ISO 19011:2026: What Changed in the Standard Governing Management System Audits (and Why the New Guidance Already Applies to You)

On 27 May 2026, ISO published the fourth edition of ISO 19011 - Guidelines for auditing management systems (46 pages, developed by committee ISO/PC 302). It cancels and replaces the 2018 version.

Here is the detail most people have not yet noticed: because it is a guidance standard, rather than a set of certifiable requirements, ISO 19011:2026 has no transition period. There is no three-year adjustment window. The guidance applies from publication. Anyone conducting, planning or supervising audits is already working under the new reference.

If you audit a management system, or engage someone who does, this article maps the changes. We move from the overview to the detail. By the end, you will understand why, in regulated sectors such as medical devices, this update is much more than an editorial adjustment.

What is ISO 19011, and why is it everywhere?

ISO 19011 is the standard that explains how to audit. While ISO 9001, ISO 13485 and ISO 14001 state what a management system needs to contain, ISO 19011 explains how to conduct its audit: how to establish the programme, select auditors, plan, collect evidence, report and follow up.

It underpins internal (first-party) and supplier (second-party) audits of practically any management system. That is why, when ISO 19011 changes, the way audits are conducted changes across all sectors at once.

For those who already know the 2018 version, the good news is that its structure remains. There are still seven clauses and seven auditing principles: integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach. The 2026 edition is a technical revision: it updates the content without rewriting the foundations. You do not need to learn auditing again; you need to recalibrate where the standard has raised the threshold. The substantive changes carry more weight than the label "technical revision" might suggest.

What has changed in ISO 19011:2026?

Here are the differences between the two editions, point by point:

1. Remote and hybrid auditing: from an exception to a method designed into the programme

This is the most significant change. In the 2018 edition, remote auditing was almost an appendix. In 2026, it is incorporated throughout the audit cycle.

The standard now includes a formal definition of a "remote auditing method", aligned with ISO/IEC TS 17012:2024, the technical specification dedicated to using remote auditing methods. Annex A has been expanded with practical guidance on remote and hybrid methods and managing virtual locations.

More significant than the definition is that choosing between on-site, remote and hybrid auditing is no longer merely an execution decision; it is an audit programme design decision (Clause 5). The interpretation established among auditing bodies is clear: remote auditing has moved from something you perform to something you design, from the programme itself through to how findings are reported. The programme must state which methods will be used.

2. Virtual locations officially enter the scope

The 2026 edition formally recognises virtual locations: online environments where an organisation carries out processes or provides services, such as cloud systems, SaaS platforms and digital workspaces.

In many organisations, much of the operation no longer takes place on a traditional factory floor. The standard guides auditors to treat this digital environment as a real auditable location, with its own processes, responsibilities and evidence.

3. Digital evidence: reliability is now a requirement

The standard reinforces an established principle with renewed weight: only information that can be verified constitutes audit evidence. It goes further: auditors must assess the reliability of evidence, ensure it is specific and traceable, and record how it was obtained, a requirement carrying even greater weight when collection is remote.

In practice, this establishes criteria for what was previously informal: a screenshot without context, a recording without consent or an electronic record collected without a trace no longer supports a finding.

4. Auditor competence: digital skills are no longer optional

Clause 7, on competence, has been expanded. Auditors in 2026 need to demonstrate skills in remote and hybrid auditing, assessing digital evidence, cybersecurity awareness and communication in digital environments, as well as judging the suitability of the technology used, including emerging technologies that support auditing.

The message is clear: knowledge of standards alone is no longer sufficient. Without digital competence and sound judgement about electronic evidence, the auditor cannot keep pace with the standard.

5. Risk is reinforced throughout the programme

The risk-based approach, already present in 2018, has been reinforced across audit programme management. Method selection (remote, on-site or hybrid), the security of the platforms used and audit continuity in unforeseen circumstances are treated as risk issues, considered during planning rather than improvised on the day.

6. Supply chains and outsourcing come into focus

The 2026 edition recognises the growing complexity of interconnected and outsourced operations. The standard reinforces assessment of the organisation within its supply chain and understanding where significant decisions, controls and outsourced functions are actually managed - beyond the company's own walls.

For supplier auditors, this directly raises the threshold: the auditor needs to see the process where it actually takes place, even when part of it has been outsourced.

What does ISO 19011:2026 change for medical device auditors?

Everything above applies to any management system. Yet in one sector these changes go beyond process improvement to become direct regulatory risks: medical devices and healthcare products.

