical competence?
• Are there confidentiality or information-security restrictions?
• What happens if the connection or technology fails?
• Would combining remote and on-site methods provide better coverage?

These questions form a practical suitability assessment rather than a mandatory checklist prescribed by ISO 19011.

3. Digital Audit Evidence: More Accessible Does Not Mean More Reliable

Digital systems can make audit evidence easier to retrieve.

However, accessibility and reliability are not the same thing.

Consider an auditor reviewing a screenshot of an electronic inspection record.

The screenshot may display a completed inspection and an acceptable result.

But it may not establish:

• When the original record was created
• Whether the information was subsequently modified
• Who performed the inspection
• Whether the displayed record is complete
• Whether the sample represents normal process performance

Where relevant, an auditor may need to examine the underlying system, transaction history, supporting records or related operational evidence.

The purpose is not to distrust every electronic record.

It is to apply appropriate professional judgement to the evidence available.

Practical Digital Evidence Controls

Organizations conducting technology-enabled audits should consider:

• Secure methods for sharing records
• Appropriate access permissions
• Protection of confidential information
• Record identification and traceability
• Appropriate retention of audit evidence
• Methods for verifying evidence where necessary
• Contingency arrangements for technical failures

These are practical implementation considerations. They should be tailored to the audit scope, risks and organizational environment.

4. Virtual Locations: Auditing Work That Does Not Happen at a Traditional Site

A growing number of business processes are performed in virtual environments.

Examples include:

• Remote customer-support operations
• Cloud-based software development
• Digital procurement workflows
• Online service delivery
• Distributed project management
• Remote document approval processes

These activities may be essential to the effectiveness of a management system even when they do not take place at one conventional physical workplace.

ISO 19011:2026 expands Annex A guidance covering remote auditing methods and virtual locations.

For audit programme managers, this creates a practical responsibility to ensure that the audit scope and selected methods adequately cover relevant processes.

An organization should not assume that a process becomes less important simply because it is performed digitally.

5. Risk-Based Audit Programmes: Audit What Matters, Not Just What Is Due

Risk-based thinking was already embedded in ISO 19011:2018.

It remains fundamental to effective auditing under ISO 19011:2026.

The practical challenge is applying this approach to audit programme planning rather than simply describing every audit as risk-based.

Consider an organization that audits every department once per year using the same duration and depth.

Its programme may be easy to administer.

But is it necessarily effective?

Suppose one process has:

• Repeated customer complaints
• Significant changes in personnel
• Recent process modifications
• Recurring nonconformities
• High consequences of failure

Another process is stable, low-risk and consistently performing.

Giving both processes identical audit attention may not represent the best use of audit resources.

A more effective audit programme considers the relative importance, changes, performance and risks associated with the processes being audited.

Factors That Can Influence Audit Priorities

• Significance of the process
• Previous audit findings
• Customer complaints and feedback
• Operational changes
• Regulatory and contractual obligations
• Performance trends
• Complexity of the activity
• Outsourced processes
• Audit programme risks and available resources

Audit frequency, duration, methods and competence requirements can then be planned accordingly.

6. Audit Programme Risks Are Different From Process Risks

This distinction is frequently overlooked.

A process may carry significant operational risk.

But the audit programme itself can also face risks that affect whether an audit is effective.

For example:

• An auditor may lack sufficient technical competence.
• Remote access may fail during a critical interview.
• Important evidence may be unavailable.
• The audit duration may be insufficient.
• An auditor may not be adequately independent.
• Confidential information may be exposed through inappropriate sharing.

These issues concern the ability of the audit programme to achieve its objectives.

Organizations should therefore distinguish between risks associated with the audited processes and risks associated with planning and conducting the audit itself.

7. Auditor Competence: Are Traditional Skills Enough?

ISO 19011 has long addressed auditor competence and evaluation.

Auditors continue to require foundational capabilities such as:

• Understanding applicable audit criteria
• Planning and conducting interviews
• Evaluating objective evidence
• Applying professional judgement
• Understanding relevant processes
• Communicating findings accurately
• Maintaining independence and confidentiality

However, modern audit environments create additional practical demands.

