ISO 19011:2026: what the new auditing guidance means for your internal audits

Internal auditor on a video call with a site supervisor showing a fire extinguisher

If you hold ISO 9001, ISO 14001, ISO 45001, or most other management system certificates, you have to run internal audits. ISO 19011 is ISO’s guidance on how to plan and carry out management system audits, internal and external, and a new edition was published in May 2026.

The good news is that this isn’t a big-bang change. You don’t need to rush, and nobody will be certified to it. But there are some sensible updates, particularly around remote auditing and the risks to your audit programme, that are worth building into your next internal audit cycle.

What ISO 19011:2026 is

ISO 19011:2026, Guidelines for auditing management systems, is the fourth edition. ISO’s page shows it was published on 27 May 2026, and it replaces ISO 19011:2018, which is now withdrawn. In the UK it’s published by BSI as BS EN ISO 19011:2026, which supersedes BS EN ISO 19011:2018.

ISO describes it as providing “guidelines for auditing management systems, including quality management systems (ISO 9001) and environmental management systems (ISO 14001).” It covers the principles of auditing, managing an audit programme, conducting audits, and evaluating auditor competence. BSI notes it is designed for “any organization needing to plan and conduct internal or external audits”, which is why it matters to small firms running their own internal audits.

It’s guidance, so there’s no transition

This is the most common question I’ve had since May. The CQI and IRCA are clear: “ISO 19011 is a guidance standard, not a requirements standard, and organisations are not certified to it.” They also state that, as a guidance standard, ISO 19011:2026 “takes effect immediately on publication, with no transition period.”

So there’s no deadline to “upgrade”, and because it isn’t a requirements standard, not having adopted the 2026 wording isn’t a nonconformity in itself. That said, external auditors will be working to current good practice, so it makes sense for your internal audit programme to catch up at a sensible pace.

The CQI describes the revision as a technical revision, “updating and clarifying existing guidance rather than introducing fundamental change”. In another CQI article it’s summed up as “evolutionary not revolutionary.” That matches my reading.

What has changed

The points below are taken only from ISO, BSI, and CQI/IRCA summaries. I haven’t added anything they don’t say.

Remote and hybrid auditing

BSI says the 2026 revision “responds to the significant shift towards remote and hybrid audits.” The CQI calls the expanded remote auditing guidance “perhaps the most significant” change. It draws on ISO/IEC TS 17012:2024, ISO’s guidance on the use of remote auditing methods, and Annex A has been expanded to cover remote auditing methods and virtual locations. There’s also a new defined term for “remote auditing method”.

Risk to the audit programme

According to the CQI, risks and opportunities in the audit programme should now be “determined”, not just “considered”. The risk-based approach principle now also applies to planning and implementing the audit programme. New examples of programme risk include:

a lack of auditor independence and/or impartiality
a lack of top management sponsorship
the selection of unsuitable auditing methods
failure to conduct audits in accordance with the audit programme
unavailability of the auditee and/or audit evidence

If you’ve ever had an internal audit postponed three times because “it’s a busy month”, you’ll recognise several of those.

Auditor competence

The CQI notes that when choosing auditors, “consideration should be given to the auditor’s knowledge and skills relating to auditing methods that will be used.” Auditors should also understand information security, including privacy. BSI adds that expanded competence expectations cover areas such as cloud platforms, video conferencing, data analytics, and AI. When evaluating auditors, managers are now advised to consider feedback from auditees and other stakeholders.

Independence for internal auditors

This one matters for small businesses. The 2018 edition said internal auditors should be independent “if practicable”. According to the CQI, that wording has gone. Instead, where independence isn’t possible, “every effort should be made to remove bias and encourage objectivity.”

