Your cart is empty.
Keep shopping
Teach on Udemy
Turn what you know into an opportunity and reach millions around the world.
Learn MoreISO 19011:2018 Auditing Management Systems Mastery
ISO 19011:2018 Auditing Management Systems Mastery
Plan, conduct, report, and follow up management system audits with the credibility regulators and clients demand
Role Play
Created byISO Horizon
Last updated 6/2026
English
What you'll learn
- Apply all seven ISO 19011:2018 audit principles including the risk-based approach
- Design and manage an audit programme from objectives through review
- Conduct audits end-to-end from initiation through follow-up verification
- Classify findings correctly as major nonconformity, minor nonconformity, or observation
- Write nonconformity statements that pair criterion, evidence, and gap defensibly
- Plan and run remote, combined, and joint audits with confidence
- Use interviews, sampling, and document review to gather verifiable evidence
- Evaluate auditor competence using documented criteria and recognised methods
- Verify correction and corrective action effectively under Clause 6.7
- Distinguish ISO 19011 guidance from ISO/IEC 17021-1 certification requirements
Explore related topics
Course content
6 sections • 37 lectures
- What ISO 19011:2018 Is and Why It Matters8:50Introduce ISO 19011:2018 as the international guidance standard for auditing management systems, published in July 2018 by ISO/TC 176/SC 3. Explain that unlike certification standards such as ISO 9001 or ISO 14001, ISO 19011 is non-certifiable guidance — a recommended playbook used by internal auditors, second-party auditors, and any organization that wants its audits to be consistent, credible, and value-adding. Walk the learner through the standard's seven clauses, its applicability to any management system discipline (quality, environment, occupational health and safety, information security, energy, food safety, and beyond), and its relationship to ISO/IEC 17021-1 which governs third-party certification body audits. Emphasize why a guidance standard, despite using "should" rather than "shall," carries enormous weight in regulated and certified industries.
- Evolution from 2002 to 2011 to 20187:34Trace the development of ISO 19011 across three editions to show why the 2018 version looks the way it does. The 2002 edition originally covered only quality and environmental auditing. The 2011 edition broadened the scope to any management system and introduced the concept of audit programme management. The 2018 edition added the seventh audit principle of risk-based approach, expanded guidance on remote auditing, addressed combined audits across multiple disciplines, refined competence requirements to reflect Annex SL high-level structure, and introduced Annex A with practical guidance on professional behaviour and audit methods. Help the learner appreciate that each revision tracks how real-world auditing has matured.
- Audit Types: First-Party, Second-Party, and Third-Party8:49Define and contrast the three classifications of audits that the standard recognises. First-party audits are internal audits conducted by or on behalf of the organization itself for management review and self-declaration. Second-party audits are external audits performed by parties having an interest in the organization, such as customers auditing suppliers, or by other persons on their behalf. Third-party audits are conducted by independent external auditing organizations, including certification bodies and regulatory authorities. Explain how the same audit principles apply across all three, but the objectives, independence requirements, and reporting expectations differ. Use concrete industry examples so the learner can immediately classify any audit they encounter.
- Combined Audits, Joint Audits, and Integrated Systems8:24Unpack two often-confused concepts. A combined audit examines two or more management systems of a single auditee at the same time — for example, ISO 9001 and ISO 14001 audited together. A joint audit is conducted by two or more auditing organizations cooperating to audit a single auditee. Explain when each approach delivers efficiency, the additional planning rigour needed for competence coverage, role clarity, and report structure, and the risks of cutting corners. Tie this directly to the rise of integrated management systems and the Annex SL common structure that makes combined auditing practical across quality, environment, health and safety, and information security disciplines.
- Key Terms and Definitions You Must Master8:20Walk through the vocabulary defined in Clause 3 of ISO 19011:2018 that every auditor uses daily. Cover audit, audit criteria, audit evidence, audit findings, audit conclusion, auditee, auditor, audit team, technical expert, observer, guide, audit plan, audit scope, audit programme, risk, conformity, nonconformity, competence, and the often-misused terms verification and validation. Clarify the precise distinction between criteria (what you audit against), evidence (what you observe and verify), findings (the result of evaluating evidence against criteria), and conclusions (the overall outcome). Strong terminology discipline is what separates credible auditors from amateurs.