An auditor may now need to evaluate processes through enterprise software, electronic records, remote interviews and technology-enabled observation.

Therefore, organizations should consider whether their auditor competence criteria remain appropriate for the methods and environments being used.

Digital Competence

Auditors should be comfortable using the technologies necessary to conduct their assigned audits effectively.

This may include secure video platforms, document-management systems, electronic audit records and relevant business applications.

Evidence Evaluation

Auditors need to understand the limitations of different forms of digital evidence.

For example, a screenshot may require additional context before it can support an audit conclusion.

Remote Interviewing

Remote interviews can introduce communication challenges.

Auditors may need to adapt questioning, confirm understanding and manage interruptions while maintaining professional engagement.

Process and Risk Understanding

Technology should not replace understanding of the audited process.

An auditor who can navigate software but cannot evaluate process effectiveness is not necessarily competent to audit that process.

The goal is not simply to develop auditors who can use digital tools. It is to develop auditors who can apply sound auditing principles through those tools.

8. Should Organizations Update Their Internal Auditor Competence Matrix?

Reviewing the competence matrix is a sensible practical response to ISO 19011:2026.

However, organizations should not assume the revision universally mandates a specific new competence matrix or digital-auditor qualification.

Instead, they can evaluate whether existing competence arrangements reflect current audit assignments.

Any identified gaps can inform training, mentoring, supervised audits or other competence-development activities.

9. Hybrid Auditing: Combining Remote and On-Site Methods

Organizations do not always need to choose between a fully remote audit and a fully on-site audit.

A combined approach may provide better coverage.

For example, a manufacturing organization could:

1. Review relevant procedures and records remotely.
2. Interview selected management personnel through video meetings.
3. Examine production activities during an on-site visit.
4. Verify physical controls and operational conditions.
5. Complete selected follow-up discussions remotely.

This approach can improve the use of available time while preserving direct observation where it is important.

However, hybrid auditing should not be adopted simply because it appears efficient.

The methods should be selected according to audit objectives, evidence needs and risks.

10. Common Mistakes When Modernizing Internal Audits

Mistake 1: Assuming Remote Auditing Is Always Acceptable

Remote methods may be appropriate for some activities and unsuitable for others. The decision should be justified by the audit objectives and evidence requirements.

Mistake 2: Treating Screenshots as Complete Evidence

Digital records should be evaluated in context. Additional verification may be necessary.

Mistake 3: Using the Same Audit Schedule Every Year

Audit programmes should be reviewed against changes, performance, risks and previous results.

Mistake 4: Focusing Only on Auditor Certificates

Training certificates can support competence evaluation, but actual competence also depends on knowledge, skills, experience and demonstrated performance.

Mistake 5: Confusing Audit Completion With Audit Effectiveness

Completing every scheduled audit does not automatically mean the audit programme is identifying meaningful weaknesses.

Mistake 6: Ignoring Technology-Related Risks

Connectivity failures, inappropriate access and confidentiality concerns can affect remote audit effectiveness.

Mistake 7: Treating ISO 19011 as a New Certification Requirement

ISO 19011 provides auditing guidelines. It should not be presented as a standalone certification standard or as automatically imposing new certification obligations on every organization.

Practical ISO 19011:2026 Internal Audit Readiness Checklist

Organizations can use the following questions when reviewing their audit programmes:

1. Have we obtained and reviewed the published ISO 19011:2026 edition?
2. Have we assessed the suitability of our current audit methods?
3. Do we have a clear basis for selecting remote, on-site or combined methods?
4. Are audit programme risks identified and managed?
5. Do our audit priorities reflect process significance and performance?
6. Can auditors obtain sufficient evidence from digital systems?
7. Are confidentiality and access controls appropriate?
8. Do our auditors have competence relevant to their assignments?
9. Have we considered virtual locations and distributed processes?
10. Do we review and improve audit programme effectiveness?

This is a practical self-assessment checklist, not a mandatory ISO 19011 form.

How ISO 19011:2026 Supports ISO 9001, ISO 14001 and ISO 45001 Audits

Organizations operating certified management systems generally need to conduct internal audits against their applicable management system requirements.

