ISO 19011:2026: What Changed in the New Edition and How to Run an Internal Management System Audit

ISO 19011 is the international guideline for auditing management systems. On 27 May 2026, ISO published its fourth edition, and the 2018 edition was withdrawn the same day. If you run internal audits against ISO 9001, ISO 22000 or ISO 45001, that's a reason to check your procedure against the new text. The good news: you won't have to rewrite it from scratch. Below we go through what actually changed, where the new edition really needs your attention, and how to run an internal audit that finds problems before the certification body does.

The full title is "Guidelines for auditing management systems", and the word "guidelines" says it all. The document sets no requirements for your company. It describes the principles of auditing, managing an audit programme, conducting an individual audit and evaluating auditor competence. That's why there's no such thing as an "ISO 19011 certificate": on the ISO 19011 page at iso.org, ISO answers the question of whether using it leads to certification with a short "no".

Where the obligation to audit comes from

The obligation comes from the certifiable standard. In ISO 9001:2026 it's clause 9.2 "Internal audit", with 9.2.2 covering the internal audit programme; ISO 22000 and ISO 45001 have equivalent requirements. The guideline answers the "how": how to plan the programme, whom to appoint as auditor, how to collect evidence and word the findings. The QMS requirements themselves are covered in our complete ISO 9001 guide.

Here's a consequence people often overlook. The ISO 9001 Auditing Practices Group, a joint group of ISO/TC 176 and IAF, states in its paper "Effective Use of ISO 19011" that a certification body auditor can't raise a nonconformity against ISO 19011, because applying it isn't mandatory for the organization. If your procedure departs from the guidance somewhere but clause 9.2 is met, there's no breach.

What an internal audit actually is

The standard defines an audit as a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled (clause 3.1). An internal audit is a first-party audit: the organization runs it itself, or someone does it on its behalf. The second party is a customer auditing a supplier; the third is a certification body, which works under ISO/IEC 17021-1 (more on that in our walkthrough of the Stage 2 certification audit).

A note for Ukrainian readers: don't confuse this with internal audit in budget-funded institutions. That function is set up by budget fund managers under Article 26 of the Budget Code of Ukraine, and it has nothing to do with ISO management systems.

The short answer: less than the "revolutionary new edition" mailings suggest. The foreword of ISO 19011:2026 lists two main changes, and both concern remote auditing:

• expanded guidance on remote auditing methods, bringing in the guidance from ISO/IEC TS 17012:2024;
• an expanded Annex A, which now gives guidance on remote auditing methods and virtual locations.

ISO/TC 176, in its announcement of the release dated 9 June 2026, puts the same point more broadly: the new edition reflects the growing impact of technology, digitization and virtual environments and puts more focus on risk analysis and mitigation. As with the previous edition, the text was prepared by project committee ISO/PC 302 together with CEN.

We compared the tables of contents of both editions. Both run to 46 pages, every clause starts on the same page, and subclause titles have barely changed. So if your internal audit procedure is built on the 2018 edition, it isn't obsolete: it needs additions, not a rewrite.

The most visible change in clause 3 is the new term 3.4 "remote auditing method". It's defined as a method used for conducting audit activities from any place other than the location of the auditee. The term comes from ISO/IEC TS 17012:2024 together with three notes, and the notes are more practical than the definition:

1. remote methods can be combined with on-site methods to achieve a full and effective audit;
2. they apply to virtual locations, where an organization performs work or provides a service in an online environment regardless of physical location;
3. an auditor at one site of the auditee can audit another site remotely.

The third note helps companies with several sites: checking a warehouse in Zhytomyr from the Kyiv office over video is now explicitly a remote method, and should be planned as one.

Its own vocabulary instead of references to ISO 9000

The second change is less visible, but it matters more to whoever writes the procedures. In the 2018 edition, all 26 terms cited ISO 9000:2015. Now only 14 of the 27 terms cite ISO 9000:2026. The rest of the audit vocabulary (audit programme, plan, criteria, evidence, conclusion, auditor, technical expert, observer) is defined by the standard itself. So take your internal audit glossary from the new edition, not from ISO 9000.

Two small but telling edits. An observer now explicitly "does not act as an auditor nor a technical expert", say a colleague from another department who came along to watch. And the note on audit criteria now lists industry standards: for a food producer that might be the FSSC 22000 scheme, for a defense manufacturer AQAP 2110 where it's written into the contract.

