By Mthokozisi Nkosi, ASC Food Safety Training. Reviewed 21 September 2026.
Short answer: ISO 19011:2026, the fourth edition of the guidelines for auditing management systems, was published in May 2026. The main changes are expanded guidance on remote auditing methods and virtual locations, more on digital tools, and refinements to audit programme management, audit communication and auditor competence. It cancels and replaces ISO 19011:2018, and because it is a guidance standard there is no transition period. If your internal audit procedure says ISO 19011:2018, it now cites a withdrawn document. Changing the reference takes an hour. Then check whether your audits follow the guidance at all. The six fixes below are the places to check first.
What is ISO 19011, and why does a food factory care?
Food standards tell you that you must audit. ISO 22000:2018 does it in clause 9.2. BRCGS Food Issue 9 does it in clause 3.4.1, and wants the programme spread over at least four different dates in the year. FSSC 22000 inherits the ISO 22000 requirement. None of them tells you how to plan an audit, how to collect evidence, or how to write a finding. That is what ISO 19011 is for. It is scheme neutral on purpose. Use it against FSSC, BRCGS, your own procedures or R638 alone.
It is written in shoulds, not shalls. No certification auditor will raise a nonconformity against ISO 19011 itself. What they will do is look at your internal audit programme, and the weaknesses they find there, no objective, unverified evidence, no follow up, are all things ISO 19011 tells you how to avoid.
What are the changes in ISO 19011:2026?
Not many. The foreword of the standard lists two main changes: guidance on remote auditing methods brought in from ISO/IEC TS 17012, and an expanded Annex A on remote auditing methods and virtual locations. A virtual location is where work is done or a service is provided online, so people can carry out a process from anywhere. The Chartered Quality Institute describes the revision as evolutionary. It updates and clarifies the existing guidance and the structure is the same. The three areas it names are:
- Remote auditing. Expanded guidance on remote auditing methods and on virtual locations. The 2018 edition dealt with this briefly in an annex. The 2026 edition gives it more room, which matches how audits have been run since 2020.
- Technology. More consideration of digital tools in how audits are planned, run and recorded.
- Programme, communication and competence. Refinements to how the audit programme is managed, how auditors communicate during an audit, and what competence an auditor needs.
The seven principles are still there. Every audit still rests on defined objectives, scope and criteria. Evidence still has to be verifiable. Findings still get reviewed with the auditee before the closing meeting. Follow up is still part of the audit.
| ISO 19011:2018 | ISO 19011:2026 | |
|---|---|---|
| Edition and status | Third edition, withdrawn | Fourth edition, published May 2026, 46 pages |
| Transition period | Not applicable | None. Guidance takes effect on publication |
| Remote auditing | Covered briefly in Annex A | Guidance from ISO/IEC TS 17012 brought in, Annex A expanded |
| Virtual locations | Mentioned | Expanded guidance in Annex A |
| Principles of auditing | Seven | Seven, clauses 4.2 to 4.8 |
| Audit process | Clause 6, from initiating the audit to follow up | Same structure, same clause numbers for the steps used in this article |
Can a food safety audit be done remotely under ISO 19011:2026?
Partly.
The expanded remote guidance is useful to a food business, inside limits. A document review of your supplier’s certificates, specifications and corrective actions can be done from a desk. So can a review of your own records where they are electronic, and interviews with a head office function in another province. For a group with sites in Gauteng, the Western Cape and KwaZulu-Natal, that saves flights and nights away.
A camera does not look up. Condensate above an open product line, tape on a guard, the smell of a drain, a hand wash station nobody is using. A person standing in the area finds these. Use remote methods for the reading part of an audit and keep the watching part on the floor.
Which ISO 19011:2026 clauses matter most for a food safety internal audit?
| ISO 19011:2026 clause | What it covers | Where food sites go wrong |
|---|---|---|
| 4 | The seven principles of auditing | Independence. The QC audits the line she works on, against the checklist she wrote |
| 5.5.2 | Objectives, scope and criteria for each individual audit | The programme lists areas and dates and nothing else, so every audit is improvised on the morning |
| 6.3.1 and 6.3.2 | Reviewing documented information, and audit planning | The procedure gets read for the first time on the production floor |
| 6.4.7 | Collecting and verifying information | What the supervisor said is written down as evidence. It is a lead until a record or an observation confirms it |
| 6.4.8 | Generating audit findings, including grading | The site grades major and minor and has never written down what either means |
| 6.4.9 and 6.5 | Audit conclusions and the audit report | The report lists nine findings and never says whether the control works |
| 6.7 | Audit follow up | The report is issued and nobody goes back. Next year’s audit finds the same things |
Clause 6.4.7 deserves a second look. It says only information that can be subject to some degree of verification should be accepted as audit evidence. Test your last audit report against that sentence. The hygiene supervisor says the deep clean happens every Sunday. That is information. It becomes evidence when you have the cleaning records for the last eight Sundays, the chemical issue records for those days and the swab results from the Mondays after. If six of eight are there and two are missing, you have a finding, and you would never have reached it from the interview.
