ISO 19011:2026: review the way your audit programme works

PRACTICAL GUIDANCE

The starting point

The fourth edition of the auditing guidance was published in May 2026. Use the edition change as a prompt to examine objectives, sampling, competence and follow-up in your own audit programme.

Guidance with a defined purpose

ISO’s catalogue records ISO 19011:2026, edition 4, as published on 27 May 2026 and identifies the 2018 edition as withdrawn. ISO 19011 provides guidance on auditing management systems; it is not a standard against which an organisation obtains management-system certification.

This briefing does not claim a clause-by-clause comparison of the paid editions. The practical review below is our suggested way to assess the usefulness of an audit programme. Use authorised copies of the relevant publications for a formal methodology update.

Ask what each audit is intended to establish

Start with a decision that the audit should support. A high-risk handover, a recurring complaint or a major system change may justify deeper sampling than a stable, low-risk administrative process. Record the reasoning so future programme changes can be explained.

Separate the programme from the plan for an individual audit. The programme sets coverage and priorities over time; the plan turns a specific objective into activities, participants and evidence requests.

• State the audit objective and the criteria that will be used.
• Choose samples that include exceptions and recent changes.
• Check competence and conflicts before assigning the work.
• Identify when remote methods cannot provide sufficient evidence.

Make conclusions traceable

A useful finding tells the reader what was expected, what was observed and why the difference matters. A missing document is not a complete explanation if the real issue is an ineffective control. Conversely, an auditor’s preferred template is not a requirement unless it forms part of the agreed criteria.

Record sampling limitations and contradictory evidence. Treat unavailable evidence as uncertainty to resolve, rather than converting it automatically into either conformity or a nonconformity.

Test the result of corrective action

Ask what would demonstrate that the cause has been addressed. A training attendance record or updated procedure may show an activity happened; a later sample can help establish whether behaviour or results changed.

Use the audit brief to identify the process, decision and evidence gap you want to investigate. Keep organisational accountability with management and any certification decision with the independent certification body.

Related guidance and practical next steps