ISO 19011:2026 Internal Audit Procedure: 7 Essential Edits

Auditing Management Systems · 2026 Procedure Revisions

Revising your internal audit procedure is the single most practical move an organization can make in response to the 2026 wave of ISO updates, and most teams need a handful of targeted edits rather than a rewrite. Three documents are driving the work at once: ISO 19011:2026, the newly published guidance on how management system audits are designed and delivered, and two requirements standards — ISO 14001:2026 in April and ISO 9001:2026 on 16 September — that now both require every internal audit to have defined objectives. This article walks through the seven essential edits your procedure needs, what authority sits behind each one, and how to roll them out without disrupting a program that already works.

The Three Drivers

Why Your Internal Audit Procedure Needs Revising in 2026

Three Drivers. One Document.

For most organizations the internal audit procedure is a single controlled document serving every management system the company runs — quality, environmental, safety, healthcare, and medical device alike. That makes it the natural place to absorb the 2026 changes once, cleanly, rather than scattering edits across separate systems. Three forces are pushing on that document this year: one piece of guidance and two hard requirements, and they carry very different weight.

The first driver is guidance. ISO 19011:2026 was published on 27 May 2026 as the fourth edition, withdrawing ISO 19011:2018 on the same day. ISO’s own list names exactly two: remote-auditing guidance brought in from ISO/IEC TS 17012, and a wider Annex A covering remote methods and virtual locations. Because ISO 19011 is guidance rather than a requirements standard, it applies immediately, with no transition period, and no clause of it can be raised as a nonconformity. The full picture of what shifted is covered in MSI’s companion analysis of the ISO 19011:2026 changes; this article translates the guidance into the specific procedure edits it implies.

The second driver is a hard requirement. ISO 14001:2026, published 15 April 2026, revised the internal audit clause so that defining scope and criteria for each audit is no longer enough — each internal audit must now also state defined objectives, and the audit program itself must be available as documented information. This is a normative “shall,” and certified organizations are working against a transition deadline of 30 April 2029. MSI’s ISO 9001 and 14001 transition guide sets the wider sequencing out, and the ISO 14001 standard overview covers the certificate mechanics.

The third driver arrived on 16 September 2026, when ISO announced the publication of ISO 9001:2026. Its Clause 9.2.2 now asks the organization to plan the audit program as well as establish and maintain it, and item a) requires the audit objectives, criteria and scope to be defined for each audit. Evidence of the program’s implementation and of audit results must now be available rather than retained. Correction and corrective action without undue delay stay in the clause, now as item d).

Beneath the clause, ISO 9001:2026 now cross-refers readers to ISO 19011 — so the guidance behind Edits 2, 3 and 4 is no longer a separate document your quality auditors can ignore. ISO 9001:2015 certificates cease to be valid after 30 September 2029; MSI’s ISO 9001:2026 executive briefing translates the wider revision for leadership.

One correction still worth making: per-audit objectives are not a new idea in the ISO standards. ISO 7101:2023 Clause 9.2.2 a) has required audit objectives since 2023, and healthcare organizations have operated under that requirement for three years. What changed in 2026 is that the obligation reached the two standards most organizations actually hold. If you run an integrated system with a healthcare arm, the field you need may already exist in one corner of your business, as MSI’s ISO 7101 healthcare quality overview explains. MSI’s read on how the 2026 revisions interlock is set out in its overview of the 2026 revisions and certification strategy.

Edit 1 · ISO 9001:2026 and ISO 14001:2026 Clause 9.2.2

Edit 1 — Make Audit Objectives a Required Field in Your Internal Audit Procedure

Define. Document. Deliver.

Under the prior editions of both standards, an internal audit plan defined two things for each audit: the scope, meaning which processes, sites and activities are included, and the criteria, meaning the requirements being audited against. The 2026 revisions add a third. An objective is the purpose of the specific audit — “confirm that corrective actions from the previous environmental audit were effectively implemented,” or “verify that the new change-management process is operating as designed.” Scope tells the auditor where to look; criteria tell the auditor what to measure against; the objective tells the auditor what the audit is trying to learn.

In practice this edit is small but exacting. Your internal audit procedure should require that every audit plan, schedule entry and audit report carries an explicit objective, and that the objective drives the audit design rather than being backfilled afterward. The discipline pays off: audits with a clear objective are sharper, shorter and more useful, because the auditor knows exactly what conclusion the audit is meant to support. This is the same outcome-focused thinking MSI applies in its guide to internal audit planning and in the planning phase of internal audits, where a well-framed objective is what separates a meaningful audit from a checklist traversal.

