What this standard provides
ISO 19011 provides guidelines on auditing principles, programme management and conducting management system audits. It includes guidance on auditor competence. The ISO catalogue identifies the 2026 edition as the fourth edition, published in May that year. It is a methodological reference, not a requirements standard against which a system can independently be certified.
Application to health and safety
In an internal OSH audit, the methodology helps organise work, but criteria come from the system and applicable requirements. They may include internal procedures, commitments and ISO 45001 requirements, depending on scope. Legal review additionally requires correct identification of jurisdiction, activity and specific obligations.
Programme and individual audit
A programme organises a set of audits and their priorities. An individual audit plan establishes what will be reviewed, when and with whom. Confusing these levels can leave important areas uncovered. Selection should consider processes, changes and previous information, avoiding the same fixed annual route when it no longer responds to current risks.
Evidence and conclusions
The audit gathers evidence through document review, interviews and observation within the engagement’s conditions. Conclusions should match the scope and information obtained. A finding needs to express the criterion and supporting evidence; a general impression or personal recommendation should not be presented as noncompliance without that relationship.
Review example
In a hypothetical example, the programme prioritises a workplace that has introduced contractors and a new activity. The audit examines how changes were identified, what measures were defined and what evidence of implementation exists. The selected sample and its limits are documented so the report does not appear to guarantee every case not reviewed.
Follow-up and limits
Closing a report is not equivalent to correcting the causes of findings. The organisation assigns responsibilities and verifies actions using appropriate criteria. This entry summarises general use of the standard without reproducing its text or replacing auditor training. The applicable edition and certification requirements must be checked for each engagement.