Consider someone auditing under ISO 13485, MDSAP, MDR 2017/745 or ANVISA RDC 665. For this professional, each ISO 19011:2026 change has a concrete consequence:

• Remote auditing at a medical device manufacturer is more than a convenience; it is scrutinised by regulators such as the FDA, ANVISA, Health Canada, TGA and PMDA (the five MDSAP participants). A poorly chosen method or remote evidence collected without clear criteria can compromise the entire audit outcome.
• Verifiable evidence connects directly with data integrity (the ALCOA+ principles already familiar to the sector through GMP). An electronic record collected through a weak process will not withstand a regulatory audit.
• Data protection and information security in an environment handling clinical and production data are matters of serious nonconformity, rather than optional good practice.
• Risk-based thinking connects with ISO 14971 (medical device risk management), which these professionals already apply.

In other words, ISO 19011:2026 has raised the threshold precisely where medical device auditing is most sensitive. The cost of getting it wrong here is more than an observation in a report: it is certification delays, blocked market access, a recall or suspension.

An honest assessment: the 2026 version is not difficult to understand. The challenge is applying it well in a regulated environment, where every decision about methods, evidence and data protection carries the weight of an official audit. This is where knowing the standard and mastering the audit diverge.

What should you do now about ISO 19011:2026?

If you are an auditor or quality professional, review your audit programme against clauses 5, 6 and 7. Do your ICT, digital evidence and data protection skills meet the level now required by the standard?

If you are a manager or director, are your internal audit team and supplier auditors already operating under ISO 19011:2026? An audit conducted against the old benchmark in a regulated sector is a costly risk.

If you want to enter the field, this is an excellent moment. Those who master the new version early are more valuable in the market than those who have to catch up later.

Going further

This article has covered the overview. Applying ISO 19011:2026 to auditing medical devices and regulated environments (with MDSAP, ISO 13485, MDR and RDC 665) is a deeper subject, where every change in the standard meets practical examples and the common errors that generate findings.

That is precisely the focus HSC addresses systematically in its dedicated training programme. Would you like to discuss how to apply ISO 19011:2026 in your regulated operation?

ISO 19011:2026 is not difficult to understand. The challenge lies in applying it well in a regulated environment, where every decision about methods, evidence and data protection carries the weight of an official audit. This is where the difference between knowing the standard and mastering the audit truly emerges.

HSC Global specialises in this field: certified by Exemplar Global as an RTP for MDSAP, with leadership that has worked at BSI and a dedicated focus on the medical device sector.

For those seeking a structured understanding of the standard, HSC offers ISO 19011:2026 Update (24h, live, with Exemplar Global certification). Would you like to find out more about the training?

"The same certificate. A different authority behind it."

Frequently asked questions about ISO 19011:2026

When was ISO 19011:2026 published?

The fourth edition was published on 27 May 2026, cancelling and replacing ISO 19011:2018 (the third edition).

Does ISO 19011:2026 have a transition period?

No. As a guidance standard, rather than a set of certifiable requirements, it has no transition period: the guidance applies from publication.

Is ISO 19011 a certifiable standard?

No. It provides guidance on how to conduct management system audits (internal and supplier audits). Certification bodies follow ISO/IEC 17021-1; ISO 19011 is the good practice reference for first- and second-party auditing.

What are the most significant changes from ISO 19011:2018 to 2026?

The main changes are remote and hybrid auditing as a formal method (aligned with ISO/IEC TS 17012:2024), recognition of virtual locations, requirements for reliable digital evidence, expanded auditor competence (digital skills and cybersecurity), reinforcement of the risk-based approach and greater focus on supply chains and outsourcing.

Does ISO 19011:2026 change anything for medical device auditing?

Yes, in practice. In audits under ISO 13485, MDSAP, MDR or RDC 665, decisions about remote methods, evidence integrity and data protection carry direct regulatory audit weight.

Sources and references

• ISO - ISO 19011:2026 - Guidelines for auditing management systems (4th edition). iso.org/standard/88984.html
• ISO/IEC - ISO/IEC TS 17012:2024 - Conformity assessment: Guidelines for the use of remote auditing methods in auditing management systems. iso.org/standard/84718.html
• CQI | IRCA - ISO 19011:2026 revision: guidance for management system auditing. quality.org
• TRECCERT - ISO 19011:2026 Is Here: What the New Standard Means for Management System Auditing. treccert.com
• Auditor Training Online - ISO 19011:2026 and the Shift from Conducting Audits to Designing Them. blog.auditortrainingonline.com

Informational content based on public sources about ISO 19011:2026, consulted in June 2026. For application, consult the complete official standard.