For organizations running an integrated system, building the objectives field into the shared internal audit procedure once means every standard inherits the requirement at the same time — including ISO 45001 and ISO 13485, which do not yet ask for it. That is the structural efficiency MSI describes in its guide to integrated management system implementation and across the wider integrated management systems family. The equivalent equipment-side discipline is set out in MSI’s guide to control of monitoring and measuring equipment, where the same “what would settle this” logic applies.

Edit 2 · Method Selection

Edit 2 — Add a Method-Selection Step to Your Internal Audit Procedure

Choose. Justify. Record.

Before this edition, remote auditing tended to sit awkwardly outside the procedure — something teams did when travel was inconvenient, without a documented basis. Both of the headline ISO 19011:2026 changes concern remote auditing, which tells you where the attention has moved. Your internal audit procedure should add a step recording, for each audit, whether it will be conducted on-site, remotely, or as a hybrid, and the rationale for that choice. A review of records may be done remotely; observing a high-risk operational process may require physical presence. The method is chosen to fit the evidence the objective demands.

What ISO 19011:2026 Says About Choosing the Method

The fourth edition gives your internal audit procedure three things to cite. Clause 5.5.3 asks for on-site and remote methods to be suitably balanced, based on their risks and opportunities. Annex A.1 says remote feasibility depends on how much risk the method poses to meeting the audit objectives, how much trust exists between the auditor and the auditee’s people, and what regulators expect. And the edition adds a defined term, remote auditing method, taken from ISO/IEC TS 17012 — any method used from a place other than the auditee’s location, regardless of the distance.

That last point changes how most procedures should be written. A quality engineer at headquarters watching an inspection bench two buildings away through a tablet camera is using a remote method. A procedure that treats “remote” as meaning “off-site travel we avoided” will undercount the choices it is supposed to record.

Turning Annex A.1 Into a Method-Selection Record

Annex A.1 classifies methods by two questions: is the auditor at the auditee’s location, and does the method involve talking with the auditee’s people? Those two questions make a clean method-selection record for each audit in your plan:

Two further details belong in the internal audit procedure. Annex A.1 allows a multi-person team to split, with one auditor on site while another works remotely. It also accepts observation through surveillance equipment only where privacy and legal limits are respected, so agree the rules with HR and legal before anyone points a camera at a workstation. ISO/IEC TS 17012:2024 is worth naming in your procedure’s reference list, because it is the source the 2026 guidance points to. For multi-site and dispersed organizations this is where the internal audit procedure earns its keep, a theme MSI explores in its guide to multi-site ISO certification. A procedure that documents method choice against the objective gives your certification body a defensible record of why each audit was run the way it was.

Edit 3 · MSI House Standard, Anchored in Annex A.16

Edit 3 — Require Platform-Specific Auditor Competence

Train. On. The-Tool.

A procedure that says “auditors shall be competent in remote auditing tools” is too vague to be auditable. Competence has to be platform-specific, because a remote audit is only as reliable as the auditor’s command of the platform carrying it. MSI’s house standard, drawn from 200+ audits attended, is that the internal audit procedure names the platform the organization actually uses and requires auditors to be trained on its mechanics: host and presenter controls, screen-sharing and remote-control permissions, recording behavior and where recordings are stored, admission controls, and secure file exchange. When an auditor fumbles a control mid-session, evidence is lost and the audit’s credibility erodes.

Teams vs. Zoom — Why the Mechanics Differ for Auditors

The differences are not cosmetic; they change how evidence is gathered and retained. Recording destination is the clearest example. Microsoft Teams typically routes recordings into SharePoint or OneDrive under the organization’s retention rules, while Zoom may store them in its cloud or locally depending on configuration — and an audit recording can itself become a controlled record subject to your retention policy. Host and presenter roles differ too, governing who can share a screen, grant remote control, or admit a participant. Lobby and waiting-room settings determine who is admitted and when, which matters when sensitive evidence is on screen. File-exchange paths that IT permits on one platform may be disabled on another, changing how an auditee submits documents mid-session.

What the Standard Text Already Says

ISO 19011:2026 does not use the word “platform,” but it comes close enough to anchor this part of your internal audit procedure. Annex A.16 expects auditors to be able to operate the technology in use and to know how to run an audit at a distance. Clause 7.2.3 lists understanding the appropriateness and consequences of using information and communications technology and emerging technology to conduct audits, with artificial-intelligence-based evaluation tools named as the example. Certification bodies face a harder rule: under IAF MD 4:2025, a legacy document still valid under Global ACI, conformance is mandatory whenever ICT is used, and the Standards Council of Canada summary notes that team members must be competent in the ICT used. Your internal auditors should not be held to a lower standard than the auditor who arrives for surveillance.