- Section 1 Quiz: Foundations of ISO 19011:2018 and the Auditing Discipline
- Roleplay: Foundations of ISO 19011:2018 and the Auditing Discipline
- Integrity: The Professional Foundation7:37Examine the first audit principle, integrity, which ISO 19011 calls the foundation of professionalism. Auditors must perform their work ethically, with honesty and responsibility, undertake auditing activities only if competent to do so, perform work impartially and remain fair and unbiased in all dealings, and remain sensitive to influences that may be exerted on judgement. Use realistic scenarios — pressure from a senior auditee, a gift offered during a site visit, a colleague auditing their own former department — to show how integrity is tested in practice. Explain how documented codes of ethics and conflict-of-interest declarations operationalise this principle.
- Fair Presentation: Reporting Truthfully and Accurately7:23Explore the principle of fair presentation, which obliges audit findings, conclusions, and reports to reflect truthfully and accurately the audit activities. Significant obstacles encountered during the audit, unresolved diverging opinions between the audit team and auditee, and information that supports the conclusions must all be reported. Communication must be truthful, accurate, objective, timely, clear, and complete. Address the common temptation to soften findings to avoid conflict and explain why diluted reports erode the entire audit programme's credibility. Connect this to closing meeting dynamics where pressure to compromise wording is most acute.
- Due Professional Care: Diligence and Judgement6:19Define due professional care as the application of diligence and judgement in auditing. Auditors are expected to exercise care in accordance with the importance of the task they perform and the confidence placed in them by audit clients and other interested parties. A critical capability is reasoned judgement in all audit situations — knowing when to dig deeper, when sample sizes are adequate, when an observation truly indicates a systemic issue, and when something genuinely is not worth pursuing. Contrast superficial tick-box auditing with the thoughtful, evidence-driven inquiry that the standard expects.
- Confidentiality: Security of Information8:04Cover the principle of confidentiality, which requires auditors to exercise discretion in the use and protection of information acquired during their duties. Audit information should not be used inappropriately for personal gain by the auditor or the audit client, or in a manner detrimental to the legitimate interests of the auditee. Address the sensitive handling of proprietary processes, personal data under regulations such as GDPR, trade secrets, security vulnerabilities, and pending litigation matters. Walk through practical safeguards including non-disclosure agreements, secure transmission of audit evidence, retention policies, and the disposal of working papers.
- Independence: The Basis of Impartiality8:33Examine independence as the principle that underpins audit impartiality and the objectivity of audit conclusions. Auditors should be independent of the activity being audited wherever practicable, and should always act in a manner that is free from bias and conflict of interest. For internal audits, auditors should be independent from the operating managers of the function being audited. Address how small organizations manage independence when staff inevitably wear multiple hats, the use of cross-functional auditing rotations, and the boundary between independence in fact and independence in appearance.
- Evidence-Based Approach: Reliable and Reproducible Conclusions8:44Unpack the evidence-based approach as the rational method for reaching reliable and reproducible audit conclusions in a systematic audit process. Audit evidence should be verifiable and based on samples of the information available, since an audit is conducted during a finite period of time and with finite resources. Explore the appropriate use of sampling, the difference between corroborated and uncorroborated evidence, why a single document review is rarely sufficient, and how triangulation across documents, interviews, and observation strengthens findings. Emphasize that conclusions a peer cannot reproduce from the same evidence are not conclusions at all.
- Risk-Based Approach: The 2018 Addition6:00Examine the seventh principle introduced in the 2018 revision: the risk-based approach. This principle requires auditors to consider risks and opportunities throughout audit programme management and the individual audit. Risks and opportunities relate to achieving audit objectives, and the risk-based approach should substantively influence the planning, conducting, and reporting of audits to ensure that audits are focused on matters that are significant for the audit client and for achieving the audit programme objectives. Connect this to the parallel emphasis on risk-based thinking in ISO 9001:2015 and other Annex SL standards.