In Ukraine, the 2018 edition was adopted as DSTU ISO 19011:2019 "Guidelines for auditing management systems" (ISO 19011:2018, IDT). DSTU is Ukraine's national standard designation. It was adopted by order of the national standards body (SE "UkrNDNC") No. 435 of 18.12.2019, has been in force since 01.01.2021, and was developed by technical committee TC 189 "Quality management systems". The degree of correspondence is "identical", so it's a translation, not an adaptation. In October 2026 DSTU ISO 19011:2019 is listed as in force, and we found no national standard identical to the 2026 edition in the catalogues.

Which raises the usual question: what should you reference? Here's our advice.

• Internal documents. Reference ISO 19011:2026 as the current international edition, and keep DSTU ISO 19011:2019 as the source of official Ukrainian terminology.
• Contracts with state customers and other documents that require national standards specifically: use the DSTU until a new version appears.
• A search for the Ukrainian text of ISO 19011 will lead you to DSTU ISO 19011:2019. No official Ukrainian text of the 2026 edition has been issued yet, so the new remote-auditing provisions have to be read in English.

In the Ukrainian version of this article we stick to the DSTU terminology so that your procedure stays consistent with the national standard.

ISO 19011 separates two levels that companies constantly mix up. The audit programme (clause 5) is the arrangements for a set of one or more audits planned for a specific time frame and directed towards a specific purpose (clause 3.5). An individual audit (clause 6) is a specific check with a plan, a team, an opening and a closing meeting. The ISO 9001 Auditing Practices Group puts it bluntly: managing an audit programme isn't the purview of an individual auditor; it's a separate process. In a small company one person may do both, but you still have to think about them separately.

What the programme should contain under clause 5.1 of ISO 19011:2026

The standard lists eleven items, a) to k). In short:

• programme objectives, the risks and opportunities associated with it, and the actions to address them;
• the scope of each audit (boundaries, locations), the schedule (number, duration, frequency) and audit types;
• audit criteria and methods, including remote ones, with a reference to A.16;
• criteria for selecting the audit team and for observer participation;
• the organization's context based on external and internal issues, and relevant documented information.

The programme should also take into account the application of technology such as digital tools, and information security requirements. And the most useful sentence in the clause is about resources: priority goes to matters with higher inherent risk and lower levels of performance.

The logic of clause 5 follows the PDCA cycle: establish the programme, implement it, monitor it (5.6), review and improve it (5.7). A programme that hasn't changed in three years tells you "check" and "act" aren't working.

What it looks like in practice

Food production. A department with CCPs that had monitoring deviations last year is one we'd audit twice a year, while HR with stable results can be audited less often, provided that's justified in the programme.

Defense manufacturer. The programme picks up customer requirements and AQAP 2110: configuration management, batch traceability, subcontractors. Some information is restricted, so the audit method is decided in advance, not on the day.

IT company. Processes live in virtual locations: the repository, the ticketing system, the cloud. A remote audit is more natural here than an office one, but access rights and screen-recording rules are agreed beforehand.

We've covered the cycle of an individual audit, from preparation to the report, in our article on the four stages of an internal quality audit.

Clause 7 has the same layout in the new edition: personal behaviour (7.2.2), knowledge and skills (7.2.3), achieving auditor competence (7.2.4) and audit team leader competence (7.2.5), then evaluation and maintenance of competence (7.3–7.6). The competence matrix you built on the 2018 edition still works.

The new emphasis isn't in clause 7 but next to it. If remote methods are part of the audit programme (clause 5.1 g), the auditor has to be able to use them. For certification bodies that's already mandatory: IAF MD 4:2025, applicable from 30 January 2026, requires team members to have the competency and ability to understand and use the ICT employed and to be aware of how it may affect the validity and objectivity of the information gathered. The document doesn't bind internal auditors, but the logic is worth adopting, otherwise an audit over video turns into a conversation in which nobody sees the workplace.

The principles an internal auditor stands on

Seven principles (clauses 4.2–4.8): integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach. For internal auditors, the sore point is independence. The standard accepts that an internal auditor can't always be independent of the activity being audited and, where that's the case, asks for every effort to remove bias. In plain terms: the lab manager doesn't audit the lab, even if they're the best auditor on site.

How to build a competence profile

We suggest assessing each internal auditor on five blocks:

1. the standard you audit against, and the guideline itself;
2. the process and the industry: a food auditor needs HACCP and prerequisite programmes, a defense auditor needs the customer's requirements;
3. audit methods: interviews, observation, sampling, records;
4. personal behaviour: ethics, observation, tact;
5. working with ICT for remote methods.

It's better trained on real cases than in lectures. That's what our ISO 9001 internal audit practicum is for.

ISO/IEC TS 17012:2024 says it plainly: remote auditing methods aren't intended to replace on-site methods; they're a tool to conduct the audit effectively and efficiently. We agree. A camera shows what it's pointed at. An auditor on site sees what nobody planned to show: an unlabelled container, a puddle after defrosting, the shortcut past the hygiene lock.

