ISO 19011:2018: Updated Guidance for Auditing Management Systems
The third edition of ISO 19011 was published in July 2018. It adds a risk-based approach to the principles of auditing and expands the guidance on managing an audit programme.
Key points
- ISO 19011:2018 was published in July 2018 and replaces the 2011 edition.
- A seventh principle of auditing was added: the risk-based approach.
- The guidance applies to internal audits and supplier audits; certification audits follow ISO/IEC 17021-1.
What the standard is for
ISO 19011 gives guidance, not requirements. It is used by organisations that run internal audits and audits of their suppliers, and it is the reference for auditor training in every management system discipline.
What changed
- The risk-based approach as a principle: audit planning, conduct and reporting focus on what matters most
- Expanded guidance on managing the audit programme, including programme risks
- More on audit planning and on auditing leadership, context and risks and opportunities
- Wider generic competence requirements for auditors
- Recognition of remote audit methods and virtual locations
What to do with it
Update the internal audit procedure and the audit programme so that frequency and depth reflect risk and past results, not a fixed annual calendar. Refresher training for internal auditors is the simplest way to put the new edition into practice.