What Happened to Annex A? The Biggest Visible Change in ISO 19011:2026

The Change That Every Auditor Will Notice Immediately

Open a copy of ISO 19011:2018 and flip to the back. You will find Annex A sitting there with five subsections, each offering supplemental guidance on specific auditing topics. Now open ISO 19011:2026 and do the same thing. The structure has shifted noticeably. Annex A has been reorganised, expanded in some areas, and made considerably more practical in others. For auditors who have been using the 2018 edition as a reference, this is the change that will catch your eye first.

This article walks through exactly what happened to Annex A in the 2026 revision, why the changes matter in practice, and what they mean for how you plan and conduct audits. Whether you run internal audit programmes, conduct supplier audits, or work as a lead auditor for a certification body, the updated Annex A content is worth understanding properly.

Before we get into the detail, a quick reminder of what Annex A actually is. It is informative, not normative. That means the content does not impose requirements on you. It offers guidance to help you apply the normative clauses in Clause 4 through Clause 7 more effectively. Think of it as the practical companion to the rules. The 2026 edition has made that companion considerably more useful.

What Was in Annex A Under the 2018 Edition

Under ISO 19011:2018, Annex A contained five sections. These covered additional guidance on auditing management systems, guidance on auditor competence, additional auditing methods for specific contexts, auditing a virtual organisation, and guidance on sampling in audits. Each section was relatively brief and served as a supplement to the main body of the standard.

The 2018 Annex A was useful but felt somewhat disconnected from the day to day realities of modern auditing. Remote auditing, for example, was addressed only lightly, despite the fact that technology had already made remote audit methods common in many sectors. The guidance on competence was general. The section on sampling gave auditors a starting point but left significant gaps in practical application.

In short, the 2018 Annex A was adequate but thin. Auditors who wanted deeper practical guidance often had to look elsewhere.

The Restructure: What ISO 19011:2026 Changed

The 2026 revision reorganised Annex A around the practical challenges auditors actually face. The content has been updated, expanded, and in some cases entirely rewritten. Here is a section by section look at what changed.

A.1 Additional Guidance for Auditing Management Systems

This section remains but has been updated to reflect the broader range of management systems now being audited. The 2026 edition acknowledges that auditors increasingly work across integrated management systems covering quality, environment, safety, information security, and artificial intelligence simultaneously. The guidance in A.1 now gives more explicit direction on how to apply audit principles across these different contexts without losing consistency.

One practical shift is the stronger emphasis on process based auditing. The 2026 guidance reinforces that auditors should follow the process, not just tick clauses. If you are auditing a manufacturing organisation against ISO 9001 and ISO 14001 together, the updated A.1 guidance encourages you to trace a product through the system and pick up conformity evidence for both standards along the same process thread, rather than auditing each standard as a separate exercise.

This is something experienced auditors already do. But the updated guidance makes it explicit, which matters for auditor training and for organisations building their internal audit programmes.

A.2 Additional Guidance on Auditor Competence

This section has seen significant expansion. The 2018 edition gave general guidance on knowledge and skills. The 2026 version goes considerably further, addressing competence requirements for auditing in new and emerging contexts.

The most notable additions relate to technology and data. The 2026 Annex A acknowledges that auditors now encounter digital systems, automated processes, and data driven decision making as core parts of the management systems they audit. Auditors need enough competence to evaluate whether these systems are working as intended, even if they are not technology specialists.

The guidance also addresses AI systems specifically. As ISO 42001 gains traction as the management system standard for artificial intelligence, auditors are increasingly being asked to audit AI governance frameworks. The updated A.2 guidance sets out the kind of competence an auditor needs to do this credibly. This does not mean auditors must become data scientists. It means they need to understand AI risk concepts, impact assessment processes, and governance structures at a level sufficient to ask the right questions and evaluate the answers.

For those who want to understand how the 2026 edition treats auditor competence in the normative clauses, our article on auditor competence and evaluation under Clause 7 of ISO 19011:2026 covers the requirements in detail. Annex A.2 builds on those requirements with practical application guidance.

