Treat the method as a recorded decision. ISO 19011:2026 defines a remote auditing method as conducting audit activities from any place other than the auditee's location, and clause 5.1 asks the programme to consider digital tools and information security and confidentiality requirements. Confirm the evidence can be verified remotely, secure the tools, and name virtual locations in the scope.
Under ISO 19011:2026, a remote auditing method is a method used for conducting audit activities from any place other than the location of the auditee (definition 3.4). The fourth edition expands the guidance on remote auditing methods, drawing on ISO/IEC TS 17012, and its expanded Annex A covers remote auditing methods and virtual locations.
Abilene's practitioner approach builds on that guidance with three questions. First, can the evidence you need be observed and verified reliably from another place? If not, audit those activities on site. Second, do the remote tools meet the information security and confidentiality requirements agreed for the audit? Clause 5.1 asks the audit programme to consider digital tools together with these requirements, so settle the tooling before the opening meeting. Third, does the scope combine physical and virtual locations? Definition 3.6 now includes both, and a scope with both usually calls for a hybrid audit.
Record the chosen method and the reasons in the audit plan. Our ISO 19011:2026 article includes a decision visual for this choice, the answer on virtual locations explains how to describe online environments in the scope, and the note on ISO/IEC TS 17012 explains where the guidance comes from. Auditors of information security management systems can go further with the ISO 27001 Lead Auditor training.
QUOTE_PENDING_VALIDATION Before a remote ISMS audit, I send the auditee a one-page note on the tool, who records and how long recordings are kept. It is quick to write and removes most of the friction in the opening meeting.
This ISO/IEC 27001 Foundation training provides a structured entry point into Information Security Management Systems for professionals who need to understand how ISO 27001 works in practice.
View courseISO/IEC 27001 formation and certification is no longer a differentiator but a baseline expectation. This training prepares professionals to implement and manage an Information Security Management System that actually works in operational environments.
View courseISO 27001 Lead Auditor training requires prior knowledge of information security and familiarity with ISO 27001 concepts. Practical experience with ISMS implementation, operation, or internal audits is strongly recommended.
Yes. In 2026, ISO 27001 Lead Auditor certification is highly valued for roles involving audits, supplier assurance, regulatory oversight, and certification activities, particularly in regulated and security-sensitive sectors.
The ISO 27001 Lead Auditor exam covers ISMS principles, audit planning, audit execution, nonconformity management, and audit program management, aligned with ISO 19011 and ISO/IEC 17021-1.
ISO 27001 Lead Auditor focuses on auditing and certification of an ISMS, while Lead Implementer focuses on designing and deploying an ISMS. Auditors assess conformity and effectiveness; Implementers build and operate the system.
ISO 19011:2026 was published on 27 May 2026 with expanded guidance on remote auditing. What changed, what did not, and what internal auditors, lead auditors and programme managers should do.
ISO 27001 Lead Implementer vs Lead Auditor: what each qualifies you to do and how to choose the right certification in 2026.
Browse all FAQs →
Full knowledge base
Necessary cookies are always active. You can accept, reject non-essential cookies, or customize your preferences.