What changed in 2026 for ISO 9001 internal audit?
Both the method and the criteria. ISO 19011, which provides the method, was revised in May 2026; ISO 9001, which sets the audit criteria for a quality management system, in September 2026. The transition calendar set by Global ACI then determines when your internal auditors must be ready.
Date | Event | What it changes for the internal auditor | Source |
|---|---|---|---|
27 May 2026 | ISO 19011:2026, fourth edition, published; 2018 edition withdrawn | The reference method is updated, notably for remote auditing | |
16 September 2026 | ISO 9001:2026 published | New audit criteria for the amended clauses | |
31 March 2027 at the latest | Accreditation bodies ready to assess against the 2026 edition | Certification bodies prepare their own transition | Global ACI |
30 June 2027 | Certification bodies submit their readiness declarations | Their auditors must be trained on the 2026 edition | Global ACI |
30 September 2027 | Transition decisions on certification bodies completed | A certification body issues accredited certificates to the 2026 edition only once its accreditation has transitioned | Global ACI |
31 March 2028 | End of initial certifications to the 2015 edition | Every initial audit is carried out against the 2026 edition | Global ACI |
30 September 2029 | End of the transition | Certificates to the 2015 edition are no longer valid | Global ACI |
Global ACI’s dates come from its transition document for ISO 9001:2026, which is mandatory for signatory accreditation bodies and for the certification bodies they accredit. The full certification calendar is covered in our article on the ISO 9001:2026 transition deadline of 30 September 2029.
Auditors of an integrated system face one more deadline: ISO 14001:2026, published in April 2026, has a transition that ends on 30 April 2029. ISO 45001 remains at its 2018 edition, with a revision expected in 2027.
Which ISO 9001:2026 clauses must the internal auditor learn to audit?
Those that Global ACI lists as amended, each with its audit question and its evidence. Global ACI presents its list as non-exhaustive; the content of each change is detailed in our article on the ISO 9001:2026 transition, clause by clause. The table below turns it into an auditor’s checklist.
Clause | Change cited by Global ACI | Question to add to the checklist | Evidence to look for |
|---|---|---|---|
5.1.1 | Top management promotes quality culture and ethical behaviour | What actions by top management promote quality culture? | Shop-floor visits, decisions made in favour of quality, concerns raised and dealt with |
5.2.1 | The policy takes into account the context and supports the strategic direction | Has the policy been reviewed since the last change of strategy or market? | Review date, link with the context analysis |
6.1 | Split into 6.1.1, 6.1.2 and 6.1.3: determining risks and opportunities, actions to address risks, actions to address opportunities | Are opportunities addressed in their own right? | Actions, owners and deadlines specific to opportunities |
6.3 | Monitoring the effectiveness of changes, communicating them and reviewing their results | How was the effectiveness of the last significant change evaluated? | Success criterion, communication plan, dated review |
7.3 | Awareness of quality culture and ethical behaviour | Do the staff interviewed know what is expected of them? | Interviews at the workstation, recorded awareness sessions |
9.3.2 | The review “shall include” each input, including changes in the needs and expectations of interested parties | Do the minutes deal with every input? | Complete minutes, decisions and owners |
The clause numbers are those Global ACI cites in its list “Key Changes Include but Are Not Limited To”. The wording in this table is ACG’s summary of the English Global ACI document, not the text of the standard.
Two practical consequences follow. The numbering of clause 6.1 changes: audit grids, correspondence matrices and cross-references in reports must be reread. And several changes concern behaviour, not documents: quality culture is checked by asking an operator at the end of a shift, not by reading a charter. That is an interviewing skill, and it is built in training.
The internal audit requirement does not appear in Global ACI’s list. As that list is not exhaustive, reread this requirement in your copy of ISO 9001:2026 before updating the internal audit procedure.
What does ISO 19011:2026 change in audit method?
Above all, it expands remote auditing. According to its foreword, the 2026 edition brings in the guidance of ISO/IEC TS 17012 on remote audit methods and extends Annex A to these methods and to virtual locations.
Three points matter directly to the internal auditor:
- A definition. A remote audit method is one that allows audit activities to be performed from a location other than the auditee’s site. It can be combined with on-site methods, be used for virtual locations, or allow an auditor present at one site to audit another.
- Principles set out more clearly. The seven principles of auditing, from integrity to the risk-based approach, each have their own subclause (4.2 to 4.8).
- A confirmed scope. The introduction recalls that the standard focuses on internal audits and second-party audits, and that it applies to combined audits of several management systems.
For a multi-site Moroccan company, for example with a head office in Casablanca and a plant in Tangier, remote auditing makes it possible to review records or interview a process owner without travelling. It does not replace observing a workshop, a loading dock or a store. The choice follows the risk-based approach: what does the auditor need to see in order to reach a conclusion?
Sector schemes do not all move at the same pace. The FSSC 22000 Version 7 scheme, published in May 2026, still cites ISO 19011:2018. A food plant that audits both ISO 9001 and a food safety scheme therefore checks which edition each one uses.
Do internal auditors need to be retrained?
No: an upgrade is usually enough, provided it takes place before the first internal audit against the 2026 edition. The expected level is set, indirectly, by Global ACI.
The transition document requires certification bodies to ensure that their personnel concerned, auditors included, are trained and competent for the revised edition. It also sets the minimum content of the transition audit: the amended requirements of ISO 9001:2026, changes in the organisation’s context, and the need for any other changes to its system. This audit may take place during a surveillance audit, a recertification or a special audit, and may be carried out remotely if the certification body demonstrates that its objectives are met.
The external auditor will therefore arrive trained on the 2026 edition. An internal audit carried out with a 2015 grid would prepare nothing. The upgrade must cover:
Auditors who are new to the job take the full course described in our guide to ISO 9001 internal auditor training.
What training calendar should you aim for in 2027?
Read it backwards from the date of the transition audit. The order is always the same: auditor upgrade, internal audit against the 2026 edition, treatment of nonconformities, management review, transition audit.
A site whose recertification falls in 2028 should train its auditors in 2027, so that it can run a cycle of internal audits against the 2026 edition before the management review. A site aiming for a transition at a surveillance audit at the end of 2027 must train even earlier, after checking that its certification body will have completed its own transition, by 30 September 2027 at the latest.
In Morocco, an upgrade included in the training plan before it takes place may qualify for special training contracts (CSF) run by OFPPT, the national vocational training office, at the planned training rate. No amount is guaranteed: see our page on CSF and OFPPT funding. The method for the first audit after training is set out in our article on the first ISO 9001 internal audit after training.