- Section 2 Quiz: The Seven Principles of Auditing
- Roleplay: The Seven Principles of Auditing
- What an Audit Programme Is and How It Differs from an Audit5:05Distinguish between an individual audit and an audit programme. An audit programme is the arrangements for a set of one or more audits planned for a specific time frame and directed towards a specific purpose. The programme sits above individual audits and includes everything needed to plan, organize, and conduct the audits effectively and efficiently, including resourcing, scheduling, monitoring, and improvement. Explain the typical scope of an annual internal audit programme for a certified organization, how programme extent is influenced by organizational size, complexity, risks, and management system maturity, and who normally owns the programme.
- Establishing Audit Programme Objectives6:42Cover Clause 5.2 — how to set objectives for the audit programme that direct the planning and conduct of audits and ensure they are conducted effectively. Programme objectives should be consistent with the audit client's strategic direction and support management system policy and objectives. Examples include identifying opportunities for improvement, evaluating the capability of the auditee to determine context, evaluating the auditee's ability to meet relevant requirements, evaluating compatibility and alignment of multiple management system objectives, and contributing to organizational performance improvement. Show how poorly defined objectives produce vague, low-value audits.
- Determining and Evaluating Programme Risks and Opportunities7:11Work through Clause 5.3 on determining and evaluating the risks and opportunities of the audit programme. Risks may relate to planning (failing to set relevant objectives), resources (insufficient time or competence), selection of audit team (lack of authority or impartiality), communication (ineffective channels), implementation (poor coordination), records (lacking adequate protection), and monitoring (ineffective reviews). Opportunities include combining multiple audits, minimising travel through remote techniques, aligning audit dates with management system implementation milestones, and using technology to improve coverage. Demonstrate a practical risk register applied to the audit programme itself.
- Establishing the Audit Programme: Roles, Competence, and Resources7:00Examine Clause 5.4 covering who runs the programme, what they need to know, what they must do, and what resources they require. The individual managing the audit programme needs competence in audit principles, management of an audit programme, and the requirements of the management system standards being audited. Responsibilities include establishing programme extent, identifying and evaluating risks and opportunities, ensuring selection of audit teams, providing resources, ensuring audits are conducted in accordance with the programme, ensuring records are kept, and reviewing the programme. Cover the resource categories: financial, time, methods, technology, and competent personnel.
- Implementing the Audit Programme9:24Detail Clause 5.5 on actually putting the programme into action. This includes communicating relevant parts of the programme to interested parties, defining objectives, scope, and criteria for each individual audit, selecting and determining audit methods, selecting audit team members and assigning the team leader, providing necessary resources to the audit team, ensuring conduct of audits in accordance with the programme and timetable, ensuring records are managed and maintained, and ensuring follow-up actions are reviewed and accepted. Use a realistic monthly programme implementation calendar to show how the pieces fit together in practice.
- Monitoring, Reviewing, and Improving the Programme9:08Close out Clause 5 with subclauses 5.6 and 5.7. Monitoring means evaluating whether schedules are being met and audit objectives achieved, the performance of audit team members, and the ability of the audit teams to implement the audit plan. Feedback from audit clients, auditees, auditors, and technical experts informs corrective actions and opportunities for improvement. Reviewing the programme means periodically evaluating whether overall objectives have been achieved, lessons learned have been applied, and the programme should be modified. Show how this loop directly feeds management review under ISO 9001 Clause 9.3 and equivalent requirements in other standards.
- Section 3 Quiz: Managing an Audit Programme
- Roleplay: Managing an Audit Programme
- Initiating the Audit and Establishing First Contact8:32Cover Clause 6.2 on initiating the audit. The audit team leader should ensure initial contact for the audit with the auditee is established, the channels of communication are defined, the authority to conduct the audit is confirmed, relevant information is provided on objectives, scope, methods and audit team composition, access to relevant information is agreed, applicable statutory and regulatory requirements are confirmed, arrangements for the audit are confirmed, and any concerns are resolved. Address how to determine audit feasibility — whether sufficient and appropriate information, cooperation from the auditee, and adequate time and resources are available.
