Introduction
ISO 19011 training is the core programme for everyone who plans, conducts and manages management system audits. The 4th edition of the standard was published on 27 May 2026, and ISO 19011:2018 was withdrawn the same day.
There is a critical difference here: ISO 19011 is a guidance standard, not a certification standard. For this reason no transition period was granted. There is no three-year preparation window as with ISO 9001 or ISO 14001 — the new edition became the reference text the moment it was published.
The practical consequence: if your internal audit procedure, auditor competence criteria and audit report templates are still based on the 2018 edition, this gap may come up at your next external audit.
Table of Contents
Which systems does ISO 19011 cover?
ISO 19011 is not specific to a single standard. It provides the methodological basis for internal and second-party audits of ISO 9001 (quality), ISO 14001 (environment), ISO 45001 (occupational health and safety), ISO 27001 (information security), ISO 50001 (energy), ISO 22000 (food safety) and other management systems.
Its scope is not limited to internal audit: supplier (second-party) audits also fall within this guideline. It is the reference text for purchasing and supplier quality teams running a supplier audit programme as well.
Even though automotive has audit approaches with their own methodology, such as VDA 6.3, ISO 19011 continues to set the general framework in terms of audit programme management, auditor competence and reporting practices.
What changed with ISO 19011:2026?
The revision is not a transformation that radically changes the understanding of auditing; it is an update that aligns the existing framework with digitalizing audit practice. The seven principles of auditing and the core of the process have been retained. The highlights:
Remote auditing becomes part of the standard. Remote audit practices that became widespread with the pandemic are no longer an exceptional method but an integral part of the standard. “Remote audit method” was added to the terms and definitions section as a new term, and subsequent terms were renumbered as a result of this addition.
The “virtual location” concept. A new concept was defined for audits conducted via cloud-based systems and video conferencing tools. Areas that have no physical address but need to be audited are now included in the audit programme.
Justifying the choice of method. When deciding whether an audit is conducted fully remotely, on site or in hybrid form, the deciding factor should not be habit but the level of risk, the audit scope and the quality of the evidence to be obtained. This decision should rest on a recordable justification.
Alignment with ISO/IEC TS 17012:2024. Remote audit methods were aligned with this technical specification and detailed in the annexes.
Sampling statement in the audit report. Stating which sampling approach was used in the report is emphasized. The aim is transparency about the scope and limits of the audit.
Strategic management of the audit programme. Audits are no longer merely calendar-driven routine activities; they are positioned as activities expected to be planned with the organization’s objectives, processes, changes and priorities in mind.
New elements to consider in the programme. It was emphasized that topics such as information security, data protection, the use of digital tools and climate change should be taken into account when establishing the audit programme.
Audit team leadership. What is expected of the lead auditor is not only conducting the audit but also guiding the team, allocating tasks correctly and ensuring coordination within the team.
Joint and integrated audits. Additional guidance was introduced on evaluating the risks that may arise in joint audits; integrated and multiple management system audits were updated.
Terminology and structural adjustments. The definition of “audit conclusion” was changed from the output of an audit to the outcome of an audit, and this change was carried through the text. It was clarified that the term “observer” does not cover technical experts. The presentation of the audit principles was restructured.
Why is there no transition period?
ISO 19011 is a guidance standard, not a requirements standard. No certificates are issued against it, so there is no transition period granted for moving certificates. The 2018 edition was withdrawn on 27 May 2026 and replaced by the 4th edition.
This does not mean “no need to hurry” — it means the exact opposite: there is no buffer period granted for preparation. Your responsibility to update your audit infrastructure started with the publication date.
Typical documents that need updating:
- Internal audit procedure (with remote/hybrid method and virtual location provisions)
- Auditor competence and evaluation matrix (including digital and remote auditing skills)
- Annual audit programme (with virtual locations included in the scope)
- Audit plan and audit report templates (including sampling statement and digital evidence references)
- Audit method selection record (risk-based on-site/remote/hybrid decision rationale)
- Auditor competence records and training plan
Who should attend ISO 19011 training?
- Internal auditors and lead auditors
- Audit programme managers
- Quality, environmental, OH&S and information security system officers
- Management representatives
- Purchasing and supplier quality teams conducting supplier audits
- Audit teams of organizations running an integrated management system
- Senior managers evaluating audit reports
There are no prerequisites. For experienced auditors the emphasis shifts to the differences introduced by the 4th edition and remote audit practice.
