What every auditor needs to know about the ISO 19011:2026 update

Most auditors have heard of ISO 19011. Far fewer have actually read it.

That's because ISO 19011 is a guidelines document, not a certification standard. Organisations do not get certified to it, there are no findings raised against it in an external audit, and nobody requires you to hold a copy. Yet it sits behind every structured management system audit conducted anywhere in the world.

The 2026 edition — the fourth version of the standard, published in May 2026 — is the most significant update since the 2018 revision. If you audit management systems for a living, or you manage an internal audit program, this is the edition that reflects how auditing actually works today.

What ISO 19011 is

ISO 19011 is the international guideline for auditing management systems. It applies to any management system audit — ISO 9001 quality, ISO 14001 environmental, ISO 45001 occupational health and safety, ISO 27001 information security, or any other standard that follows the harmonised structure.

It covers four areas:

Principles of auditing. The foundation: integrity, fair presentation, due professional care, confidentiality, independence, the evidence-based approach, and the risk-based approach. These principles are unchanged in the 2026 edition, with the only adjustment being a slight expansion of the confidentiality definition to “security and privacy of information.” They are what makes an audit trustworthy.

Managing an audit program. How to establish, plan, implement, monitor, and improve an audit programme over time — not just individual audits. This is the part most internal audit programme managers underuse.

Conducting management system audits. The full audit process, from initiation through preparation, execution, and reporting to follow-up. This is the practical core of the standard.

Evaluating auditor competence. Knowledge, skills, personal attributes, and how to assess and develop auditors. This section matters directly for anyone applying for Exemplar Global certification — the AU (auditing) and TL (team leadership) competency units are built on the competency framework ISO 19011 defines.

Why ISO 19011:2026 matters more than its predecessors

The 2018 edition was written when remote auditing was rare, digital evidence was an edge case, and AI had no practical role in audit practice. All three of those things are now normal features of how organisations operate and how audits get done.

ISO 19011:2026 reflects that. It is not a rewrite of the fundamentals — the principles of auditing are unchanged. But the guidance around how those principles are applied in a modern audit environment has been substantially expanded.

What changed in the 2026 edition

Remote and hybrid auditing now in the main body

The single biggest structural change in the 2026 edition replaces a two-page appendix from the 2018 version with remote and hybrid audit guidance throughout the main body of the standard.

Planning a remote audit, gathering electronic evidence, maintaining audit effectiveness when you are not physically on site, and managing communication across platforms are now treated as standard audit methods, not exceptions. If your audit program has no documented position on remote evidence gathering or hybrid audit conduct, that is worth addressing.

Digital evidence and documentation

The 2026 edition provides clearer guidance on how auditors should approach electronic evidence — cloud documents, digital records, audit software outputs, scanned records, and data pulled from management information systems. The key question ISO 19011:2026 now expects auditors to consider is not just whether evidence exists digitally, but whether it is reliable, controlled, and traceable.

This is especially relevant for organisations that have moved to paperless systems or cloud-based document management. An auditor trained under the 2018 edition may default to asking for paper copies or printed records. An auditor trained under the 2026 edition understands how to evaluate electronic evidence on its own terms.

ICT and AI competence for auditors

The 2026 edition explicitly adds information and communication technology competence to the criteria for evaluating auditor capability. This appears in the competence section — the part of the standard that defines what a qualified auditor needs to know and be able to do.

In practical terms this means: comfort with digital audit tools, video conferencing platforms, shared document environments, and an understanding of how AI-generated outputs should be approached when they appear as evidence during an audit. This is not about auditors becoming IT specialists. It is about auditors being able to function effectively in the digital environments where most organisations now operate.

Risk-based audit program planning

Risk-based thinking has been in ISO standards since 2015. ISO 19011:2026 gives it more detailed treatment in the context of audit program design. The expectation is not simply that you audit all clauses on a rotating schedule, but that you weight your program toward the areas of greatest risk, change, and consequence.

Organisations with static internal audit schedules — the same clauses, the same processes, the same frequency year after year regardless of what has changed — will find this expectation increasingly difficult to demonstrate as conformant. A well-designed audit programme starts from risk, not from a calendar.

Supply chain and external provider auditing

The 2026 edition gives expanded guidance on auditing external providers and supply chains, including a dedicated annex on the topic. As organisations rely more heavily on outsourced processes, suppliers and subcontractors, the integrity of a management system increasingly depends on parties outside the organisation’s own walls. For auditors, this means second-party and supplier audits carry more weight in the new edition. The guidance helps auditors assess how an organisation identifies, controls and monitors risks that sit beyond its direct control, rather than treating the supply chain as out of scope. If your organisation outsources significant processes, the question is no longer just whether a supplier is approved, but whether the controls over that supplier are effective and auditable.

Terminology alignment

Language in ISO 19011:2026 has been aligned with the 2026 editions of ISO 9001 and ISO 14001. For auditors working across multiple standards, this update reduces interpretation drift between the standard being audited and the framework being used to conduct the audit.

What this means if you manage an internal audit programme

If your internal audit program was designed with the 2018 edition in mind, the changes are evolutionary rather than disruptive. You do not need to rebuild from scratch. But a conscious review is more useful than absorbing the differences by osmosis.

Three areas to check specifically:

Program design. Is your program driven by risk, or by a fixed rotation? The 2026 edition pushes firmly toward risk-based scheduling. If you cannot articulate why certain processes are audited more frequently than others, that is worth revisiting.

Remote and hybrid audit coverage. Does your program have a documented approach for remote evidence gathering? If you conduct any audits partially or fully off-site, the 2026 guidance is now the relevant reference.

Auditor competence criteria. If you have written competence criteria for your internal auditors, do they address digital tools and ICT capability? If not, it is worth adding — both because the 2026 edition expects it, and because it is increasingly relevant to how audits are actually conducted.

ISO 19011 and Exemplar Global certification

The Exemplar Global auditor certification scheme is built on the competency framework ISO 19011 defines. The AU (management systems auditing) and TL (leading audit teams) units that Exemplar Global requires for auditor certification reflect the knowledge, skills, and personal attributes ISO 19011 sets out.

Our training under the TPECS scheme — including the Integrated Management Systems Lead Auditor course and the Internal Auditor Course — is designed and delivered with the current edition of ISO 19011 built in, so participants learn audit practice as it is described in the 2026 standard.

Where to go from here

If you are new to ISO auditing and want to build from the ground up, the Internal Auditor Course covers the full audit process for those auditing their own organisation. If you need to lead audit teams, conduct second-party or supplier audits, or work toward third-party certification audit work, the Integrated Management Systems Lead Auditor course covers all three management system standards across five facilitated days and awards five Exemplar Global qualifications.

Why train with us?

Auditor Training Co is powered by Southpac International Group, with over 20 years as management systems specialists in aviation and other high-risk industries. Our auditor training offering has developed as a result of understanding both what it takes to build effective management systems and what effective third-party auditing looks like, as a JAS-ANZ accredited certification body. Our courses are certified by Exemplar Global and are facilitated by some of the industry's most experienced trainers with auditing backgrounds.

We offer comprehensive training courses for various auditing roles — from those looking to specialise in auditing Integrated Management Systems across quality, safety and environment, to those wanting to develop the skills to conduct effective internal audits.