ISO 19011 is the guidance that sits behind almost every management system audit, yet it carries no certificate and sets no pass mark. It describes how to manage a set of audits, how to carry out one audit and what an auditor needs to be good at. This post covers the three ideas that matter most: principles, programme and competence.
Last reviewed: 17 October 2026. Facts checked. We opened web search results summarising ISO 19011:2018: a Johner Institute article, a SafetyCulture explainer and several study-guide pages. These are secondary sources; we did not open the standard, which is paid. We have not quoted clause numbers or wording. We could not confirm whether a newer edition is in progress. Our step-by-step method is in a separate post; this one is about the thinking behind it.
What ISO 19011 is, and is not
It is guidance for organisations that need to plan and perform audits of management systems, whether internal, by a customer or by a certification body. It is written to work with any management system standard, which is why quality, environment, safety and food auditors all refer to it. The sources we checked describe the current edition as ISO 19011:2018.
It is guidance, so an organisation is not "certified to ISO 19011". Certification bodies work to a separate standard for bodies that certify management systems, and that standard draws on 19011-style practice. If your internal audit procedure says "we follow ISO 19011", it means you borrow its approach, and you should be able to show where.
The seven principles
Secondary sources summarise the principles consistently. In plain words:
- Integrity. The audit is done honestly and responsibly. This is the foundation of the others.
- Fair presentation. Findings and conclusions are reported truthfully and completely, including obstacles met and disagreements not resolved.
- Due professional care. The auditor applies diligence and judgement in proportion to the task.
- Confidentiality. Information gained is protected, particularly what is sensitive.
- Independence. The auditor is impartial and objective, and does not audit their own work.
- Evidence-based approach. Conclusions rest on verifiable evidence. Sources describe this as making results reliable and reproducible.
- Risk-based approach. Planning and reporting focus on what matters most to the objectives.
The sources describe the risk-based approach as the principle most associated with the 2018 edition. Treat that as a pointer rather than a quotation.
How the principles show up on a job. An auditor who softens a finding because the process owner is senior breaches fair presentation. An auditor who reviews a process they designed breaches independence. An auditor who writes "controls seem adequate" with nothing behind it breaches the evidence-based approach. These principles are less about ethics lectures and more about decisions you can check afterwards.
The audit programme
An audit programme is the plan for all audits over a period, not a single audit. Good practice for managing it, as described in the sources, covers:
- Objectives of the programme, such as meeting a standard's requirement, checking supplier performance or preparing for certification.
- Risks and opportunities that could affect the programme, for example key auditors leaving or a process that changed quickly.
- Scope and extent: which processes, sites and standards, how often and with what depth.
- Resources: people, time and tools.
- Responsibilities: who runs the programme, who approves it, who sees results.
- Monitoring and review: whether audits are happening as planned and whether the programme itself is worth its cost.
The key shift is from "an annual audit" to "a programme that focuses effort". A process that changed last quarter, had complaints or produced earlier findings deserves earlier and deeper audit than a stable one. A flat schedule that audits everything once a year, equally, ignores that.
For a practical programme view in internal audit more generally, see the audit programme meaning and contents.
Competence of auditors
The guidance treats auditor competence as two things: personal behaviour and knowledge and skills. Summaries describe behaviours such as being ethical, open-minded, diplomatic, observant, perceptive, versatile, tenacious and decisive. They also describe knowledge of audit principles and methods, the management system standard in question, the organisation's context and the legal requirements that apply.
Competence is not a certificate. A lead auditor course helps, as covered in what an ISO lead auditor course covers, but the programme manager decides whether a person is competent for a given audit by looking at education, work experience, training, audit experience and an evaluation of how they actually perform. The evaluation is the part most small organisations skip.
Practical ways to evaluate:
- Have a new auditor shadow a senior one, then audit with supervision.
- Review their working notes and findings for evidence quality.
- Collect feedback from the people audited, on clarity and fairness.
- Keep a short record per auditor: what they are competent to audit and why.
Subject knowledge also matters. An auditor with no understanding of a casting process will not spot that a record is odd. If the team lacks it, the guidance contemplates technical experts joining the team.
A short invented example
A mid-sized firm audits all twelve processes once a year using the same checklist. After a customer complaint about delayed deliveries, the programme manager reweights the plan: dispatch and planning get two audits a year with deeper sampling, stable processes like document control drop to a lighter check, and one auditor who has worked in dispatch is excluded from auditing it. Total audit effort is the same. The findings improve, because effort follows risk and independence is preserved.
Using it without overdoing it
- Do not write a 40-page procedure to prove you follow it. A short one that is true is better.
- Keep records that show the programme works: schedule, reports, competence evidence, review of results.
- Link to the method in how to run an ISO internal audit using ISO 19011 guidance, and to the wider view of what internal audit is if the audience is new to the field.
The takeaway
The principles keep audits honest, the programme keeps effort pointed at risk and competence keeps the people capable. All three are checkable by someone other than the auditor, which is the point.
Last reviewed: 17 October 2026. Facts checked. Opened: web search summaries from Johner Institute, SafetyCulture and study-guide sites on ISO 19011:2018 (secondary). Could not open: the standard itself, so no clause numbers or exact wording are given, and we could not verify the competence attribute list beyond those summaries.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error