Other updates worth knowing

The CQI also highlights that:

the scope of the management system is now identified as an input to the extent of the audit programme
the programme should include information relating to the organisation’s context
whether climate change is a relevant issue for the auditee should be considered when designing the audit programme
criteria for the participation of observers should be included where relevant
nonconformity grading criteria should be “defined and communicated”
reports go to “previously determined parties” rather than “relevant interested parties”
“outcome of an audit” is now “result of an audit”

The CQI also points out that changes to terms, definitions, clause references, and clause titles will affect how audit reports are produced. If your internal audit report template quotes ISO 19011:2018 clause numbers, it’ll need updating.

Practical tips for SME internal audit programmes

Here’s how I’d apply the new edition to a typical small or medium-sized business, without adding bureaucracy.

Write down your audit programme risks

Most SMEs have an audit schedule. Fewer have thought about what could stop it working. Spend half an hour listing your real risks (the only trained auditor leaving, or audits slipping every peak season) and what you’ll do about each one. That’s a direct response to the “determined, not just considered” change.

Decide when remote auditing actually works

Remote methods are great for reviewing records, interviewing office staff, and auditing a second site. They’re weaker for checking a warehouse floor, a construction site, or a guard’s patrol route. Decide in advance which method suits each audit, and note why. According to the CQI, the 2026 edition says consideration should be given to the “relative impact on the organisation of different auditing methods.”

Be honest about independence

In a ten-person business, true independence is rare. The new wording accepts that, but expects you to show you’ve tried to remove bias. Practical options include swapping auditors between departments, training a second person so nobody audits their own work, using an auditor from a sister company, or bringing in an external auditor for the areas where you’re closest to the work.

Check your auditors can use the tools

If an audit relies on screen sharing, cloud document systems, or video walkthroughs, make sure the auditor is competent with them and understands the data protection side. Record this in their competence file.

Define how you grade findings

The CQI says grading criteria should be “defined and communicated”. If your team uses Major, Minor, and OFI, write down what each means and make sure auditees know before the audit, not after.

For more on what typically goes wrong, see my guide to the top 10 nonconformities we see in SMEs. And remember that internal audit results should feed straight into your management review. If you’re also working through the ISO 14001:2026 changes, it’s sensible to align your updated audit programme with that work.

FAQs

When was ISO 19011:2026 published?

ISO 19011:2026, the fourth edition, was published by ISO in May 2026 (ISO’s life cycle records 27 May 2026). It replaces ISO 19011:2018. BSI publishes it in the UK as BS EN ISO 19011:2026.

Is there a transition period for ISO 19011:2026?

No. The CQI and IRCA state that, as a guidance standard, ISO 19011:2026 takes effect immediately on publication with no transition period.

Can my business be certified to ISO 19011?

No. ISO 19011 is a guidance standard, not a requirements standard, and organisations are not certified to it. It supports the internal and external audits required by standards such as ISO 9001, ISO 14001, and ISO 45001.

What is the biggest change in ISO 19011:2026?

The CQI describes expanded guidance on remote auditing as perhaps the most significant change. It draws on ISO/IEC TS 17012:2024 and expands Annex A to cover remote auditing methods and virtual locations.

Do internal auditors have to be independent under ISO 19011:2026?

The guidance no longer says internal auditors should be independent “if practicable”. Instead, where independence isn’t possible, every effort should be made to remove bias and encourage objectivity.

Do I need to update my internal audit procedure?

There’s no deadline, because ISO 19011 is guidance. However, it’s good practice to review your audit programme, competence records, grading criteria, and report templates against the 2026 edition at your next review.

Need a hand with your internal audits?

If your internal audits have slipped, or you’d simply like an independent pair of eyes on your system before your next certification visit, CAW Consultancy can carry them out for you. Our internal audits are £399 + VAT, and we can align your audit programme with ISO 19011:2026 at the same time.

Call 01257 824481, email Craig@cawconsultancy.co.uk, or visit www.cawconsultancy.co.uk.

If you’d rather build in-house skills, ISO Training Institute offers online ISO courses, and Compliance Master helps you track audits, findings, and actions in one place.

Sources

Craig Willetts is the founder of CAW Consultancy Business Solutions Ltd and a UK lead auditor with over 20 years’ experience across ISO management systems and UK security industry schemes.