ISO 19011
ISO 19011: the guidance for conducting audits
ISO 9001 says that you must audit. ISO 19011 says how — and it contains exactly the points where internal audit programmes fail in practice.
The points that make the difference in practice
The process approach instead of clause order. ISO 19011 suggests running audits along real processes rather than the structure of the standard. A question catalog that works through clauses 4 to 10 reliably produces yes answers. A catalog that follows a process from enquiry to delivery finds the breaks. More in the article on the audit question catalog.
Risk-based programme planning. The audit programme should consider process importance, changes, customer feedback and the results of previous audits. The most common failure is copying last year’s plan.
Independence as a system property. Clause 6.2.5 is easy to state and hard to uphold once roles overlap. If the check only happens during the certification audit, it is too late — which is why qportal warns automatically when auditor and audited org unit coincide.
Confirmation by the auditee. Clause 6.5.5 expects findings to be agreed before the report is finalised. Modelled as its own lifecycle state, that step cannot quietly disappear.
Competence as an ongoing process. Clause 7 requires evaluation and maintenance of auditor competence. A 2019 certificate in a personnel file does not satisfy that.
Link to the implementation
How the audit programme, question catalogs, independence check and auditee confirmation work together is described on the audit management page.
Frequently asked questions
- Can you be certified against ISO 19011?
- No. ISO 19011 is guidance, not a requirements standard. Organisations are not certified against it, but certification auditors refer to it and internal audit programmes are regularly measured against it.
- What does ISO 19011 say about auditor independence?
- Clause 6.2.5 requires auditors to be independent of the activity being audited and not to audit areas for which they are themselves responsible. In smaller organisations that is the most common structural weakness.
- Is knowledge of the standard sufficient auditor competence?
- No. Clause 7 distinguishes knowledge from skills and names audit methodology, process understanding and personal behaviour alongside knowledge of the standard. Competence must be evaluated and maintained, not demonstrated once.