Because these mechanics affect evidence capture, retention and confidentiality, MSI’s house standard treats platform competence as a prerequisite for conducting remote audits — verified and recorded the same way you record any other auditor qualification. The supporting framework sits inside MSI’s internal audit services; the skills are taught in the ISO 9001 two-day internal auditing course, the ISO 13485 two-day internal auditor training, the ISO 9001 and 13485 two-day training for combined programs, and the ISO 14001:2026 internal auditing course. The case for treating internal audit skills as a profession rather than a rotating assignment runs through MSI’s ISO internal auditor training and its live ISO internal auditor workshop.

Edit 4 · MSI House Standard, Anchored in Annex A.16

Edit 4 — Build In an Evidence-Reliability and Data-Security Check

Verify. Trace. Protect.

When evidence arrives through a screen rather than a walk-through, a new question attaches to it: can this be relied upon? A document emailed mid-audit, a screen-shared dashboard, or a remotely demonstrated process each carries a reliability question. Your internal audit procedure should instruct auditors to evaluate whether information collected remotely is verifiable, sufficiently specific and traceable to a source. This protects the audit conclusion from resting on evidence that looked convincing on a video call but could not be confirmed afterward.

The Remote-Audit Protocol Annex A.16 Already Wrote

Annex A.16 reads like a pre-audit checklist, and most of it can go into your internal audit procedure almost as written. It makes effective remote auditing a joint responsibility of auditee and auditors. Paraphrased as procedure steps:

• Confirm the agreed remote access protocols, devices and software with the auditee before the audit.
• Run a technical check in advance so connection problems are solved before evidence is at stake.
• Have a contingency plan for lost access or a failed platform, including provision for extra audit time.
• Ask permission in advance before taking screenshots of documented information or recording any part of the audit.
• Use floor plans or diagrams to orient the auditor to remote locations and electronic information.
• Protect confidentiality and privacy during breaks by muting microphones and pausing cameras.

Add two more lines to the internal audit procedure from the surrounding text. The interview guidance in A.17 adds that non-verbal cues carry less weight in virtual settings, so auditors should rely on well-chosen questions. The audit-preparation guidance also treats photos, screen captures and video from the audit as confidential material the audit team must protect throughout. The ISO 9001 Auditing Practices Group remote-audit guidance is a useful practitioner companion.

The data-security half of the edit matters just as much. When an organization grants an auditor access to live systems, records and recordings, both parties inherit a responsibility to protect that data. The procedure should set expectations for how audit evidence and recordings are handled, stored, retained and destroyed. It connects to MSI’s work on change management and the audit trail, with its procedure-first view of ISO compliance automation, and with the harder version of the problem in auditing AI agents and AI process controls, where reliable, traceable evidence is designed in rather than reconstructed later.

Edit 5 · The Conformity Anchor

Edit 5 — Make Risk Change Five Things, Not Just Frequency

Focus. Where. Risk-Lives.

Start with what is citable. ISO 9001:2026 Clause 9.2.2, like the 2015 edition before it, requires the organization to consider the importance of the processes concerned, changes affecting the organization, and the results of previous audits when establishing the audit program. ISO 19011:2026 carries a published clause at 5.3 on audit program risks and opportunities. Those are structural facts about where the topic lives. What neither document does is tell you what to do about the importance you have considered — and that is where most audit programs quietly stop.

MSI’s house standard, developed across 28 years and 200+ audits attended, is that risk should change five properties of an audit. Frequency is only the first, and on its own it changes almost nothing about what the audit finds.

The practical edit is to write those five levers into the planning section of your internal audit procedure, with the risk basis recorded per process rather than asserted for the program as a whole. Mature teams already concentrate effort where exposure is greatest rather than auditing everything on a flat cycle — a discipline MSI details in its analysis of internal audit risk mitigation strategies and applies at the aspect level in its guide to ISO 14001 environmental aspects. MSI client experience suggests teams that vary all five levers get more from fewer audit days than teams that vary only the calendar.

Edit 6 · Competence and Reporting

Edit 6 — Update Competence Records, CPD, and Reporting in Your Internal Audit Procedure

Record. Renew. Report.

