ISO 19011:2026 and the Shift from Conducting Audits to Designing Them

Why remote auditing is now embedded across the full audit lifecycle

About fifteen years ago, when I was still delivering classroom-based training, there was always a slide on remote auditing that raised some interesting discussions. Not that a lot of people had done a remote audit back then, but because it felt unfamiliar and slightly uncomfortable, and the discussion that followed was always framed around what it might look like if you ever had to conduct an audit without being on site.

Back then, remote auditing was treated as a single activity rather than an audit approach. The focus was always on the moment of delivery. How would you conduct interviews? How would you review records? How would you know you were seeing enough evidence? The assumption was that everything else in the audit stayed the same, and remote simply replaced the physical presence on the day.

Fast forward to now, and that same slide barely raises an eyebrow when it appears in virtual training. Not because remote auditing has become less important, but because it has become ordinary. In many cases, it is simply how audits are done, either fully remote or as part of a hybrid approach, depending on the context of the organisation and the objectives of the audit.

“A system is a network of interdependent components that work together to accomplish the aim of the system.”
- W. Edwards Deming

What’s interesting, and often overlooked, is that the biggest change hasn’t been in how audits are conducted, but in how they are designed. Fifteen years ago, remote auditing sat awkwardly in the middle of the process, disconnected from audit programmes, planning decisions, and post-audit activities. Today, the ISO/FDIS 19011 Guidelines for auditing management systems reflects a very different reality, where the choice of audit methods is embedded across the entire lifecycle of an audit rather than bolted on at the point of delivery.

That’s the shift worth paying attention to. Remote auditing is no longer something you “do”. It’s something you design for, from the moment an audit programme is established through to how findings are reported and communicated.

Remote Auditing Across the Audit Lifecycle

What has changed over time is not just where remote auditing sits within the audit process, but how early it is now considered in the design of an audit.

Audits are no longer planned on the assumption of physical presence, with remote methods added later if needed. Instead, audit programmes, planning activities, and delivery approaches are increasingly designed with remote, hybrid, or on-site methods in mind from the outset, supported by the appropriate use of technology informed by risk-based thinking across the full lifecycle of an audit.

At the audit programme stage, remote auditing is considered a part of how audits are structured over time, with decisions made about the suitability of remote, hybrid, or on-site approaches based on risk, complexity, system maturity, and the nature of activities being audited. At this level, technology capability and auditor competence are already relevant, as programme decisions increasingly assume digital access to information and virtual engagement with organisations.

During audit planning, those assumptions become more concrete. Planning now routinely includes consideration of digital platforms, document access, interview methods, time zones, confidentiality, and data security. Technology is no longer just a tool used during the audit, but part of how the audit method itself is designed, requiring auditors to apply judgement not only about what to audit, but how best to gather and assess evidence.

The opening meeting provides an opportunity to confirm the audit approach in practical terms, including how technology will be used, how communication will be managed, and how evidence will be shared. At this stage, the auditor’s digital competence and ability to clearly articulate the audit method play an important role in establishing confidence and setting expectations.

During the conduct of the audit, remote delivery places greater emphasis on professional judgement. Interviews are structured differently, evidence is often reviewed digitally, and observations rely more heavily on questioning techniques, screen sharing, and triangulation of information. The effective use of technology supports this process, but it is the auditor’s competence and judgement that determine whether audit conclusions are sound.

The closing meeting brings together the outcomes of the audit, with findings presented in a way that reflects both the evidence reviewed and the audit approach used. Clear communication, supported by well-managed technology and consistent application of judgement, ensures that conclusions are understood and accepted regardless of whether the audit was conducted remotely, on-site, or through a hybrid model.

Finally, the audit report and communication stage documents the audit outcomes and the basis for the conclusions reached. Transparency around the audit method, including the use of remote techniques and digital evidence, supports confidence in the findings and reinforces the credibility of the audit process.

Seen together, the lifecycle and its enabling capabilities reflect how auditing now operates in practice. Remote auditing is embedded across the audit programme, planning, delivery, and reporting, supported by technology, digital competence, and professional judgement that allow auditors to design and deliver effective audits in increasingly complex environments.

Your Next Steps

Lead Auditor Management Systems

This course gives you practical, real-world training in how to lead and manage audits across any management system. You will learn to plan audits, assign team responsibilities, gather and evaluate evidence, write reports and guide organizations through the audit process.

Learn more

1. Review your audit programme through a design lens

Check where decisions about remote, hybrid, and on-site audits are made, and whether they are clearly linked to audit objectives and risk.

2. Challenge your audit planning approach

Confirm that remote auditing is deliberately designed into planning activities, rather than assumed and adjusted during delivery.

3. Reflect on your capability as an auditor

Consider whether your skills support effective auditing across different delivery methods, including risk-based decision making and confident use of technology.  

Continue the Conversation with the LTS Podcast

This article is just the beginning. Join us for the extended discussion on the podcast, available on Spotify and YouTube.