- Preparing Audit Activities: Document Review, Plan, and Work Assignments7:17Detail Clause 6.3 on preparing audit activities. Begin with performing review of documented information to gather information for the audit and to prepare audit activities and applicable work documents, including determining the adequacy of documented information against the audit criteria. Move to audit planning — what the audit plan should contain, including objectives, scope, criteria, locations, dates and times, methods, roles and responsibilities, and resource allocation. Cover assigning work to the audit team based on competence and impartiality, and preparing work documents such as checklists, sampling plans, and forms for recording information.
- Audit Checklists Done Right7:15Dedicate focused attention to building audit checklists that drive value rather than mechanical tick-boxing. Effective checklists translate audit criteria into open-ended questions that elicit evidence, prompt the auditor to verify multiple sources, and leave space for unexpected observations. Cover the difference between requirement-driven checklists, process-driven checklists, and risk-driven checklists, when each is appropriate, and how to balance preparation with flexibility. Address common pitfalls — checklists so detailed they become rigid scripts, or so vague they fail to ensure coverage of the audit criteria. Show what a strong checklist line item actually looks like.
- Opening Meeting: Setting the Tone7:57Cover the opening meeting required under Clause 6.4.3 to confirm the agreement of all parties to the audit plan, introduce the audit team, ensure all planned audit activities can be performed, confirm communication channels, provide an opportunity for the auditee to ask questions, and confirm logistics such as audit safety, security, emergency procedures, and confidentiality arrangements. Discuss the right level of formality for internal versus certification audits, how to handle a defensive auditee, and why a well-run opening meeting prevents misunderstandings that would otherwise surface as disputes during the closing meeting.
- Communication, Sampling, and Gathering Evidence7:32Work through the core of audit fieldwork covered in Clauses 6.4.4 through 6.4.7. Address communication during the audit including regular audit team meetings, communication with the auditee, and the role of guides and observers. Cover audit sampling — judgement-based and statistical sampling approaches, when to use each, and how to document sampling rationale. Examine information sources including interviews, observation of activities, reviewing documented information, summarising data, reports from other sources, and records. Tie everything back to the evidence-based principle: evidence must be verifiable, sufficient, and traceable.
- Interview Techniques That Surface Real Evidence8:32Develop interviewing as a core auditor skill rooted in Annex A.17 of ISO 19011:2018. Cover preparation including selecting the right interviewees from appropriate levels and functions, scheduling that respects operational priorities, and clarifying the purpose at the outset. Walk through question types — open, probing, clarifying, closed — and when each belongs in the conversation. Address active listening, neutral body language, managing silence, handling defensive or evasive responses, and the ethical line between rigorous inquiry and intimidation. Show how to summarise responses back to the interviewee to confirm understanding before recording evidence.
- Generating Findings and Reaching Audit Conclusions6:15Cover Clauses 6.4.8 and 6.4.9 on generating audit findings and determining audit conclusions. Evidence is evaluated against criteria to produce findings, which indicate conformity, nonconformity, or opportunities for improvement. Findings should be reviewed with the auditee to obtain acknowledgement that evidence is accurate and the nonconformities are understood, with any disputes recorded. The audit team then prepares for the closing meeting by determining audit conclusions addressing the extent of conformity, effective implementation, capability of management review, achievement of audit objectives, coverage of scope, and root causes where applicable.
- Closing Meeting, Report, and Follow-Up9:53Finish Clause 6 with the closing meeting, audit report, audit completion, and follow-up. The closing meeting presents findings and conclusions, addresses divergent opinions, and identifies post-audit activities. The audit report prepared under Clause 6.5 should provide a complete, accurate, concise, and clear record of the audit. Audit completion under Clause 6.6 occurs when all planned activities are performed or otherwise agreed with the client. Conducting follow-up under Clause 6.7 verifies completion and effectiveness of corrections, corrective actions, and improvements — without which findings become paper exercises.
- Remote Auditing Techniques6:32Address remote auditing as expanded in the 2018 edition and accelerated by recent global events. Remote auditing uses information and communication technologies to obtain evidence and interact with the auditee when physical presence is not possible or not preferred. Cover technologies — video conferencing, document portals, screen sharing, live video walkthroughs, drones for hard-to-reach areas — and their fit with different audit activities. Examine the risks: technology failure, inability to observe culture and physical conditions, security of transmitted information, and verification of identity. Provide criteria for deciding when remote, on-site, or hybrid approaches are appropriate.