Training Content
Fundamentals of auditing
- Types of audit: first, second and third party
- The seven principles of auditing and their counterparts in practice
- The differences between audit, surveillance and inspection
- Auditor impartiality and the evidence-based approach
Managing the audit programme
- Building the programme on the organization’s objectives and risks
- Scope, frequency and prioritization criteria
- Reflecting information security, data protection and climate change elements in the programme
- Monitoring and reviewing programme performance
- Managing audit resources and the auditor pool
Conducting the audit
- Initiating the audit, document review, preparing the audit plan
- Opening meeting, fieldwork, evidence collection techniques
- Sampling approaches and the use of the sampling statement in the report
- Classifying findings, writing nonconformities
- Closing meeting and reporting
- Follow-up activities and verification of corrective actions
Remote and hybrid auditing
- The remote audit method: when it is suitable, when it is insufficient
- The virtual location concept and determining the scope
- Evaluating risk, scope and evidence quality in method selection
- Platform security, data protection and digital evidence management
- Common challenges in remote auditing and their solutions
Auditor competence
- Determining and evaluating competence criteria
- Adding digital and remote auditing skills to the competence matrix
- Monitoring auditor performance and continuous development
- Audit team leadership and task allocation
Practical exercises
Participants prepare an audit plan, write nonconformities and draw up an audit report using sample scenarios. In in-house programmes the exercises are run on your organization’s own procedures and audit templates.
Learning Outcomes
- Adapting the changes introduced by ISO 19011:2026 to your existing audit infrastructure
- Building an audit programme based on the organization’s objectives
- Making a justifiable choice between on-site, remote and hybrid methods
- Including virtual locations in the audit scope
- Writing evidence-based findings and preparing an effective audit report
- Structuring the auditor competence matrix according to the current requirements
Duration and Participation Options
Duration: 2 days in open-enrolment programmes. In in-house programmes, planned as 1–3 days depending on the scope and participant profile.
Participation type: Open enrolment or in-house.
Training method: In person (at your organization or in our training room), live online, on-demand recording.
Dates: Set according to demand.
Certificate of Attendance
Participants who complete the training receive a certificate of attendance. The certificate includes the participant’s name, training scope, date and duration. It can be used as evidence of competence in your auditor competence records and in audits.
Standard-Specific Internal Auditor Trainings
ISO 19011 provides the methodological framework; to audit against the clauses of a specific standard, standard-specific auditor training is required:
- ISO 9001 Internal Auditor Training
- ISO 14001 Internal Auditor Training
- IATF 16949 Internal Auditor Training
- VDA 6.3 Process Auditor Training
All of these programmes have been updated to the ISO 19011:2026 framework.
Beyond Training: Implementation Support
You can make use of our consulting services in every area where support is needed.
- Audit programme set-up and internal audit procedure update
- Design of the auditor competence matrix and evaluation system
- Adapting audit plan and report templates to the 2026 edition
- Independent internal audit and supplier audit services
- Readiness audit before the certification audit
Frequently Asked Questions About ISO 19011 Training
When was ISO 19011:2026 published? It was published on 27 May 2026. The 3rd edition, ISO 19011:2018, was withdrawn the same day.
Is there a transition period for ISO 19011:2026? No. ISO 19011 is a guidance standard, not a certification standard; since no certificates are issued against it, no transition period is granted. The new edition is the reference text from the moment it was published.
Can I obtain an ISO 19011 certificate? No. ISO 19011 is a guideline; organizations are not certified against it. At the end of the training, participants receive a certificate of attendance.
Which management systems does ISO 19011 training cover? The standard provides the methodological basis for internal and second-party audits of all management systems, including ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 50001 and ISO 22000. The training is run standard-independent.
Does this training replace ISO 9001 internal auditor training? Partly. ISO 19011 provides the audit methodology; to audit against the clauses of a specific standard you also need to take that standard’s training.
Can I audit remotely — does it count as valid? The 2026 edition made remote audit methods an integral part of the standard. What matters is justifying the method: on-site, remote or hybrid is chosen by evaluating the level of risk, the scope and the quality of the evidence to be obtained, and that decision is recorded.
How long does ISO 19011 training take? Open-enrolment programmes take 2 days. In-house programmes are planned as 1-3 days depending on content density.
Do our existing internal auditors need to be retrained? You are expected to be able to show that your competence records are based on the current edition. For experienced auditors, a short update programme focused on the differences of the 4th edition may be sufficient.