A.3 Additional Guidance on Managing an Audit Programme

This is one of the most practically useful additions in the 2026 Annex A. The 2018 edition touched on audit programme management but did not go deeply into the practical challenges. The 2026 version introduces more detailed guidance on risk based audit scheduling, prioritising audit resources, and responding to changes in the organisation's context.

The guidance now explicitly addresses the concept of audit programme risks. This includes risks such as auditor bias, undue influence from audit clients, and the risk that the audit programme becomes a compliance exercise rather than a genuine assurance mechanism. These are not abstract concerns. Any experienced auditor has seen audit programmes that have drifted into box ticking. The 2026 Annex A gives audit programme managers language and a framework to address these risks proactively.

There is also updated guidance on how to set audit programme objectives. The 2026 edition is clear that objectives should be specific and measurable, not vague statements about maintaining conformity. If your audit programme objective is simply to conduct audits in accordance with the standard, the updated guidance suggests you need to think harder about what the programme is actually trying to achieve.

For a detailed look at how the normative requirements for audit programme management work under Clause 5, see our article on managing an audit programme under Clause 5 of ISO 19011:2026. Annex A.3 provides the practical layer on top of those requirements.

A.4 Additional Guidance on Conducting Audits

This section has been substantially updated and is probably the most immediately useful part of the revised Annex A for practising auditors. The 2018 edition gave limited supplemental guidance on audit conduct. The 2026 version goes into considerably more practical detail across several areas.

The guidance on collecting audit evidence has been strengthened. The 2026 Annex A provides more direction on triangulating evidence from multiple sources, including document review, interviews, and direct observation. It reinforces that audit conclusions should rest on a sufficient body of evidence, not on a single data point or a single interview response.

The guidance on audit interviews has also been updated. The 2026 edition acknowledges that auditors operate in increasingly diverse workplace environments, including remote work settings, multilingual workplaces, and contexts where workers may have limited familiarity with formal audit processes. The updated guidance encourages auditors to adapt their interview approach to the context, using plain language and creating conditions where auditees feel comfortable providing honest information.

There is also new guidance on grading and classifying audit findings. The 2018 edition was relatively brief on this. The 2026 Annex A provides more direction on how to distinguish major nonconformities from minor ones, and how to handle findings that sit in the grey zone. This is a practical challenge that every auditor faces, and the additional guidance is welcome.

One important addition is guidance on closing meetings. The 2026 Annex A reinforces that all nonconformities identified during the audit should be presented and discussed with the auditee before the closing meeting concludes. This sounds obvious, but it is a point of failure in many audits where findings are communicated poorly or incompletely. The updated guidance sets a clearer expectation.

A.5 Additional Guidance on Remote Auditing

This is the section that most clearly reflects how much auditing has changed since 2018. The 2018 edition of ISO 19011 addressed remote auditing briefly and somewhat tentatively. By the time the 2026 revision was being developed, remote auditing had become a standard part of the auditing landscape. The 2026 Annex A responds to this reality with a dedicated, substantive section.

The updated guidance covers the planning considerations specific to remote audits, including how to assess whether a remote approach is appropriate for the audit objectives, what technology infrastructure is needed, and how to manage evidence collection when you cannot physically observe processes.

The guidance also addresses the limitations of remote auditing honestly. There are things you simply cannot assess effectively from behind a screen. Physical conditions, workplace culture, and the behaviour of workers in their actual environment are all harder to evaluate remotely. The 2026 Annex A encourages auditors and audit clients to make deliberate decisions about when remote auditing is appropriate and when an on site visit is necessary.

There is also updated guidance on the use of ISO/IEC TS 17012, the technical specification that provides additional guidance specifically for remote auditing. The 2026 Annex A positions this document as a companion resource for auditors who conduct remote audits regularly.

If you want to understand how remote auditing guidance has evolved across the 2026 edition more broadly, our article on remote auditing in ISO 19011:2026 and the role of ISO/IEC TS 17012 covers this in depth.