ISO 19011 provides guidance that can help organizations establish consistent and effective audit practices.

For an ISO 9001 organization, this may involve evaluating process effectiveness, customer requirements and corrective actions.

For an ISO 14001 organization, it may involve examining environmental controls, compliance obligations and operational performance.

For an ISO 45001 organization, it may involve assessing occupational health and safety processes, worker participation and relevant operational controls.

Organizations operating integrated management systems may use the guidance to coordinate audit programmes across multiple disciplines.

The audit criteria remain the relevant management system requirements and other applicable obligations.

ISO 19011 supports the methods used to audit against those criteria.

How Shark Certification Can Support Internal Audit Improvement

Updating an internal audit programme involves more than changing audit templates.

Organizations may need to review their audit objectives, programme risks, audit methods, auditor competence and evidence-evaluation practices.

Shark Certification provides audit services, professional training and management system consultancy to support organizations seeking stronger management system performance.

For organizations reviewing ISO 19011:2026, practical support may include internal audit programme assessments, auditor competence development, audit methodology reviews and management system improvement planning, subject to the services agreed.

Contact Shark Certification to discuss internal audit effectiveness, auditor training and management system audit readiness.

Frequently Asked Questions About ISO 19011:2026

What is ISO 19011:2026?

ISO 19011:2026 is the fourth edition of the international guidelines for auditing management systems. It covers auditing principles, audit programme management, conducting audits and auditor competence.

When was ISO 19011:2026 published?

ISO 19011:2026 was published on 27 May 2026 and replaces ISO 19011:2018.

What are the main changes in ISO 19011:2026?

The officially identified main changes are expanded guidance on remote auditing methods, drawing on ISO/IEC TS 17012, and expanded Annex A guidance on remote auditing methods and virtual locations.

Does ISO 19011:2026 allow remote auditing?

The standard provides expanded guidance on remote auditing methods. Whether a remote method is suitable depends on the audit objectives, evidence requirements, risks and relevant programme or scheme rules.

Is risk-based auditing new in ISO 19011:2026?

No. The risk-based approach was already an established auditing principle in ISO 19011:2018. The 2026 revision continues to emphasize risk analysis and mitigation.

Does ISO 19011:2026 require all auditors to obtain new certificates?

The publication of ISO 19011:2026 does not, by itself, establish a universal requirement for every internal auditor to obtain a new certificate. Organizations should evaluate competence against their audit needs and any applicable scheme requirements.

Can ISO 19011:2026 be used for ISO 9001 internal audits?

Yes. ISO 19011 provides guidance relevant to auditing quality management systems, including those based on ISO 9001.

Does ISO 19011:2026 replace ISO 9001 internal audit requirements?

No. ISO 9001 establishes requirements for the quality management system, including internal auditing. ISO 19011 provides guidance on auditing methods and audit programme management.

What is a virtual location in management system auditing?

A virtual location refers to an environment where relevant activities are performed through digital or online systems rather than exclusively at a conventional physical workplace. Audit planning should consider how those activities can be evaluated effectively.

Should organizations revise their internal audit programmes after ISO 19011:2026?

Organizations should review the updated guidance and determine whether their existing programmes, remote methods, auditor competence and risk assessments remain appropriate. Changes should be based on actual needs rather than automatic replacement of every audit document.

Conclusion: Modern Auditing Requires More Than Modern Technology

ISO 19011:2026 reflects a world in which management systems operate across physical facilities, digital platforms and distributed teams.

The expanded guidance on remote auditing and virtual locations is particularly relevant to organizations adapting their audit programmes to these conditions.

However, the fundamental purpose of auditing has not changed.

An effective audit should provide reliable information about conformity and management system effectiveness.

Technology can improve access to evidence.

Remote methods can create flexibility.

Risk-based planning can help focus resources.

Competent auditors can connect evidence to meaningful conclusions.

But none of these elements should operate in isolation.

The strongest internal audit programmes do not simply adopt new tools. They use appropriate methods, professional judgement and reliable evidence to identify what truly matters.

That is the practical opportunity ISO 19011:2026 presents.