In ISO 19011:2026, the definition of audit scope (3.6) includes physical and virtual locations. In practice, auditors use virtual location for an online environment where the auditee performs work or holds information, such as a cloud platform or a collaboration workspace. Naming virtual locations in the scope makes clear which online environments the audit will examine.
ISO 19011:2026 changed definition 3.6, audit scope, so that it now includes physical and virtual locations. The fourth edition, published on 27 May 2026, also expands Annex A to cover remote auditing methods and virtual locations.
In practice, auditors use virtual location for an online environment where the auditee performs work or holds information, as opposed to a physical site. Typical examples are a cloud platform that hosts business applications or an online collaboration workspace where a team produces and stores its records. This description reflects common audit practice, so check the exact wording in the published standard when you write formal scope statements.
Naming virtual locations in the scope tells the auditee and the audit team which online environments will be examined. It also connects with clause 5.1, which asks the audit programme to consider digital tools and information security and confidentiality requirements. See how to plan a remote or hybrid audit for the method decision and our guide to ISO 19011:2026 for auditors for the full picture. Auditors of AI management systems, where much of the evidence sits in online environments, can practise this through the ISO 42001 Lead Auditor certification.
QUOTE_PENDING_VALIDATION For an AI management system, I ask the auditee to list where models, data and logs actually live before we write the scope. The list is often longer than anyone expected, and that is the point of the exercise.
This ISO/IEC 42001 Lead Implementer course trains professionals to design and deploy an Artificial Intelligence Management System that stands up to regulatory, ethical, and operational scrutiny.
View courseThis ISO/IEC 27001 Lead Auditor training prepares experienced professionals to conduct and lead ISMS audits that stand up to regulatory, contractual, and certification scrutiny. The course focuses on audit execution, evidence evaluation, and decision-making under real-world constraints.
View courseThis Lead AI Risk Manager training prepares professionals to design, operate, and defend an AI risk management program aligned with regulatory and governance expectations. The course focuses on practical risk identification, decision traceability, and defensible mitigation strategies across the AI.
View courseTreat the method as a recorded decision. ISO 19011:2026 defines a remote auditing method as conducting audit activities from any place other than the auditee's location, and clause 5.1 asks the programme to consider digital tools and information security and confidentiality requirements. Confirm the evidence can be verified remotely, secure the tools, and name virtual locations in the scope.
Yes. Existing auditor certificates remain valid, and there is no transition period because ISO 19011 is a guidance standard. What changes is the guidance you work from, especially for remote and hybrid audits, so lead auditors should review the expanded remote auditing guidance and Annex A before planning their next audit.
Retraining is not mandatory, because existing auditor certificates remain valid and there is no transition period. Auditors who run remote or hybrid audits should study the expanded remote auditing guidance and Annex A. New auditors are best served by training that teaches the 2026 edition from the start.
ISO 19011 influences audits by emphasizing risk-based planning, sampling, evidence evaluation, and consistent reporting across the audit lifecycle.
An AI management system structures how an organization governs, uses, and controls AI responsibly. ISO 42001 defines requirements to manage risks, ethics, and accountability.
An ISO 42001 Lead Auditor plans, conducts, and closes AI management system audits. The role ensures conformity and objective conclusions.
ISO 42001 audits verify responsible AI practices and provide confidence in governance and controls.
ISO 19011:2026 was published on 27 May 2026 with expanded guidance on remote auditing. What changed, what did not, and what internal auditors, lead auditors and programme managers should do.
ISO/IEC 42006 changed who can certify you, ISO 19011:2026 changed how the audit runs, and the Omnibus moved the AI Act deadlines. What an AIMS audit demands, evidence by evidence.
Browse all FAQs →
Full knowledge base
Necessary cookies are always active. You can accept, reject non-essential cookies, or customize your preferences.