Many auditor competence frameworks were built around discipline knowledge alone — what the auditor knows about the standard and the processes being audited. MSI’s house standard broadens that to include the platform competencies covered in Edit 3 and the evidence judgment covered in Edit 4, and requires that auditor qualification records reflect them explicitly rather than by implication. Clause 7.2.3 adds data protection and information security to the knowledge list, and its note draws a firm line between a management system audit and a legal compliance audit. Continuing professional development should include audit methods and digital techniques, so competence stays current rather than freezing at the point of initial qualification. Auditing a culture-and-behavior requirement takes the same evidence discipline, as MSI sets out in its guide to auditing quality culture.

Reporting closes the loop. Because objectives and methods are now first-class elements of audit design, your report template should record them: what the audit set out to learn, how it was conducted, and whether the objective was met. That makes the audit program self-documenting and gives management review a cleaner read on how the system is performing. The 2026 editions raise the stakes: ISO 14001:2026 now asks for audit results framed as trends, which only works if audits measure comparable things across cycles, and ISO 9001:2026 asks top management to review the system’s alignment with strategic direction.

MSI covers the record in its management review procedure guide and the 14001 clause in its ISO 14001:2026 management review guide. Strong reporting also feeds the follow-up that turns findings into improvement, covered in MSI’s guide to internal audit follow-up; ISO 19011:2026 carries a published clause at 6.7 on audit follow-up, and every finding eventually hands off to a corrective action procedure.

Edit 7 · The Harder 2026 Change

Edit 7 — Bring the Audit Program Itself Under Document Control

Available. Not. Retained.

In most organizations the audit program is a spreadsheet on the program manager’s desktop: uncontrolled, unversioned, and not in the document system at all. Making it available as documented information means bringing it under document control. That takes planning, where adding an objectives field takes ten minutes — which is exactly why this edit belongs on the plan early and the objectives edit does not.

The two words also carry different tests. Retained means kept — you can produce it when asked. Available means current, retrievable and under control: the version an auditor sees is the version the program is actually running to, with a revision history, an owner and a review trigger. A spreadsheet with four people’s edits and no version number satisfies neither test convincingly, and it is the single most common piece of an internal audit procedure that never made it into the document management system. If a single program serves ISO 9001 and ISO 14001 together, the stricter ISO 14001 wording governs the shared document.

The edit itself is a cross-reference: your internal audit procedure names the audit program as a controlled document, assigns its owner, states its revision trigger, and points at your document control procedure for the mechanics. Organizations that already run a mature document control process will find this a half-day change. Organizations whose program lives in one person’s files will find it is the change the 2029 deadline was really about. MSI’s guide to evaluation of compliance covers the parallel available-versus-retained distinction on the compliance side of ISO 14001, the ISO 14001 continual improvement guide shows where the audit program feeds the wider loop, and building an internal audit program covers the program document itself.

One Procedure · Five Standards

What Each Standard Requires of Your Internal Audit Procedure

Same Clause. Different Teeth.

This is the part most integrated versions of an internal audit procedure get subtly wrong. The clause numbers line up neatly, which creates the impression the requirements do too. They do not, and each standard has one requirement that quietly vanishes when a procedure is written from another standard’s template.

One more distinction worth writing down, because assuming otherwise is a common error. In February 2024 ISO amended the context clauses of dozens of harmonized-structure standards to mention climate change, among them ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018, and ISO 9001:2026 and ISO 14001:2026 carry that wording into the new editions. ISO 13485 is not among them — it is not built on the harmonized structure and was not amended. A shared procedure that applies climate criteria to the ISO 13485 scope is auditing against a requirement that standard does not contain.

US Device Manufacturers

Why QMSR Changes the Stakes on Your Internal Audit Procedure

Inspectable. Now. Not-Later.

For twenty-five years, internal audit reports sat behind an exemption. A device manufacturer could audit itself honestly, write findings plainly, and know the report would not be read across the table during an inspection. That changed with the Quality Management System Regulation final rule, and the practical consequence lands squarely on the internal audit procedure: the report template, the language convention for findings, and the retention rule are now decisions with regulatory weight.

The wrong response is to soften the findings. An internal audit program that stops writing honest nonconformities stops working, and an investigator reading a year of clean audits in a facility with open complaint trends draws exactly the conclusion you were trying to avoid. MSI’s house standard is the opposite: write the finding precisely, close it with evidence, and let the closure record carry the weight. That is the discipline MSI teaches throughout its ISO consulting engagements, and it is what makes an audit trail defensible rather than merely tidy.