A.6 Additional Guidance on Audit Sampling

The sampling guidance in Annex A has been updated to reflect more sophisticated approaches to audit sampling. The 2018 edition gave a basic introduction to sampling concepts. The 2026 version goes further, addressing risk based sampling, statistical and non statistical approaches, and the factors that should influence sample size decisions.

The updated guidance is clear that sample sizes should be driven by risk, not by habit or convenience. Auditing the same five records every year because that is what you have always done is not a defensible sampling approach. The 2026 Annex A encourages auditors to think about what they are trying to conclude from their sample and to choose a sample size and composition that gives them a reasonable basis for that conclusion.

There is also updated guidance on how to document sampling decisions. This is important for audit trail purposes and for demonstrating that the audit was conducted with appropriate professional care.

What the Annex A Changes Mean for Internal Audit Programmes

If you manage an internal audit programme, the updated Annex A content has several practical implications.

First, your audit programme objectives need to be specific. Vague objectives will not satisfy the spirit of the 2026 guidance. Think about what your programme is actually trying to achieve in terms of assurance, improvement, and risk management, and write objectives that reflect those goals.

Second, your auditors need to be competent for the systems they are auditing. If your organisation has implemented an AI management system or a sophisticated digital quality system, your internal auditors need enough understanding of those systems to audit them credibly. The updated A.2 guidance makes this expectation clear.

Third, your sampling approach needs to be defensible. If you cannot explain why you chose the records you did, or why you interviewed the people you did, the updated guidance suggests you need to think more carefully about your sampling methodology.

Fourth, remote audit arrangements need to be deliberate. If your programme includes remote audit elements, the updated A.5 guidance encourages you to document the rationale for using remote methods and to assess whether those methods are appropriate for the audit objectives.

What the Changes Mean for Lead Auditors

For lead auditors working for certification bodies or conducting second party audits, the Annex A changes reinforce several expectations that the best auditors already meet.

The updated guidance on evidence collection and finding classification is a useful reference point for audit team management. When you are leading a team of auditors with different experience levels, the Annex A guidance gives you a common framework to reference when discussing how to classify a finding or how to approach a difficult interview situation.

The updated guidance on closing meetings is also worth noting. The expectation that all nonconformities are presented and discussed before the meeting concludes is not new in practice, but the 2026 Annex A makes it more explicit. If your current practice involves presenting findings in a closing meeting without prior discussion, the updated guidance suggests a different approach.

The competence guidance in A.2 is also directly relevant for lead auditors who are building their skills in new areas such as AI governance or integrated management system auditing. The updated guidance gives you a framework for assessing your own competence gaps and planning your professional development accordingly.

A Practical Observation From the Field

Having conducted audits across a wide range of sectors and management systems, the most striking thing about the updated Annex A is how much it reflects the realities of modern auditing practice. The 2018 edition was written at a time when remote auditing was the exception, integrated management systems were less common, and AI governance was not yet on the auditing radar.

The 2026 Annex A catches up with where auditing actually is. It gives auditors and audit programme managers better tools for navigating complexity, and it sets clearer expectations for what good audit practice looks like in a rapidly changing environment.

The informative nature of Annex A means it does not impose requirements. But in practice, the guidance in a well written annex shapes how the normative requirements are interpreted and applied. The 2026 Annex A is well written. Auditors who engage with it seriously will find it genuinely useful.

For those who want to understand the full scope of what changed between the 2018 and 2026 editions, our overview article on ISO 19011:2026 and what changed from the 2018 edition covers the complete picture across all clauses and annexes.

Updating Your Skills for ISO 19011:2026

The changes in ISO 19011:2026, including the updated Annex A, have practical implications for anyone involved in auditing. Whether you are an internal auditor, a quality manager running an audit programme, or a lead auditor conducting certification audits, the updated guidance is worth understanding properly.

At Audit Workshop, our auditor training courses are built around practical audit skills, not just theoretical knowledge. Our lead auditor and internal auditor courses across ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 42001, and other standards are delivered by experienced practitioners who have conducted hundreds of real audits. If you want to build the skills to apply the ISO 19011:2026 guidance effectively in your work, our courses give you the practical foundation to do that.