Can ISO Certification Audits Be Done Remotely?
- Jul 7
- 5 min read
One of the first questions many businesses ask when discussing ISO certification is:
“Does the auditor actually need to come to our premises?”
For years, businesses assumed that an ISO audit automatically meant an auditor spending one or more days on site, sitting in a meeting room, reviewing documents and interviewing staff.
That is no longer always the case.
Remote auditing has become an established part of ISO certification, and for many businesses, a significant proportion of the audit process can be completed using video calls, screen sharing and digital records.
But that does not mean every audit can - or should - be completely remote.
So, when is remote ISO auditing appropriate, what actually happens, and will customers accept a certificate issued following remote audits?
The short answer to remote ISO certification audits
Yes, ISO certification audits can be carried out remotely where the organisation, its activities and the audit objectives make this appropriate.
For many office-based, professional services and technology businesses, remote auditing can work extremely well.
For organisations carrying out manufacturing, construction, engineering or other physical activities, some on-site auditing may still be needed.
The important point is that a remote audit should not be a reduced audit.
The auditor still needs to obtain sufficient evidence to make a proper certification decision.
What actually happens during a remote ISO audit?
A remote audit is not simply a quick video call followed by the issue of a certificate.
The audit still follows a planned process.
The auditor will normally speak to relevant people within the business, review documents and records, follow processes through the organisation and test whether the management system is genuinely being used.
The difference is the way the evidence is accessed.
During a remote audit, this may involve:
video meetings with managers and employees
screen sharing to review systems and records
digital access to relevant documents
demonstrations of software and operational systems
interviews with process owners
For example, during an ISO 9001 audit, the auditor might ask the organisation to demonstrate how a customer enquiry becomes a live project, how requirements are reviewed, how the work is controlled and how the completed job is checked.
For ISO 27001, the auditor may review access controls, risk records, incident processes and security monitoring through the systems used by the organisation.
The questions and evidence requirements remain. The audit method is simply different.
Which businesses are best suited to remote audits?
Remote auditing is particularly effective where the organisation's work and evidence are already largely digital.
This often includes:
consultancies
software and technology companies
professional services firms
remote or hybrid businesses
organisations using cloud-based management systems
If employees already work remotely, records are held electronically and business processes are managed through online systems, asking an auditor to sit physically in the office may add little value.
In these situations, a remote audit can often reflect the way the business actually operates more accurately than a traditional site visit.
When is an on-site audit more likely to be needed?
Some activities are much harder to assess properly from behind a screen.
If a business operates a factory, warehouse, workshop or active construction site, the auditor may need to see physical activities taking place.
This can be particularly relevant where the audit needs to assess:
production processes
environmental controls
workplace health and safety
machinery and equipment
storage arrangements
site-specific operational controls
A construction company, for example, may be able to complete parts of its management system audit remotely while still requiring an auditor to visit an operational site.
The right approach depends on what needs to be seen to reach a reliable conclusion.
Is remote certification less credible?
This is one of the biggest concerns businesses have.
They worry that a remotely audited certificate will somehow be viewed as a lesser form of certification.
The credibility of certification should depend on whether the certification process has been properly conducted - not whether the auditor happened to sit in the same room as the people being interviewed.
A robust remote audit still requires the organisation to demonstrate that its system is working.
The auditor still needs evidence.
Nonconformities can still be raised.
The organisation still needs to meet the requirements of the relevant standard.
A remote audit should never mean an easier audit.
The practical advantages of remote auditing
For suitable businesses, remote audits can make certification much easier to manage.
There is less disruption from having an external auditor on site, and employees in different locations can often join relevant parts of the audit more easily.
It can also reduce unnecessary travel.
For a business with remote employees, several offices or a geographically dispersed management team, this can make the audit considerably more practical.
Instead of forcing everyone into one location for the audit, the assessment can often work around the way the organisation already operates.
What businesses often get wrong
The biggest mistake is assuming that a remote audit requires less preparation.
It does not.
If anything, poor document control can become more obvious during a remote audit.
If the auditor asks to see a training record, internal audit report or customer complaint, the organisation needs to be able to find it.
Problems arise when:
documents are scattered across different systems
nobody knows where records are stored
staff cannot explain their own processes
evidence has been created purely for the audit
the management system is not being used day to day
Whether the auditor is sitting across the table or looking at a shared screen, these weaknesses are usually easy to identify.
Will a remote audit be easier for your staff?
For many businesses, yes.
Some employees find formal audit meetings intimidating, particularly when an external auditor arrives on site and the whole organisation feels as though it is “under inspection”.
Remote auditing can feel more natural, especially for teams already used to online meetings.
However, staff still need to be able to answer questions about the work they actually do.
They do not need to memorise the ISO standard.
They need to understand their responsibilities, the processes they follow and how they deal with problems when they arise.
Should you choose a certification body based on whether it offers remote audits?
Remote auditing can be an important factor, but it should not be the only one.
The more useful question is whether the certification body's audit approach is appropriate for your business.
A completely remote approach may make sense for one organisation but be unsuitable for another.
The certification process should be proportionate to:
your size
your activities
your locations
your risks
the standard being audited
Flexibility is useful. A one-size-fits-all approach is not.
Not sure what type of audit your business would need?
If you are considering ISO certification, you may not yet know whether your audits could be carried out remotely, whether site visits would be required, or how much of your existing system is already suitable for certification.
Our free ISO readiness check can help you understand:
which ISO standards are relevant to your business
how prepared you may already be for certification
what your next steps should look like
Final thought
ISO certification does not have to mean an auditor spending days sitting in your office.
For many modern businesses, remote auditing is a practical and effective way to assess how the management system really works.
But the principle remains the same.
The audit method should fit the business. - and the auditor must still gather enough evidence to make a credible certification decision.
Remote should mean more flexible.
It should never mean less rigorous.
Comments