ISO 19011:2026 Explained: What Changed in Auditing Guidelines

ISO 19011:2026 was published on 27 May 2026, replacing the 2018 edition of Guidelines for auditing management systems. Unlike a requirements standard such as ISO 14001 or ISO 27001, ISO 19011 is a guidance document. You don’t get certified to it, and there is no transition period. It takes effect immediately. But it shapes how good audits are planned and run, so it matters to anyone responsible for an internal audit programme or supplier audits.

What ISO 19011 is (and isn’t)

ISO 19011 provides guidance on managing an audit programme, planning and conducting audits, and the competence of auditors. It applies to internal (first-party) audits and to supplier or second-party audits across any management system: quality, environment, safety, information security and beyond. Third-party certification audits are governed by ISO/IEC 17021-1, but certification auditors still draw heavily on the principles in ISO 19011. In short, it’s the playbook for doing audits well.

Here is the part most coverage gets wrong, and it is worth being precise about. ISO 9001 clause 9.2 requires you to conduct internal audits. It does not normatively reference ISO 19011, and the only normative reference in ISO 9001 is ISO 9000. So an auditor cannot raise a nonconformity against ISO 19011, and anyone telling you your audit programme must conform to it is overstating the position.

What clause 9.2.2 does require is defined audit criteria and scope for each audit, auditors selected so as to ensure objectivity and the impartiality of the audit process, and competence under clause 7.2. ISO 19011 is the recognised way to evidence all three, which makes it the benchmark rather than the rule. That distinction matters when you are deciding how much to invest in your audit programme, and it is why we audit to ISO 19011 without pretending a clause compels it.

What changed in the 2026 edition

The revision is narrower than most of the commentary suggests, and that is worth knowing before you rewrite anything. ISO names only two main changes in the standard’s own Foreword, and both are about remote auditing.

• Remote auditing guidance moves into the main standard. The 2026 edition absorbs the guidance from ISO/IEC TS 17012, a technical specification published in July 2024 covering the use of remote auditing methods in auditing management systems. That guidance previously sat in a separate document most audit teams never bought. It is now part of the standard your audit programme already references.
• Annex A is expanded to cover remote auditing methods and virtual locations. The phrase to notice is virtual locations. Guidance that once assumed an auditor walks a site now has to deal with work that happens in a cloud platform, across a distributed team, or at a location with no physical office at all.

For Australian organisations this lands harder than it might elsewhere. Distance is our constant audit cost, and remote and hybrid auditing has been the practical answer for multi-site operators, regional depots and anyone auditing a dispersed or fly-in fly-out workforce. Until now that was being done on judgement and improvisation. There is now recognised guidance behind it.

What did not change, which matters just as much

Plenty of what you will read implies a broad overhaul. It is not one, and you can check that yourself in the free contents listing on ISO’s Online Browsing Platform.

• The seven principles of auditing are the same: integrity, fair presentation, due professional care, confidentiality, independence, the evidence-based approach and the risk-based approach. They are now set out as numbered subclauses, 4.1 through 4.8, where the 2018 edition listed them unnumbered. Useful if your procedures cite them, because you can now point at a specific subclause rather than a whole clause.
• The risk-based approach is not new. It arrived in the 2018 edition, as did clause 5.3 on determining and evaluating audit programme risks and opportunities. If you see the 2026 edition credited with introducing risk-based auditing, that is a 2018 change being reported eight years late.
• Managing an audit programme, conducting an audit, and auditor competence are structurally unchanged. Clauses 5, 6 and 7 carry the same subclauses as 2018, with only minor wording tidy-ups.

So if your internal audit programme conformed to the 2018 guidance, it has not become deficient. The work in front of you is narrower than a rewrite: it is about how you handle remote and hybrid auditing, and whether your procedures and competence criteria reflect it.

What it means for your internal audit programme

Because there’s no certification or transition deadline, nothing breaks on 27 May 2026. The value is in adopting the updated guidance to make your audits sharper. If your team still treats remote auditing as a workaround rather than a method you have thought through, the 2026 edition is a useful prompt to update your audit procedures, competence criteria and audit-programme planning. Organisations running integrated systems get a single answer across every standard they audit, because ISO 19011 has always been the common auditing guidance rather than one document per standard.

Practical steps to adopt it

1. Update your audit programme procedure to reference ISO 19011:2026, and check any clause citations, because the principles are now numbered subclauses.
2. Write down when a remote or hybrid audit is appropriate for your organisation, and when it is not. This is the judgement the new guidance supports, and the one an auditor will ask you to justify.
3. Set out the controls that keep a remote audit rigorous: how you verify you are seeing the live system, how you handle evidence you cannot physically inspect, and what triggers a switch back to an on-site visit.
4. Address virtual locations explicitly. Decide how you audit work that happens in a cloud platform or across a dispersed team, rather than treating it as an awkward exception.
5. Extend auditor competence criteria to cover remote auditing technique, not just the technical subject matter.
6. Give your internal auditors a short briefing on what changed, and equally on what did not, so nobody rebuilds a programme that was already sound.

Where to buy it, and which edition you get

This one catches people out, because the Standards Australia store sells two different documents under the ISO 19011 name and Standards Australia has not adopted the 2026 edition. Since nobody certifies to ISO 19011, that has no bearing on your certificate. It does decide whether the copy you buy contains the remote auditing guidance.

• ISO 19011:2026, $418.26 including GST. The current international edition, and the one this article describes. This is the version that contains the remote auditing guidance and the expanded Annex A.
• AS/NZS ISO 19011:2019, $222.04 including GST. The Australian and New Zealand adoption, which adopts the 2018 edition. It is cheaper, and it does not contain any of the 2026 changes.
• ISO/IEC TS 17012:2024 is also sold separately, if you want the remote auditing guidance at its source rather than as absorbed into the 2026 edition.

How Streamline can help

Streamline ISO Consultants delivers independent ISO internal audits aligned to ISO 19011:2026, giving you an objective view of your system ahead of certification or surveillance. We can also build your team’s capability through ISO mentoring, coaching your internal auditors on modern, risk-based and remote auditing techniques so the skills stay with your people. Explore our full range of auditing services, or read our guide to certification bodies in Australia.

Want help applying ISO 19011:2026 to your audit programme? Contact our team for a no-obligation chat. The official standard is available on the ISO website.

Sources: ISO 19011:2026, fourth edition, published 27 May 2026, Foreword and contents, read via ISO’s Online Browsing Platform and compared against ISO 19011:2018; ISO/IEC TS 17012:2024, Conformity assessment, guidelines for the use of remote auditing methods in auditing management systems. Reviewed 22 September 2026.