Six things to fix in your internal audit procedure on Monday
- Change the reference. Find every place your procedure, plan template, checklist header and report template cite ISO 19011:2018, and update them to ISO 19011:2026. Record the change through document control like any other.
- Give every audit an objective, a scope and criteria. The objective should contain the word effective. To audit the chiller is not an objective. To determine whether the cleaning programme is implemented as documented and is effective is one.
- Put a period in the scope. Which months of records does this audit cover? Without it, auditor and auditee argue about which records count.
- Write down your grading rules. The standard lets you grade however suits your risks, as long as the criteria are defined and communicated. If the only rule is that everyone knows what a major is, you have no rule.
- Check who audits what. Look at this year’s programme for anybody auditing their own area or their own documents. Swapping areas between two QCs fixes most of it. Documents still need a reviewer who did not write them.
- Put a follow up date in every report. Name who will verify the corrective actions and when. Without it, the same findings come back next year.
For what to do when you are the one being audited, see how to prepare for a food safety audit in South Africa.
What about FSSC 22000 Version 7 and the other scheme changes?
They are separate, and they come with transition dates. FSSC 22000 Version 7 was published on 7 May 2026. Audits against Version 6 are permitted until 30 April 2027, and Version 7 upgrade audits run from 1 May 2027 to 30 April 2028. BRCGS Food is still on Issue 9. ISO 19011:2026 has no transition dates, because nobody certifies against it. The practical position for a South African site is to update the audit procedure now and deal with the scheme upgrade on its own timetable.
Learn to do this on your own site, in about 9 hours
Food Safety Inspections and Audit Readiness for QCs and HACCP Teams is our online course for the people who do the inspections and sit in the audits. 27 lessons, two tools that export to Excel, a workshop on your own site or our case study, and an assignment marked automatically against published criteria. R1,699 per delegate.
Frequently asked questions
When was ISO 19011:2026 published?
ISO published ISO 19011:2026, Guidelines for auditing management systems, in May 2026. It is the fourth edition and runs to 46 pages. It cancels and replaces ISO 19011:2018.
Is there a transition period for ISO 19011:2026?
No. ISO 19011 is a guidance standard. Nobody certifies against it, so it took effect on publication and there is no deadline. A procedure that still cites the 2018 edition is citing a withdrawn document.
What are the main changes in ISO 19011:2026?
The revision is evolutionary. The foreword of the standard names two main changes: guidance on remote auditing methods brought in from ISO/IEC TS 17012, and an expanded Annex A covering remote auditing methods and virtual locations. The Chartered Quality Institute summarises the changes as expanded guidance on remote auditing methods and virtual locations, more consideration of technology and digital tools, and refinements to audit programme management, audit communication and auditor competence. The seven principles of auditing and the basic audit process are still there.
Does ISO 19011 apply to food safety audits?
Yes. ISO 19011 is scheme neutral on purpose. Use it for audits against FSSC 22000, BRCGS, ISO 22000:2018 clause 9.2, your own procedures or the law. The food standards require internal audits. ISO 19011 is the guidance on how to run them.
Do internal auditors need retraining for ISO 19011:2026?
No full retraining is needed. An auditor trained on the 2018 edition needs to know the edition has changed, read the expanded guidance on remote methods if the site uses them, and check that the site procedure, plan template and report template cite the 2026 edition. New auditors should be trained on the 2026 edition from the start.
What are the seven principles of auditing in ISO 19011?
Integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach. On food sites the one broken most often is independence. People audit their own area or their own documents.
Sources
- ISO, ISO 19011:2026 Guidelines for auditing management systems, edition 4, May 2026, including the foreword.
- Chartered Quality Institute and IRCA Knowledge Hub, ISO 19011:2026 revision: guidance for management system auditing.
- FSSC, FSSC 22000 Version 7: key changes explained.
- BRCGS Global Standard Food Safety Issue 9, clauses 3.4.1 and 3.4.4. ISO 22000:2018, clause 9.2.