The new edition of ISO 19011 was published in May 2026. ISO 19011 is the international standard that provides guidance on auditing management systems. ISO 19011:2026 is the fourth edition of the standard and replaces ISO 19011:2018.
The standard is particularly important for organisations that maintain management systems according to ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001, ISO 50001 and other standards. It is not a certification standard, but a guidance document for planning, conducting, reporting and improving management system audits.
ISO 19011 is one of the most important practical standards for organisations in establishing a consistent and effective approach to audits, managing audit programmes, evaluating auditor competence and improving management systems through structured audits.
 
Why the new edition is important
Since the previous edition of ISO 19011 in 2018, the environment in which organisations operate has changed significantly. More and more processes are managed remotely, some activities are carried out through cloud services, teams work from different locations, and audits are often conducted using a combination of on-site and remote methods.
The new edition of ISO 19011 reflects precisely this change. It retains the basic logic of the standard – management of audit programmes, conducting audits and determining auditor competence – but places a stronger emphasis on remote audit methods and the auditing of virtual locations.
This is particularly important for organisations working with distributed teams, external providers, digital platforms, cloud systems, electronic records and processes that cannot be verified solely through a traditional on-site visit.
 
What ISO 19011:2026 covers
The standard provides guidance on auditing management systems regardless of their type, size and complexity. It can be used both for internal audits and for second-party audits, such as audits of suppliers, subcontractors or partners.
ISO 19011:2026 is applicable when auditing against various criteria, including:

• requirements of one or more management system standards;
• the organisation’s internal policies, processes and procedures;
• statutory, regulatory and contractual requirements;
• requirements of interested parties;
• plans, programmes and objectives related to specific management system results.

This flexibility makes the standard suitable for integrated management systems, where several areas are reviewed within a single audit – for example quality, environment, occupational health and safety, information security, energy efficiency or business continuity.
 
Key focus: remote audits and virtual locations
One of the most significant changes in the new edition is the expanded guidance on remote audit methods. This includes the use of information and communication technologies in planning, conducting, evidence collection, interviewing, observation of processes and reporting results.
Remote auditing is no longer viewed as an exception, but as a normal tool that can be effective when properly planned and managed. At the same time, the standard emphasises the need to assess the risks associated with the remote approach – for example connection reliability, access to records, information security, confidentiality, the ability to observe actual processes and limitations in verifying physical infrastructure.
The new edition also pays attention to virtual locations. These are environments in which the organisation carries out activities or provides services without a traditional physical presence – for example through cloud platforms, information systems, remote workplaces or digital service channels.
For many organisations, this means that auditors now have to be able to verify not only documents and records, but also the way in which processes operate in a digital environment.
 
Risk-based approach – from guidance to a core principle
The risk-based approach is not a new element in ISO 19011 – it has been present since the 2018 edition. In the updated version, however, its importance is further emphasised. Instead of being considered only as guidance in individual clauses, it is now formulated as a separate principle of auditing in clause 4.
This change requires risk assessment to be consistently integrated into all stages of the audit process – from developing the audit programme and planning the specific audit to analysing and reporting the results.
In practice, this means that audits should focus on the processes, activities and areas of greatest significance and highest risk for the organisation, rather than being carried out mechanically according to a predetermined schedule or standard structure.
 
What this means for organisations
Organisations that implement management systems should review their internal audit programmes and adapt them to the new guidance. This does not necessarily mean a complete change to the existing approach, but it does require better planning of when to use an on-site audit, when to use a remote audit and when to use a combination of both methods.
In practical terms, this includes:

• clearer definition of the audit objectives, scope and criteria;
• risk assessment when selecting the audit method;
• ensuring access in advance to the necessary documents, records and systems;
• planning interviews with participants from different locations;
• ensuring confidentiality and protection of information;
• better documentation of the evidence collected;
• evaluation of the effectiveness of the audit programme itself.

Particular attention should be paid to auditor competence. In remote and hybrid audits, auditors need not only knowledge of the relevant standard and the organisation’s processes, but also skills in using digital tools, managing online interviews, verifying electronic records and assessing the reliability of evidence presented remotely.
The standard does not provide for a transition period – the new edition applies from the date of its publication.
 
Impact on internal audits
For organisations with certified management systems, internal audit remains a key mechanism for verifying conformity and effectiveness. The new edition of ISO 19011 draws attention to the need for internal audits to be more flexible, more risk-oriented and better aligned with the organisation’s actual way of working.
This means that the audit programme should not be a formal schedule implemented mechanically. It should take into account the significance of processes, changes in the organisation, the results of previous audits, identified nonconformities, risks and opportunities, as well as the expectations of interested parties.
When applied properly, ISO 19011:2026 can help internal audits become a more useful management tool, rather than merely a requirement before a certification or surveillance audit.
 
How Consejo can help
Consejo supports organisations in establishing, maintaining and improving management systems, including in the preparation and conduct of internal audits according to ISO 19011.
 
ISO 19011:2026 reflects the reality in which management systems now operate – a more digital, more flexible and more connected environment. The new edition retains the established principles of auditing, but adapts them to remote working, virtual processes and modern ways of collecting audit evidence.
For organisations, this is a good opportunity to review the way they plan and conduct their internal audits and to make them more effective, more practical and more useful for management.