ISO 19011: Guidelines for Auditing Management Systems

ISO 19011 is the international standard providing guidance on auditing management systems, applicable across all ISO management system standards including ISO 27001, ISO 9001, ISO 14001, ISO 42001, and others. The 2018 edition introduced a risk-based approach to auditing and expanded guidance on auditor competence, making it the essential reference for anyone planning, conducting, or managing internal or external audits.

What ISO 19011 Covers

The standard covers three main areas. Audit programme management addresses how organizations plan, establish, implement, monitor, review, and improve their audit programmes. This includes defining objectives, managing resources, and evaluating programme effectiveness. Conducting individual audits covers the complete audit lifecycle from planning and preparation through execution, reporting, and follow-up. Auditor competence defines the personal attributes, knowledge, and skills required for effective auditing.

ISO 19011 establishes seven audit principles that guide auditors: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach. The risk-based approach — new in the 2018 edition — guides auditors to focus on matters that are significant to the audit client and relevant to achieving audit programme objectives.

Who Uses ISO 19011

Internal auditors across all industries use ISO 19011 as their primary reference for management system auditing. Organizations implementing ISO 27001, ISO 9001, or any other ISO management system standard rely on ISO 19011 for their internal audit programmes — a requirement of every ISO management system standard. Audit programme managers use it to design and improve their audit functions. Training organizations use it as the basis for auditor competency development.

Implementation Approach

Establish an audit programme with defined objectives, scope, and resources. Select and train internal auditors using the competence criteria in ISO 19011. Plan individual audits with clear objectives, scope, and criteria. Execute audits using evidence-based methods including interviews, document review, and observation. Report findings clearly, distinguishing between nonconformities, observations, and opportunities for improvement. Follow up on corrective actions.

Cost Considerations

ISO 19011 implementation costs are primarily training-related, ranging from $5,000 to $30,000 for auditor training courses and programme establishment. Lead auditor training courses typically cost $2,000 to $4,000 per person. The standard itself does not require certification, but effective implementation significantly improves the quality and value of internal audit programmes across all management system certifications.