ISO 19011:2026 – Summary of Main Changes

This summary has been prepared based on the revised version or ISO 19011:2026 issued on 27th May 2026 and comparison with ISO 19011:2018. Copyright has been respected and the information below is our interpretation of the differences for educational purposes only; no direct copying of information from either standard has occurred. Minor changes in wording which have no effect on meaning are not included.

Potentially significant changes are noted in the first section of this summary and may require alterations to audit practice.

Other changes represent clarifications or codifications of practices that, in our experience, have generally been adopted in advance of changes in the standard or are unlikely to lead to a need for alterations in audit practice.

Potentially Significant Changes

Section 3 – “Terms and definitions”

Regulatory authorities are included as examples of third-party auditors
New definition (3.4) for “remote auditing method” added
Reference to ‘virtual location’ removed as the revised standard considers these as ‘remote audits’
The definition of an ‘observer’ distinguishes between observers and technical experts

Section 4 – “Principles of auditing”

The principle of independence has been amended to recognise the practicalities of internal audits particularly in small organisations.
Risk-based approaches are now referenced specifically for audit programmes as well as individual audits.

Section 5 – Managing an audit programme

General – there has been simplification and clarification regarding management of audits that are complex or at diverse locations.
Audit programmes should now take account of use of technical developments including digital technologies.
Two new considerations added for audit programmes – criteria for the participation of observers and considerations of the organisation’s context.
Evaluation of the risks to an audit programme has been expanded to include factors such as lack of or loss of competent auditors, selection of on-site versus remote audits, and departures from the audit programme.
New factors to be considered when determining risk to audit programmes include lack of leadership support and security of IT / data platforms.
Individuals managing audit programmes now must protect the integrity of the programme and ensure it is not compromised by undue influences.
Arrangements should be made to check that there is sufficient bandwidth for the necessary use of digital systems during the audit.
There should be consideration of travel restrictions such as visas and vaccinations. • Audit records should include feedback from auditees, auditors and other interested parties.

Section 6 – Conducting the audit

When determining the feasibility of an audit, there is a need to consider local, regional and world geopolitical events.
Advice that risk-based approaches can focus on complaints, system complexity, previous audits, regulatory changes and (in joint audits) coordination of different audit teams.
The opening meeting should include introductions to observers, guides, technical experts and interpreters and their role described.
The system for grading nonconformities should be defined and communicated.
Explicit statement that there is a need for caution in making recommendations that could affect the impartiality of the audit.
The audit report should not include any nonconformities that were not discussed during the audit or at the closing meeting.

Section 7 – Competence review of auditors

Assessment of auditor competence should include use of emerging technologies in audit conduct and their understanding of how to use these responsibly.
Knowledge of data protection and information security has been added as a competence.

Other Changes and Advice

Section 3 – Terms and Definitions

Further examples of ‘audit criteria’ are given in a not appended to the definition
Note 2 to the definition of ‘objective evidence’ in the 2018 version has been removed
References to ISO Guide 73 have been removed from the definition of ‘risk’

Section 5 – Managing and Audit Programme

Simplification of how audit resources should be allocated with consideration of avoidance of potential influences.
Additional examples added to the selection of audit methods and the composition of audit teams within audit programmes.
Audit programme objectives reference specific requirements of combined audits and moves focus from external organisations to those that are part of the supply chain.
Opportunities to improve audit programmes should consider advances in information and communication technologies.
The need for interpreters is part of audit planning.
‘Clean room’ attire becomes ‘industry appropriate.’
Any sector-specific management systems or auditing standards are called out as ‘criteria.’

Section 6 – Conducting the Audit

Handling of confidential information has been expanded to include storage, transfer and
release.

Audit plans should be presented to the audit client (as appropriate).

Recognition that audit activities can be influenced by previous or concurrent audits.
It should also include arrangements to manage risk to the auditee from the audit and any on site activities that might impinge on the audit.

Changes to the audit plan during the audit should be documented.

Section 7 – Competence Review of Auditors

The ability to act with fortitude has been removed from the list of auditors’ personal behaviours.

Monitoring of auditor competence should include analysis of feedback from auditees and stakeholders.

Appendix A – Additional Guidance

The continuing feasibility of the audit should be considered by the auditee, audit team leader and the audit client in the event of any incidents affecting the audit.
Consider the need for disposition / retention of audit documents after completion of the audit.
The use of judgement-based sampling should be justified in the same way as statistically based sampling.
Recognition that special care is required when regulatory requirements are criteria.
Minor changes in wording to bring out the importance of management leadership.
The section on audit of supply chain has expanded advice.
Some expansion of the advice on visiting the auditee’s location including the requirement for the auditee to provide security, health and safety requirements for access.
The section with advice on virtual audits has been removed. This has been incorporated into an expanded section with advice on using remote auditing methods.
Auditor competence and skills for use of remote audit methods should include use of appropriate technology.
Audit reporting advice calls out the need to describe why nonconformities do not meet audit criteria and the basis of grading (where used).