Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    ISO 19011

    Definition

    International guidelines for auditing management systems: audit principles, programme management, audit conduct and auditor competence.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/iso-19011

    Scope: ISO 19011 is guidance and does not lead to certification; the 2026 edition replaced the 2018 edition.

    Sources checked: . Examples are editorial illustrations.

    What ISO says ISO 19011:2026 covers, and what it replaced

    ISO 19011:2026, Guidelines for auditing management systems, is the fourth edition, published in May 2026, and ISO shows ISO 19011:2018 as withdrawn. ISO describes it as guidance on the principles of auditing, managing audit programmes and conducting management system audits, and lists a framework for auditor competence and evaluation among the benefits. It is written for management system audits generally, with ISO 9001 and ISO 14001 audits as named examples. ISO says the audience includes organisations that run internal audit programmes, auditors performing first-, second- or third-party audits, certification and consultancy firms, and quality and EHS managers. Among the benefits it lists are a standardised audit process and methodology, guidance for audit programme management, principles for conducting audits and tools for continual improvement through audits.

    The status of the document is guidance. ISO answers that using ISO 19011 does not itself lead to certification: it supports the auditing of standards that can be certified, such as ISO 9001 and ISO 14001. Those standards have moved on as well. ISO's page shows ISO 9001:2026 as edition 6, published in September 2026, with ISO 9001:2015 withdrawn. An audit procedure written under the 2018 audit guidance may therefore cite an edition that is no longer current, so check which edition a procedure, a report template or a customer requirement names. This page relies on ISO's product pages and does not describe the content of the clauses, so what changed in the text is a question for the standard itself.

    A different standard answers a different question. ISO 31000:2018 is guidelines for risk management and, ISO says, is not certifiable either, although it provides guidance for internal or external audit programmes. Both are guidance documents, so an auditor still needs the requirements of the standard or procedure being audited as the criteria: ISO 19011 describes how to audit and does not say what to audit against. This page is general information, not legal advice or an accreditation statement.

    Sources opened :

    What an audit programme record holds in software

    • A programme record: objectives, scope, the audits planned across the period, responsibilities and resources, and the date the programme was reviewed.
    • For each audit, the scope, the criteria (the standard, procedure or contract audited against), the team and the dates.
    • Auditor competence records covering training, experience and any evaluation, so team selection can be justified.
    • Findings with the criterion each relates to, the evidence cited and the classification the company uses.
    • The audit report, its distribution and the date it was issued.
    • Follow-up of corrective actions and whether the audit was closed.
    • The edition of ISO 19011 that the audit procedure cites.

    ISO 19011, an audit checklist and a certification audit

    ISO 19011 is guidance on how to run an audit programme and individual audits, a checklist is a tool used within an audit, and a certification audit is carried out by an external body against a certifiable standard such as ISO 9001. A tool that holds checklists supports part of auditing, while the guidance also covers managing the programme and the competence of auditors, which sit outside the checklist screen.

    A hypothetical example: a programme that spans two standards

    This scenario is invented and describes no real organisation. A manufacturer certified to a quality and an environmental management system standard runs one audit programme. The programme record sets objectives, such as covering every process within each certification cycle, assigns responsibilities and keeps the audit schedule, and the audit procedure cites the edition of ISO 19011 it follows.

    For each audit the planner records the scope, the criteria and the team. One auditor's competence record shows training in environmental management but not in the quality standard, so the planner pairs that auditor with a colleague who has it and notes the reason. Findings are tied to the clause or procedure they relate to, a report is issued and corrective actions are followed to closure. At the programme review the manager sees which processes were audited and which are overdue, and that the audit procedure still cites the 2018 edition, so it is queued for update to the 2026 edition. The same screen lists the audit reports sent to top management and the date of each.

    Common misunderstandings about ISO 19011

    • ISO 19011 is not certifiable. ISO says it provides guidance and does not itself lead to certification.
    • It is not only for external auditors. ISO names internal audit programmes and first-, second- and third-party audits.
    • It is not the audit criteria. It guides how to audit, and what is audited against comes from the standard, procedure or contract in scope.
    • The 2018 edition is withdrawn. ISO shows ISO 19011:2026 as edition 4, published in May 2026.
    • A checklist is not the whole subject. The guidance also covers programme management and auditor competence.
    • It does not replace the text of the standard being audited. ISO 9001:2026 is edition 6, published in September 2026, and an audit against it needs that standard's own requirements.

    How ISO 19011 relates to other glossary terms

    ISO 19011 describes the auditing that other management system terms depend on.

    • ISO 9001: a quality management standard whose audits ISO names as an example for this guidance.
    • ISO 14001: an environmental management standard whose audits ISO also names as an example.
    • ISO 31000: risk management guidelines, which ISO also describes as providing guidance for audit programmes.
    • Management review: the top management review that audit results typically feed.

    Records and evidence that usually exist for audit programmes

    • The audit programme with its objectives and schedule.
    • Audit plans with scope, criteria and team.
    • Auditor competence and evaluation records.
    • Findings, evidence and reports.
    • Corrective action records with closure dates.
    • Programme review notes and the edition of the guidance cited.
    • Records of how audit results were reported to top management.

    What a software tool needs to capture for audit programmes

    • Programme-level records for objectives, schedule, scope coverage and review dates.
    • Audit scope and criteria fields tied to the standard or procedure and its edition.
    • Auditor competence profiles that can be used when assigning teams.
    • Findings linked to criteria and evidence, with attachments.
    • Report generation and a distribution log.
    • Corrective action follow-up that links back to the audit.
    • Coverage views that show what has and has not been audited across the cycle.

    Catalog profiles documenting audit-programme workflows

    The list follows the audit-programme rule. ISO 19011 is guidance without certification, so a listing does not show that a product follows it; ask how a product records programme management and auditor competence.

    Same rule for every product: tagged “Audit Management”, “Audits & Inspections” or “Internal Audit”, with a sourced audit-programme capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 45 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    Is ISO 19011 required for ISO 9001 or ISO 14001 certification?

    ISO describes ISO 19011 as guidance that supports auditing those standards, and says it does not itself lead to certification. Whether a certification body or a customer expects its use is stated in their own requirements. ISO lists ISO 9001:2026 as published in September 2026, with ISO 9001:2015 withdrawn.

    Which edition is current?

    ISO shows ISO 19011:2026 as edition 4, published in May 2026, with ISO 19011:2018 withdrawn.

    Does ISO 19011 apply to internal audits?

    Yes. ISO says the guidance serves organisations that run internal audit programmes as well as external audits, including first-, second- and third-party audits, and it names quality and EHS managers responsible for audits among its users.

    More standards terms

    Related guides