Seven Edits · One Audit

What Does a 2026-Ready Internal Audit Procedure Look Like in Practice?

One Audit. Seven Edits.

The seven edits are easiest to understand when you watch them work together across a single audit. Picture a mid-sized manufacturer running an integrated management system, preparing to audit its corrective-action process. Under a 2026-ready internal audit procedure the audit begins not with a checklist but with an objective: confirm that corrective actions raised in the last cycle were implemented and proved effective. That objective — now required under ISO 9001:2026 and ISO 14001:2026, and under ISO 7101 since 2023 — immediately shapes every decision that follows.

With the objective set, the auditor chooses a method and records why. Much of this audit is document and record review, which can be done remotely, so the auditor schedules a remote session for the corrective-action records and reserves a short on-site visit to verify that one physical control was actually installed. The method-selection step captures that reasoning. Before the remote session the platform-competence prerequisite applies: the auditor is confirmed competent on the organization’s chosen platform, has run the technical check, knows where the session recording will be stored under the retention policy, and has agreed in advance which screens may be captured.

During the session the evidence-reliability check shapes how the auditor treats what appears on screen. A screen-shared corrective-action log is useful, but the auditor confirms it is the controlled version, traceable to the document management system, before relying on it — and notes where a remote view was insufficient and on-site confirmation was needed. The five risk levers had already done their work upstream: this process carried elevated risk after a recent change, so it earned a deeper sample, the most experienced auditor available, and an on-site component rather than simply an earlier date on the calendar.

Under the revised internal audit procedure, the report records the objective, the method used and whether the objective was met, feeding cleanly into management review as part of a trend. And the schedule that placed this audit where it sits is itself a controlled document with an owner and a revision history — which is what lets the auditor demonstrate, without opening a spreadsheet nobody can version, that the program was planned rather than assembled. Every one of the seven edits played a visible role, and none required a new document.

Organizations that want to benchmark their own document against this standard will find the supporting context in MSI’s guide to ISO 14001 certification, its view of why a durable quality management mindset outperforms compliance theater, and its account of how a government internal audit program matures from event to intelligence. The wider audit lifecycle — internal, surveillance and certification — is mapped in MSI’s guide to the ISO audit.

Rollout

How to Roll These Internal Audit Procedure Edits Out Without Disruption

Edit. Approve. Train.

None of the seven edits requires rebuilding your internal audit procedure from scratch. They are targeted insertions into a document that already works: an objectives field, a method-selection step, a platform-competence prerequisite, an evidence-reliability check and remote-audit protocol, five risk levers in the planning section, updated competence and reporting records, and the audit program brought under document control. Treat the revision the way you would any controlled-document change — draft the edits, route them through your normal review and approval, update the version, and communicate what changed.

Sequence matters more than speed. Edit 7 is the long-lead item because it touches document control; start it first. Edit 1 is a same-week change and, with ISO 9001:2026 now published, the one with the widest reach, so it follows immediately, with Edit 2 alongside it. Edits 3, 4 and 6 land in your competence and reporting records and can move alongside your next training cycle. Edit 5 is a planning-section rewrite best timed to your next program cycle, when you are setting the schedule anyway.

Then train to the revised procedure. Your internal auditors and any supplier auditors you rely on should understand the objectives field, the method-selection logic, the remote-audit protocol and the platform-competence expectation before their next scheduled audit. For ISO 9001 and ISO 14001 certificate holders, the objectives field is a requirement rather than guidance, and ISO 14001 adds document control of the program, so both belong in place well before the transition audit. Teams that prefer a guided path can lean on MSI’s approach to certification audits, its SurePath turnkey certification program, or the year-round maintenance rhythm of SureResults. For an independent read on where the system actually stands, The Portrait is MSI’s operational assessment.

Frequently Asked Questions

Revising Your Internal Audit Procedure for 2026

Ask. Answer. Apply.

Does ISO 14001:2026 really require objectives for every internal audit?

Does ISO 9001:2026 also require audit objectives?

Can a certification body write a finding against ISO 19011:2026?

What actually changed in ISO 19011:2026?

Do I need to rewrite my internal audit procedure for these changes?

What does “available” mean compared with “retained” for the audit program?

Can auditors take screenshots or record a remote internal audit?

Why does the platform matter for remote audits — isn’t competence in remote tools enough?

Are internal audit reports now inspectable by FDA?

Which management systems does a single internal audit procedure cover?

How can MSI help us revise our internal audit procedure?