ISO 19011:2018-07

This document provides guidance on auditing management systems, including the principles of auditing, managing an audit programme and conducting management system audits, as well as guidance on the evaluation of competence of individuals involved in the audit process. These activities include the individual(s) managing the audit programme, auditors and audit teams.

It is applicable to all organizations that need to plan and conduct internal or external audits of management systems or manage an audit programme.
Since the second edition of this document was published in 2011, a number of new management system standards have been published, many of which have a common structure, identical core requirements and common terms and core definitions. As a result, there is a need to consider a broader approach to management system auditing, as well as providing guidance that is more generic.

This third edition cancels and replaces the second edition (ISO 19011:2011), which has been technically revised.

The main differences compared to the second edition are as follows:

• addition of the risk-based approach to the principles of auditing;
• expansion of the guidance on managing an audit programme, including audit programme risk;
• expansion of the guidance on conducting an audit, particularly the section on audit planning;
• expansion of the generic competence requirements for auditors;
• adjustment of terminology to reflect the process and not the object (“thing”);
• removal of the annex containing competence requirements for auditing specific management system disciplines (due to the large number of individual management system standards, it would not be practical to include competence requirements for all disciplines);
• expansion of Annex A to provide guidance on auditing (new) concepts such as organization context, leadership and commitment, virtual audits, compliance and supply chain.

This document replaces ISO 19011:2011-11 .