What you can audit remotely and what you can't

• Works well: documents, records, risk registers; interviews with process owners; processes that live entirely online (software development, customer support, purchasing in the ERP).
• Possible, with limits: a live video walk-through of a warehouse or shop floor. Plan the route and record what you saw and what you didn't.
• Works poorly: CCPs, hygiene, equipment condition, work at height, any physical operation where smell, sound and temperature matter.

For certification audits, IAF MD 4:2025 draws the same line firmly: a virtual site can't be considered where processes must be executed in a physical environment, such as warehousing, manufacturing, physical testing laboratories, installation or repairs. That's a good benchmark for internal audits too.

What to record in the programme and the report

1. The method for each audit (on-site, remote or combined) and why.
2. The arrangement with the auditee: which connection, who shows what, whether recording is allowed.
3. Information security: which documents can be shown on screen. At defense manufacturers this question often decides everything.
4. In the report: the extent to which ICT was used and whether the audit objectives were met. IAF MD 4 requires this of certification bodies, and it's a good habit for internal reports too.

One caveat: since 1 January 2026 the IAF website has been an archive, because the organization ceased operations and points to Global Accreditation Cooperation. Check the rules that apply to your certification audit with your certification body.

Under ISO 19011, an audit finding is the result of evaluating the collected audit evidence against audit criteria (clause 3.11). Findings indicate conformity or nonconformity, and can also point to risks, opportunities for improvement or good practice. A nonconformity (clause 3.22) is the non-fulfilment of a requirement. Those two definitions give the formula we teach every internal auditor:

requirement (criterion) + fact (evidence) + gap = nonconformity.

Without any one of the three, you have an impression, not a nonconformity. "Staff are poorly informed" can't be verified. "The line 2 operator couldn't state the pasteurization critical temperature limit, although work instruction WI-07 sets it and he was trained on 12.03" can be verified, and the process owner can see what to fix. Examples from three industries:

Root cause: don't stop at "human error"

The internal auditor doesn't have to find the root cause; that's the process owner's job. But the auditor should check that the analysis was done honestly. When the action plan says "retrain the staff", that's almost always a correction, not a corrective action. Ask "why" a few more times. Why didn't the operator record it? Because there's one operator for two lines on the night shift. And why's that? Because the rota was drawn up without allowing for monitoring. Now there's something to fix.

Clause 10.2 of ISO 9001:2026 is titled exactly that: "Nonconformity and corrective action". We showed how to build a CAPA that survives a customer's scrutiny using the example of corrective actions under AQAP 2110.

And a list of what external auditors find most often is in our review of typical ISO audit nonconformances.

ISO 9001:2026 was published on 16 September 2026, so this year's internal audits will double as transition readiness checks. The new edition's foreword lists the main changes: quality culture and ethical behaviour in the requirements, separate treatment of risks and opportunities, strengthened management of change, and an expanded explanatory Annex A. We've built that into the checklist. For the full breakdown and a transition plan, see ISO 9001:2026: changes and transition plan.

Use the table as a framework, not a tick-box questionnaire: adapt the questions to the process and look for evidence on site, not in the "for the audit" folder.

Let's make it practical. Here's what we'd advise whoever is responsible for internal audits to do by the end of 2026:

1. Update references in the procedure and audit programme to ISO 19011:2026, and keep DSTU ISO 19011:2019 as the source of Ukrainian terminology.
2. Move the glossary over from clause 3 of the new edition, including "remote auditing method".
3. Add a "method" column to the programme (on-site, remote, combined) with a short risk-based justification.
4. Extend the competence matrix with ICT and virtual locations.
5. Review the report form: does it record where ICT was used and whether the audit objectives were met?
6. Run one pilot audit under the updated procedure before the surveillance audit, not after.

If you'd like to go through the new edition with a trainer, there are two online formats in November. The three-day ISO 9001:2026 and ISO 19011:2026 course runs 11–13 November, daily from 13:00 to 17:00 (Kyiv time).

For defense manufacturers, the same block is part of a five-day programme on 9–13 November, with the first two days on AQAP 2110: details on the AQAP 2110, ISO 9001:2026 and ISO 19011:2026 course page.

Before a certification or surveillance audit, we provide audit support: we'll review your internal audit programme and reports and show you what the external auditor will see.

ISO 19011:2026 doesn't force you to break anything. It asks you to describe honestly how you audit in a world where some processes already live in the cloud and others still smell of machine oil. Do that before the surveillance audit and your internal audits will deliver real value instead of yet another folder.