Why ISO 19011:2026 Matters for Your Audit Programme
If you are responsible for internal audits in your organisation, ISO 19011:2026 is the document you should be working from. It is the international guideline for auditing management systems, and the 2026 edition brought meaningful updates that affect how audit programmes are structured, managed, and evaluated.
On this page
This article walks you through how to build an internal audit programme that genuinely reflects the guidance in ISO 19011:2026. Not a tick-box exercise. A programme that adds value, catches real problems, and holds up to scrutiny from an external auditor.
Whether you are setting up a programme from scratch or refreshing one that has grown stale, the principles here apply. We will cover the structure of a sound programme, how to apply risk-based scheduling, how to manage auditor competence, and what the 2026 edition specifically changed that you need to account for.
What an Audit Programme Actually Is
Before getting into the how, it is worth being clear on what an audit programme is. ISO 19011:2026 defines it as a set of one or more audits planned for a specific time frame and directed towards a specific purpose. It is not a single audit plan. It is the overarching framework that governs all your internal audits across a defined period, typically a year.
A well-built audit programme answers these questions:
- What will be audited, and why?
- When will each audit take place?
- Who will conduct each audit?
- What criteria will be used?
- How will results be recorded and followed up?
- How will the programme itself be reviewed for effectiveness?
If your current programme cannot answer all of those questions clearly, that is where to start.
Exemplar Global Certified Training ProviderRTP No. 310970
Clause 5 of ISO 19011:2026: The Foundation of Your Programme
Clause 5 of ISO 19011:2026 deals specifically with managing an audit programme. It is the most directly applicable section for anyone building or running internal audits. Understanding what it requires gives you the structure you need.
Establishing the Audit Programme
The first step is establishing the programme with clear objectives. ISO 19011:2026 is explicit that audit programme objectives should be set before the programme is designed. These objectives drive everything else, including scope, frequency, and auditor selection.
Typical objectives for an internal audit programme might include:
- Verifying conformity with the requirements of the applicable management system standard
- Assessing whether the system is effectively implemented and maintained
- Identifying opportunities for improvement
- Providing information to management for the management review
Do not just copy these from a template. Think about what your organisation actually needs from internal audits this year. If you had a cluster of nonconformities in a particular area during your last external audit, that shapes your objectives. If you have recently changed a key process, that shapes them too.
Risk-Based Scheduling: Deciding What Gets Audited First
One of the most important contributions of ISO 19011 to audit practice is the concept of risk-based audit scheduling. The 2026 edition reinforces this strongly. Not every process or area of your management system carries the same risk, and your audit schedule should reflect that.
Higher-risk areas should be audited more frequently or with greater depth. Lower-risk, stable areas can be audited less often. This is not about skipping things. It is about allocating your audit resources intelligently.
When deciding what to prioritise, consider:
- Previous audit results, including any outstanding nonconformities or recurring issues
- Significant changes to processes, personnel, equipment, or the operating environment
- Regulatory or legal requirements that carry compliance obligations
- Customer complaints or feedback pointing to systemic problems
- Processes that are critical to product or service quality, safety, or environmental performance
- Areas where the organisation has limited visibility or control
For example, if your procurement process has generated three nonconformities in the past two years and you recently changed suppliers, that process should sit near the top of your audit schedule. A stable administrative process with a clean history can be scheduled less frequently.
For more on how to apply this thinking in practice, see our article on risk-based audit scheduling.
New Considerations in the 2026 Edition: Climate Change and Digital Tools
The 2026 edition of ISO 19011 introduced two notable new considerations for audit programme managers: climate change and the use of digital tools in auditing.
Climate change is now explicitly mentioned as a factor that may affect the risks an organisation faces and therefore the focus of its audits. If your organisation operates under ISO 14001 or has significant environmental obligations, your audit programme should account for climate-related risks as part of its scheduling logic.
