ISO 19011

ISO 19011
Title	ISO 19011
Status	Published
Organization	International Organization for Standardization
First published	2002
Latest revision	2018
Scope	Guidelines for auditing management systems
Related	ISO 9001, ISO 14001, IAF

ISO 19011 ISO 19011 is an international standard providing guidance for auditing management systems. It is intended for use by auditors, audit program managers, and organizations conducting internal or external audits of management systems such as ISO 9001, ISO 14001, ISO 45001, ISO 27001, and other sector-specific frameworks. The standard synthesizes principles, practices, and competence criteria influenced by international bodies and national standards including International Organization for Standardization, International Electrotechnical Commission, and national accreditation bodies such as UKAS, ANAB, and DAkkS.

Overview

ISO 19011 lays out a structured approach to planning, conducting, reporting, and following up on audits of management systems. The document aligns with auditing concepts found in standards like ISO 9001 and ISO 14001 while referencing quality and environmental management histories such as the work of W. Edwards Deming, Joseph Juran, Armand Feigenbaum, and organizational implementations seen in corporations like Toyota Motor Corporation, General Electric, and Siemens AG. It reflects international accreditation practices influenced by forums such as the International Accreditation Forum and regulatory expectations exemplified by agencies including the Environmental Protection Agency, European Commission, and the United Nations Environment Programme.

Scope and Purpose

The purpose of the standard is to provide principles and guidance applicable to a wide range of organizational contexts, from multinational enterprises like Microsoft Corporation, Apple Inc., and Samsung Electronics to public sector entities such as United Nations agencies, World Health Organization, and municipal governments exemplified by City of London Corporation case studies. It addresses internal audits, supplier audits, and third-party certification audits relevant to systems governed by standards including ISO 50001, ISO 13485, ISO 22301, and sector regulations like the Sarbanes–Oxley Act and REACH regulation. The scope excludes financial audits and focuses on management system conformity, performance, and continual improvement, rooting practice in precedents such as the CMMI model and corporate governance frameworks seen at Royal Dutch Shell and BP plc.

Key Principles and Concepts

ISO 19011 emphasizes principles such as integrity, fair presentation, due professional care, confidentiality, independence, and evidence-based approach—concepts shared with audit traditions from entities like the Institute of Internal Auditors, Association of Certified Fraud Examiners, and historical audit reforms following events like the Enron scandal and reforms such as those driven by Public Company Accounting Oversight Board. It introduces risk-based thinking consistent with paradigms promoted by ISO 31000 and integrates continual improvement ideals paralleling the work of Kaoru Ishikawa and the Toyota Production System. The standard frames concepts of competence similar to professional pathways at institutions like Chartered Institute of Internal Auditors and referenced schemes employed by accreditation bodies such as JAS-ANZ.

Guidelines for Auditing Management Systems

The guidance covers audit types, objectives, criteria, scope, methods, and evidence collection used across diverse sectors including healthcare at institutions like Mayo Clinic, aerospace companies such as Boeing, and financial services firms including HSBC. It prescribes planning activities influenced by project management practices from Project Management Institute standards, detailing stages comparable to methodological approaches used in Six Sigma and Lean manufacturing. Audit activities described encompass opening meetings, on-site examination, interviews, sampling, documentation review, and closing meetings, with reporting formats that mirror templates used by certification bodies like Bureau Veritas and SGS S.A..

Auditor Competence and Evaluation

ISO 19011 specifies competence requirements for auditors and audit teams, combining knowledge, skills, and personal attributes. Competence domains include understanding of management system standards such as ISO 9001 and ISO 14001, sector-specific regulatory regimes like Food and Drug Administration requirements and European Medicines Agency guidelines, and skills areas exemplified by training programs at institutions like Harvard Business School and INSEAD. It outlines methods for selection, evaluation, and continual professional development akin to certification schemes run by bodies such as IRCA and career pathways seen in organizations like KPMG, PwC, and Deloitte.

Audit Program Management

The standard provides guidance for establishing and managing an audit program, including objectives, resource allocation, scheduling, risk assessment, and performance monitoring, comparable to corporate program governance at Siemens AG and General Motors. It addresses program documentation, audit selection, remote auditing practices amplified during events like the COVID-19 pandemic, and use of information technology tools familiar from vendors such as SAP, Oracle Corporation, and Microsoft Azure. Performance evaluation and improvement of audit programs draw on metrics and reporting approaches used by Bank for International Settlements and international benchmarking initiatives led by the Organisation for Economic Co-operation and Development.

History and Revisions

First published in 2002, the standard was developed through ISO technical committee processes involving experts from member bodies such as British Standards Institution, Deutsches Institut für Normung, and Association Française de Normalisation. Revisions occurred in 2011 and 2018 to address evolving needs including risk-based approaches, competency models, and remote auditing. The 2018 revision reflects influences from global incidents and reforms that changed auditing practice, including lessons from Deepwater Horizon and regulatory shifts after Global Financial Crisis (2007–2008). Ongoing maintenance and interpretations continue under the stewardship of ISO committees interacting with stakeholders like International Accreditation Forum and national accreditation entities.

Category:International standards