Internal Audit Requirements 2026-2027: ISO 19011, GFSI and FSSC v7

What changes for internal audit in 2026 and 2027?

The ISO method and criteria, not the programme rules of the GFSI schemes. The table brings together, as at 5 November 2026, the dates that weigh on an internal audit programme, with their source.

ISO 45001:2018 remains in force, with its revision expected in 2027. FSSC 22000 v6 certificates are withdrawn after 30 June 2028.

What does ISO 19011:2026 change for an internal audit programme?

Mainly remote auditing. According to its foreword, the 2026 edition brings in the guidance of ISO/IEC TS 17012 on remote audit methods and extends Annex A to these methods and to virtual locations. The standard recommends that the audit programme specify the methods used, remote methods included (clause 5.1).

The rest of the framework is confirmed. The seven principles of auditing each have their own subclause, from integrity (4.2) to the risk-based approach (4.8). The definition of an internal audit, conducted by the organization itself or on its behalf, and the principle of the combined audit are both maintained: an outsourced or combined QHSE programme fits within the standard with no adjustment.

One point to watch for food sites: the FSSC 22000 Version 7 scheme, published in May 2026, still cites ISO 19011:2018 in its normative references. A procedure shared between ISO 9001 and FSSC 22000 can refer to the 2026 edition for method, provided it meets the scheme’s own requirements. What the 2026 edition means for auditors is detailed in our article on what ISO 9001:2026 changes for internal auditors.

Do ISO 9001:2026 and ISO 14001:2026 amend clause 9.2?

The transition documents of Global ACI (Global Accreditation Cooperation Incorporated, which has taken over the role of the International Accreditation Forum, IAF) do not list it among the changes. For ISO 9001:2026, they list in particular clauses 5.1.1, 5.2.1, 6.1, 6.3, 7.3 and 9.3.2; for ISO 14001:2026, alignment with the harmonized structure, a new clause 6.3 on planning of changes and new subclauses under 9.3. Both lists are presented as not exhaustive, and the wording of the requirement itself belongs to the paid ISO standards, which we do not reproduce.

What certainly changes is the content of the programme. Global ACI sets the minimum content of the transition audit: the changed requirements, changes to the organisation’s context and the need for any other changes to its management system. An internal audit run on a 2015 checklist therefore does nothing to prepare for this step. The 2027 programme of a site certified to ISO 9001 and ISO 14001 should include at least one audit of the amended clauses, before the management review that precedes the transition audit.

For an integrated system, a certification rule also touches internal audit. Global ACI-TECH-3-008, applicable since 28 August 2026, takes over IAF MD 11 without any substantive change: among the criteria that characterise an integrated management system, it lists an integrated approach to internal audits. A combined QHSE internal audit is therefore one piece of evidence of the level of integration that the certification body assesses when it calculates the duration of a combined audit.

Do the internal audit rules of BRCGS, IFS and FSSC 22000 change?

Not in substance: all three schemes keep their requirements, and only FSSC 22000 has published a new version, which carries its rules over.

Comparing the FSSC texts is instructive. Clause 2.5.18.2 of version 7 repeats that of version 6: a programme set by the central function and covering every site at least once a year, internal auditors independent from the areas they audit, a Lead Auditor with a 40-hour course, internal auditors with a 16-hour course, technical review of reports, annual performance monitoring and calibration. Two wordings change. The 8-hour scheme training covers ISO 22000 in the “relevant version linked to the Scheme” and the sector-specific prerequisite programmes of the ISO 22002-x series, which replace the ISO/TS 22002-x documents and the PAS; and the technical review refers to the same series.

For a multi-site group, the practical consequence is simple: the scheme training of its internal auditors must cover FSSC 22000 Version 7 and the parts of the ISO 22002 series that apply to its sector, ISO 22002-100:2025 included, before the upgrade audit. The full requirements are detailed in our guide to outsourced internal audits.

What should you do in your 2027 audit programme?

Update it once, for every deadline. Moroccan sites certified to both ISO standards and GFSI schemes, common among food exporters, face several of these dates at once.

• Update the reference to ISO 19011:2026 in the internal audit procedure and specify which remote audit methods are allowed.
  
• Check which edition of ISO 19011 each sector scheme applied on site refers to.
  
• Upgrade internal auditors on the amended clauses of ISO 9001:2026 and ISO 14001:2026.
  
• Put an audit of the amended clauses into the programme before the transition audit.
  
• For an integrated system, schedule combined internal audits and keep the checklists that prove it.
  
• Check BRCGS coverage (four dates, every activity) and IFS coverage (every requirement within 12 months, 15 at most).
  
• For a multi-site FSSC 22000 group, update internal auditors’ scheme training before the v7 upgrade audit.
  
• Keep the health and safety checklist on ISO 45001:2018 until the revised version is published.
  

How to prepare a site for an audit assigned to an external auditor is covered in our how-to on preparing for an outsourced internal audit.