Digital tools, including remote auditing platforms, document management systems, and data analysis software, are also addressed. The 2026 edition acknowledges that auditors increasingly use these tools and that audit programmes should consider their appropriate use. This does not mean you must use technology. It means your programme should be deliberate about when and how it is used, and that auditors using these tools must be competent to do so.
Our article on climate change and digital tools in audit programmes explores both of these additions in detail.
Building the Programme Structure
Defining Scope, Criteria, and Methods
For each audit in your programme, you need to define three things before you schedule it: scope, criteria, and method.
Scope defines what is included, which processes, locations, time periods, and activities. Be specific. A scope that says “quality management system” tells you nothing useful. A scope that says “purchasing process including supplier evaluation, purchase orders, and goods receipt at the Brisbane facility for the period January to June 2025” tells you exactly what the auditor is expected to cover.
Criteria are the requirements against which conformity is assessed. For an internal audit, this typically includes the relevant clauses of the ISO standard, your own procedures, work instructions, and any applicable legal or regulatory requirements. If you are auditing a specific process, pull out the documented procedure and use it as part of your criteria.
Method refers to how the audit will be conducted. Will it be on-site or remote? Will it involve interviews, document review, observation, or a combination? The 2026 edition gives specific attention to remote auditing as a legitimate method, provided the auditor is competent in using the relevant tools and the method is appropriate for the audit objectives.
Setting Audit Frequency
ISO standards like ISO 9001, ISO 14001, and ISO 45001 require that internal audits be conducted at planned intervals, but they do not specify how often. ISO 19011:2026 fills this gap with guidance rather than prescription: frequency should be determined by risk, complexity, and the results of previous audits.
A practical approach is to categorise your processes or areas into tiers:
- High risk or high significance: Audit at least annually, possibly more often if issues are recurring or changes are frequent
- Medium risk: Audit annually as part of a standard rotation
- Low risk, stable: Audit every 18 to 24 months, ensuring full coverage of the management system within each certification cycle
Whatever frequency you choose, document your rationale. An external auditor will ask why certain areas are scheduled the way they are. “Because we always have” is not a defensible answer. “Because this area had two nonconformities last year and we changed the process owner in March” is.
Selecting and Assigning Auditors
Auditor selection is one of the most commonly mishandled parts of audit programme management. Two principles from ISO 19011:2026 apply here: competence and impartiality.
Auditors must be competent for the audits they are assigned to. Competence in ISO 19011 terms means a combination of knowledge, skills, and personal attributes. An auditor needs to understand the standard being audited against, the processes being examined, and how to gather and evaluate evidence. They also need the interpersonal skills to conduct interviews effectively and the professional judgement to distinguish conformity from nonconformity.
Impartiality means auditors must not audit their own work. This is a firm requirement. If you have a small team, you may need to rotate auditors across departments or bring in an external resource for certain areas. The principle is clear: independence is not optional.
When assigning auditors, document their qualifications and the basis for their selection. This becomes part of your audit programme records and demonstrates that your programme is managed systematically.
For a deeper look at what ISO expects from internal auditors in terms of competence, see our article on internal auditor competence.
Running the Programme: From Plan to Execution
Preparing Individual Audit Plans
Each audit within your programme needs its own audit plan. This is a working document, not a formality. A good audit plan includes:
- The audit objectives, scope, and criteria
- The date, duration, and location of the audit
- The names of the auditor and auditee
- The processes or areas to be covered and the time allocated to each
- The documents to be reviewed in advance
- The method to be used
Share the plan with the auditee before the audit. This is not about giving people time to hide problems. It is about professional practice. Auditees who know what is coming can prepare relevant records, arrange for the right people to be available, and engage meaningfully with the process.
Conducting Audits That Generate Useful Evidence
The quality of your audit programme depends entirely on the quality of the individual audits within it. An audit that produces vague findings, unsupported conclusions, or poorly written nonconformities undermines the whole programme.
ISO 19011:2026 describes evidence-based auditing as a core principle. Every finding, whether a nonconformity, an observation, or an opportunity for improvement, must be supported by objective evidence. That means specific records, direct observations, or statements that can be verified. Not impressions. Not assumptions.
