ISO 9001 specifies QMS requirements, while ISO 19011 provides guidance for auditing management systems. ISO 19011 can support audit principles, programme management and audit conduct, but it is not a substitute set of QMS conformity requirements. Distinguish the criteria being audited from guidance on how to perform the audit.
The Quality Management Standards Explained: ISO 9001, ISO 9004 and Related Frameworks places this topic in its wider QMS context. ISO’s public record identifies ISO 19011:2026. Certification-body requirements and scheme rules also need appropriate consideration for third-party certification activities.
Define the decision and its boundary
Every audit needs criteria: the requirements against which evidence is evaluated. ISO 9001 can supply relevant QMS criteria, alongside other applicable requirements in the assignment. ISO 19011 helps with the auditing approach. Keeping these roles separate prevents an auditor’s preferred interview technique, checklist layout or reporting style from becoming an unsupported requirement imposed on the organisation.
For certification work, do not treat ISO 19011 as the complete rulebook for certification decisions. Certification bodies operate within additional applicable conformity-assessment requirements and scheme arrangements. Internal and supplier audits also need agreed objectives and criteria. A common audit technique can be useful across these contexts, but the authority, reporting audience and decision consequences differ and should remain clear in the audit plan.
Put the method into practice
Plan an audit around objectives, scope, criteria and useful evidence. Appropriate guidance can help the team manage sampling, interviews and reporting, but it does not remove the need for competence and judgement. Identify access limits and relevant interfaces before the work begins. Revise sampling when evidence justifies it, and make the resulting limitation clear in the conclusion.
-
Identify audit objectives, scope and applicable criteria.
-
Use suitable auditing guidance to plan competent and impartial work.
-
Report evidence and conclusions against the actual requirements.
Worked example
A fictional internal auditor uses ISO 19011 guidance to plan sampling and interviews. During the audit, the evaluator distinguishes a preferred reporting format from an actual requirement in the QMS criteria.
The auditor reports a supported requirement gap rather than raising a finding solely because the organisation does not use the auditor’s preferred form.
The fictional auditor can suggest a clearer form without classifying its absence as a nonconformity. A finding needs an applicable requirement and evidence of a gap. If the current form supports an effective arrangement, its difference from the auditor’s preference is not enough. This distinction improves credibility and keeps improvement suggestions separate from conclusions about conformity.
Useful evidence and records
For each finding, preserve the criterion, observed evidence and resulting conclusion. Identify the work sampled and any limitation that materially affects the judgement. A checklist tick does not explain the basis for assurance, and a long evidence list does not automatically support the stated finding. Keep records sufficient for a competent reviewer to understand the reasoning without recreating the audit.
| Comparison element | Distinct purpose |
|---|---|
| ISO 9001 role | Requirements assessed in the QMS |
| ISO 19011 role | Guidance on auditing management systems |
| Criteria | Applicable requirements for the assignment |
| Conclusion | Evidence-based audit judgement |
Check the result and avoid a common mistake
Guidance should not become an undisclosed mandatory checklist. Explain the basis for each finding and distinguish suggestions from nonconformities.
Review selected findings for a clear requirement, evidence and conclusion. Check whether the audit sample and limitations support the reported judgement.
Auditing guidance does not alone establish all requirements for third-party certification. Certification bodies and schemes have additional applicable arrangements governing their work and decisions. Distinguish an internal audit, a customer or supplier audit and a certification assessment when interpreting authority and consequences. Similar techniques can be used across them without making their criteria, reporting or decision roles identical.
Connect the next decision
Review the audit programme using the information it provides about the system. Completion counts show activity, while supported findings and useful conclusions show what was learned. Check competence, impartiality and relevant coverage through the organisation’s arrangements. When an audit reveals uncertainty rather than a clear conclusion, report that limitation honestly and decide what further evidence is needed.
For a related comparison, see ISO 9000 vs ISO 9001. The related guide to internal-audit planning explains the wider process dependency.
Practical question
Can ISO 19011 certification replace ISO 9001 certification? They serve different purposes. Course or training claims about auditing guidance should not be confused with an organisation’s QMS certification. Verify the actual issuer, scope and nature of any certificate instead of assuming that the word ISO establishes equivalent recognition.
Explain audit limitations in terms meaningful to the recipient. If access prevented examination of an important interface, identify the effect on the conclusion and any further work needed. Do not conceal the limitation behind a generic statement that sampling was used. A transparent bounded judgement is stronger than an assurance broader than the evidence can support.