- Section 4 Quiz: Conducting an Audit from Initiation to Follow-Up
- Roleplay: Conducting an Audit from Initiation to Follow-Up
- Anatomy of a Well-Written Nonconformity8:02Break down the three components every nonconformity statement must contain: the requirement (audit criterion), the evidence (what was seen, said, or read with traceable references), and the nature of the gap (the precise way the evidence fails to meet the requirement). Walk through good and bad examples to show why vague findings invite dispute and why specificity protects both auditor and auditee. Cover how to phrase findings objectively, avoid loaded language, reference clauses precisely, and link evidence to the right level of the management system — process, document, or implementation.
- Major Versus Minor Nonconformities and Observations9:13Examine the classification system used across most management system audits even though ISO 19011 itself does not mandate categories. A major nonconformity typically reflects a systemic failure to meet a requirement, the absence or total breakdown of a required process, or a situation that raises significant doubt about the capability of the management system to achieve its intended outcomes. A minor nonconformity is usually an isolated lapse in an otherwise effective process. Observations or opportunities for improvement are not nonconformities but signal areas where the system could be strengthened. Address how certification bodies typically apply these categories.
- Root Cause Analysis and Correction Versus Corrective Action9:41Clarify the critical distinction between correction (action to eliminate a detected nonconformity) and corrective action (action to eliminate the cause of a nonconformity to prevent recurrence). Strong corrective action depends on credible root cause analysis using techniques such as the five whys, fishbone diagrams, fault tree analysis, and process mapping. Examine common failure modes: stopping at the symptom, blaming individuals rather than examining systems, addressing one branch while ignoring others, and treating corrective action as a documentation exercise rather than a real change to how the organization operates.
- Verifying Corrective Action Effectively6:24Cover the auditor's responsibility under Clause 6.7 for verifying the completion and effectiveness of corrective action. Verification is not merely confirming that a corrective action plan exists — it requires evidence that the action has been implemented and that it has actually eliminated the cause and prevented recurrence. Address sample-based verification across multiple instances and timeframes, when desk reviews are sufficient and when on-site verification is required, and how to handle situations where the corrective action solved the immediate issue but introduced new risks. Show how follow-up audits should be planned and documented.
- Audit Findings That Drive Improvement, Not Defensiveness6:48Step back from technical classification to address the strategic question: how do auditors generate findings that organizations actually want to act on? Cover the language and framing choices that distinguish a finding perceived as policing from one perceived as partnership. Explore the right balance between identifying nonconformities and surfacing opportunities for improvement, the role of positive findings in mature audit reports, and how to communicate systemic patterns across multiple individually-minor findings. Connect this back to the audit programme objectives — audits exist to add value, not to accumulate paperwork.
- Section 5 Quiz: Findings, Nonconformities, and Corrective Action
- Roleplay: Findings, Nonconformities, and Corrective Action
- Determining the Competence Auditors Need10:19Examine Clause 7.2 on determining auditor competence. The standard requires a combination of personal behaviour and the ability to apply knowledge and skills gained through education, work experience, auditor training, and audit experience. Personal behaviour attributes listed in Annex A include ethical conduct, open-mindedness, diplomacy, observation, perceptiveness, versatility, tenacity, decisiveness, self-reliance, openness to improvement, cultural sensitivity, and collaboration. Knowledge and skills should cover audit principles, procedures, methods, management system standards, the organizational context, and applicable legal and contractual requirements.
- Discipline-Specific and Sector-Specific Competence8:05Build on generic auditor competence with the discipline-specific and sector-specific knowledge required for credible audits in particular fields. A quality management system auditor needs depth in process approach, customer focus, and quality tools. An environmental auditor needs knowledge of environmental aspects, regulatory frameworks, and lifecycle thinking. An information security auditor needs grounding in risk assessment, controls, and applicable laws. Address how audit teams combine generalists, specialists, and technical experts to cover required competence, and how the team leader's competence requirements differ from those of team members.