During the audit, use a mix of methods: review documents and records, interview relevant personnel at different levels, and observe processes in action where possible. Triangulate across these three sources. If a procedure says one thing, the records show another, and the operator describes a third approach, you have found something worth investigating.
Reporting and Follow-Up
Every audit in your programme should produce a written report. The report is the formal output of the audit and the basis for follow-up action. It should be clear, factual, and complete. Anyone reading it should understand what was audited, what was found, and what action is required.
Nonconformities raised during internal audits require corrective action. The audit programme manager is responsible for tracking these through to closure. This is not optional. ISO 9001 Clause 9.2, ISO 14001, and ISO 45001 all require that audit findings are reported to relevant management and that corrective actions are taken without undue delay.
Build a simple tracking system into your programme. A corrective action register that captures the finding, the root cause analysis, the planned action, the responsible person, the target date, and the verification of effectiveness is sufficient. You do not need expensive software. A well-maintained spreadsheet works if it is used consistently.
Reviewing and Improving the Programme Itself
This is the step most organisations skip, and it is where audit programmes stagnate. ISO 19011:2026 requires that the audit programme be reviewed and evaluated. The person managing the programme should periodically assess whether it is achieving its objectives and make adjustments as needed.
Questions to ask when reviewing your programme:
- Were all planned audits completed on schedule? If not, why not?
- Did the audits cover the areas of highest risk?
- Were findings acted upon effectively and within agreed timeframes?
- Did the programme provide useful information for the management review?
- Were auditors competent and impartial for the audits they conducted?
- Did any audits identify systemic issues that should change how the programme is structured?
Feed the answers into your next programme cycle. A programme that never changes is a programme that has stopped paying attention to the organisation it is supposed to be serving.
The management review is also an important output point for your audit programme. Results of internal audits are a mandatory input to management review under ISO 9001, ISO 14001, and ISO 45001. Make sure your programme is generating the kind of information that management can actually use, not just a list of closed nonconformities.
Exemplar Global Certified Training ProviderRTP No. 310970Common Mistakes to Avoid
After conducting hundreds of external audits, a few patterns emerge in how internal audit programmes go wrong. Watch out for these:
- Scheduling audits too close to the external audit: This creates a scramble and means findings do not have time to be properly addressed before the certification body arrives.
- Treating the audit checklist as the audit: Checklists are a tool, not a substitute for professional judgement. Auditors who only tick boxes miss the systemic issues that matter most.
- Failing to follow up on findings: A nonconformity that is raised but never properly closed is worse than useless. It creates a false sense of security and will be noticed by your external auditor.
- Assigning auditors to their own areas: Impartiality is not negotiable. Rotate auditors or bring in external support where independence cannot be maintained.
- Not adjusting the programme when the organisation changes: A programme built on last year's risk profile may miss the most significant risks this year. Review and update as the organisation evolves.
For a practical look at how the management of an audit programme is addressed in ISO 19011:2026, our article on managing an audit programme under Clause 5 of ISO 19011:2026 goes into the clause requirements in detail.
Getting Trained to Manage an Audit Programme Properly
Building and managing an internal audit programme is a skill. It requires an understanding of the standard you are auditing against, the principles of auditing from ISO 19011, and the practical experience to make judgements about risk, evidence, and findings.
If you are new to this role, or if you want to formalise skills you have developed on the job, a structured internal auditor training course gives you the foundation you need. If you are responsible for leading audits or managing a programme across multiple standards or sites, a lead auditor qualification gives you the deeper competence the role demands.
At Audit Workshop, our internal auditor and lead auditor courses are built around real audit practice, not just theory. Courses are available for ISO 9001, ISO 14001, ISO 45001, ISO 27001, and other standards, with both live virtual and self-paced options to suit working professionals. If you are building or rebuilding your organisation's internal audit programme, training is one of the most direct investments you can make in getting it right.
