The 4th edition of ISO 19011 was published on 27 May 2026. ISO 19011:2018 was withdrawn the same day.
This standard differs from other revisions in one respect, and that difference is noticed late in most organizations: there is no transition period.
Why not?
ISO 19011 is not a requirements standard; it is a guidance standard. Unlike ISO 9001 or ISO 14001, no certificates are issued against it.
The concept of a transition period refers to the time granted for moving existing certificates to the new edition. Since there are no certificates to move, there is no period to grant.
The practical consequence: the new edition became the reference text the moment it was published. There is no option such as “let’s carry on with the old edition for another year.”
This does not mean “no need to hurry” — it means the exact opposite. In ISO 9001 you have three years of preparation time, in ISO 14001 three years. Here you have zero.
How does it affect you?
You have no direct certificate risk. But the indirect impact is real.
If your internal audit procedure, auditor competence criteria and audit report templates are based on ISO 19011, those documents now reference a withdrawn edition. This gap may come up at your next external audit.
In addition, when your auditor competence records are requested in IATF 16949 or customer audits, you are expected to demonstrate competence based on the current edition.
What changed in the 4th edition?
The seven principles of auditing and the core of the process have been retained. The notable changes are:
Remote auditing becomes part of the standard. Remote audit practices that became widespread during the pandemic are no longer an exceptional method but an integral part of the standard. “Remote audit method” was added to the terms and definitions section as a new term, and subsequent terms were renumbered as a result.
The concept of a “virtual location.” A new concept was defined for audits conducted via cloud-based systems and video conferencing tools. Areas that have no physical address but need to be audited are now included in the audit programme.
Justifying the choice of method. When deciding whether an audit is conducted fully remotely, on site or in a hybrid form, the deciding factor is not habit but the level of risk, the audit scope and the quality of the evidence to be obtained. This decision should rest on a recordable justification.
Alignment with ISO/IEC TS 17012:2024. Remote audit methods were aligned with this technical specification and detailed in the annexes.
Sampling statement in the audit report. Stating which sampling approach was used in the report is emphasized. The aim is transparency about the scope and limits of the audit.
Strategic management of the audit programme. Audits are no longer merely calendar-driven routine activities; they are expected to be planned with the organization’s objectives, processes, changes and priorities in mind.
New elements to consider in the programme. It is emphasized that topics such as information security, data protection, the use of digital tools and climate change should be taken into account when establishing the audit programme.
Terminology adjustments. The definition of “audit conclusion” was changed from the output of an audit to the outcome of an audit. It was clarified that the term “observer” does not cover technical experts.
Documents you need to update
A concrete checklist:
- Internal audit procedure — with remote/hybrid method and virtual location provisions
- Auditor competence and evaluation matrix — with digital and remote auditing skills added
- Annual audit programme — with virtual locations included in the scope
- Audit plan template
- Audit report template — including sampling statement and digital evidence references
- Audit method selection record — risk-based on-site/remote/hybrid decision rationale
- Auditor competence records and training plan
Not just internal audit
There is a common narrowing: ISO 19011 is assumed to be an “internal auditor guide.” Its scope is wider.
The standard also provides the methodological basis for supplier (second-party) audits. It is the reference text for purchasing and supplier quality teams running a supplier audit programme as well.
Next step
You can join our ISO 19011 training, where we work through what the standard brings and audit programme management hands-on, or make use of our consulting services to update your audit infrastructure.