- Establishing Evaluation Criteria and Selecting Methods7:47Cover Clauses 7.3 and 7.4 on establishing auditor evaluation criteria and selecting the appropriate evaluation method. Criteria should be qualitative — desired personal behaviour, knowledge, skills, and demonstration of attributes — and quantitative where appropriate, such as years of experience, number of audits conducted, or hours of training. Evaluation methods include record review, feedback, interviews, observation, testing, and post-audit review. Show how organizations typically combine methods at different career stages — initial qualification, ongoing evaluation, and team leader assessment — and how the rigour of evaluation should be proportional to the audit risk.
- Conducting Auditor Evaluation in Practice9:30Translate Clause 7.5 into practical evaluation processes. Cover the typical lifecycle: initial competence assessment using education and prior experience, witnessed audits where a candidate is observed by a qualified evaluator, performance feedback after each audit from team leaders and auditees, periodic re-evaluation to confirm continued competence, and remedial action when gaps are identified. Address the documentation expectations — competence records, evaluation evidence, decisions made, and the rationale for those decisions — and how these records support both internal governance and external scrutiny from certification bodies and accreditation authorities.
- Maintaining and Improving Competence Over a Career7:53Close with Clause 7.6 on maintaining and improving auditor competence through continuing professional development. Cover the activities that count: additional work experience, training, private study, coaching, attendance at meetings, seminars, and conferences, and other relevant activities. Examine how recognised auditor certification schemes such as those aligned with IRCA and Exemplar Global structure CPD requirements. Address the practical reality that standards evolve, technologies change auditing methods, and personal behaviour develops with experience — so an auditor who stops learning quickly becomes one whose findings the organization stops trusting. End with a practical CPD planning approach.
- Section 6 Quiz: Auditor Competence, Evaluation, and Continuing Development
- Roleplay: Auditor Competence, Evaluation, and Continuing Development
Requirements
- Working familiarity with at least one ISO management system standard such as ISO 9001 or ISO 14001
- Basic understanding of management system terminology including process, policy, and objective
- Comfort reading clause-numbered international standards
- Professional English language proficiency for audit communication
- No prior auditor certification required, though it is helpful
Description
This course contains the use of artificial intelligence.
Audits are where management systems either prove their worth or quietly fall apart. Whether you are an internal auditor for an ISO 9001 quality system, a lead auditor planning a programme across quality, environment, and health and safety disciplines, a supplier development manager running second-party audits, or a compliance professional preparing for a certification visit, the quality of your audits is the quality of your evidence — and ISO 19011:2018 is the international guidance that defines what good looks like.
This course delivers complete clause-by-clause coverage of ISO 19011:2018, the 2018 guidance standard for auditing management systems. You will master the seven principles of auditing including the risk-based approach introduced in the 2018 revision, manage an audit programme from objectives through monitoring and improvement, conduct an audit end-to-end from initial contact through follow-up verification, write nonconformities that hold up under scrutiny, classify findings as major, minor, or observation, and apply the competence and evaluation requirements that determine whether your auditors are credible. You will work through audit checklists, sampling methods, interview techniques, opening and closing meetings, evidence triangulation, remote auditing techniques, combined and joint audits, root cause analysis, and corrective action verification — all anchored to the precise clauses of the standard.
This course is built for internal auditors, lead auditors, audit programme managers, quality and HSE professionals, supplier auditors, certification body candidates, and compliance officers who need a defensible command of ISO 19011. Prior familiarity with at least one management system standard helps but is not required. By the end you will be able to plan a full audit programme, conduct audits that generate findings organizations actually act on, evaluate auditor competence against documented criteria, and verify corrective action with confidence.
What sets this course apart is its uncompromising fidelity to the 2018 standard combined with the practical judgement that distinguishes a tick-box auditor from a trusted one. Every concept is grounded in the clauses of ISO 19011, every technique is illustrated with realistic scenarios, and every lecture is designed to give you something you can apply on your very next audit. Enrol now and build the audit capability that your organization, your clients, and your career depend on.
Who this course is for:
- Internal auditors building or refreshing their core ISO 19011 capability
- Lead auditors and audit programme managers responsible for audit quality
- Quality, environmental, and HSE professionals running first-party audit programmes
- Supplier development and procurement professionals conducting second-party audits
- Candidates preparing for IRCA, Exemplar Global, or equivalent auditor certification