The Short Answer Is: It Depends
Remote ISO certification audits are real, they are accepted by accredited certification bodies, and they are being used by businesses across Australia and globally. But can your entire audit be done remotely? That depends on your industry, your certification body, the standard you are pursuing, and honestly, whether your situation actually suits it.
On this page
This is a question I get asked a lot, and the honest answer is more nuanced than a simple yes or no. Let me walk you through what remote audits actually involve, when they work well, when they do not, and what you need to know before agreeing to one.
What Is a Remote ISO Audit?
A remote ISO audit is an audit conducted without the auditor being physically present at your site. Instead of your auditor flying in or driving to your premises, the audit is conducted using video conferencing tools, screen sharing, document portals, and sometimes live camera walkthroughs of your facilities.
The concept is not new, but it became significantly more common after 2020 when travel restrictions forced certification bodies to adapt. What started as a temporary workaround has since become a formally recognised approach under ISO 19011, which provides guidelines for auditing management systems, and is also addressed in IAF MD 4 and IAF MD 20, which are the International Accreditation Forum documents governing remote and information and communications technology based audits.
The IAF Mandatory Document MD 4 specifically covers the use of ICT for auditing purposes and sets out conditions under which remote audits are acceptable. Accredited certification bodies must follow this guidance when conducting remote audits.
Types of Remote Audit Arrangements
Before we get into whether your entire audit can be remote, it helps to understand the different arrangements that exist in practice.
Fully Remote Audits
This is where both Stage 1 and Stage 2 of the certification audit are conducted entirely online. No auditor visits your premises at any point. All document reviews, interviews with staff, and process walkthroughs happen via video call and shared screens.
Hybrid Audits
This is the most common arrangement. Stage 1, which is the document review and readiness assessment, is done remotely. Stage 2, which is the main certification audit, involves at least some on-site time, particularly for physical verification of processes, equipment, or site conditions.
Partially Remote Audits
Some certification bodies will conduct the bulk of an audit remotely but require the auditor to attend on-site for specific activities that cannot be verified any other way. Think of a food manufacturer where the auditor needs to physically observe hygiene practices on the production floor.
When a Fully Remote Audit Is Realistic
There are genuine situations where a fully remote audit is not just possible but actually makes sense. Here are the main ones.
Software and Technology Companies
If your business delivers services digitally, such as software development, IT services, cloud hosting, or consulting, a remote audit can cover virtually everything an on-site audit would. Your processes live in systems, your documents are digital, and your staff work from laptops. An auditor can review your quality management system, interview your team, and examine evidence of conformance without ever stepping foot in your office. ISO certification for software companies is increasingly being done fully remotely for this reason.
Professional Services Firms
Consulting firms, legal practices, accounting businesses, and similar organisations often have minimal physical infrastructure that needs to be inspected. If your scope of certification does not include any physical production, storage, or equipment operation, a remote audit is usually straightforward.
Remote or Distributed Workforces
If your team works across multiple locations or predominantly from home, a remote audit can actually be more practical than an on-site one. The auditor can interview staff from different locations in a single day without the logistical complexity of travelling between sites.
Surveillance and Recertification Audits for Established Businesses
Once your system is established and your certification body already has a good understanding of your operations, subsequent surveillance audits and recertification audits are often well-suited to remote delivery. The auditor is not starting from scratch and already knows what to look for.
When Remote Audits Do Not Work Well
This is the part that does not get talked about enough. Remote audits have real limitations, and pretending otherwise does a disservice to businesses trying to make informed decisions.
Manufacturing and Industrial Operations
If you run a manufacturing facility, a construction site, a warehouse, or any operation where physical processes are central to your scope, a fully remote audit is unlikely to be accepted by your certification body, and for good reason. An auditor cannot genuinely verify that your production process controls are working, that your equipment is calibrated, or that your housekeeping meets requirements by watching a video call. Some things need to be seen in person.
Occupational Health and Safety Audits
For ISO 45001, physical site walkthroughs are often critical. Hazard identification, physical controls, emergency equipment, and safe work practices are all things that benefit significantly from an auditor being present on site. A camera walkthrough can help, but it is not the same as walking the floor with an auditor who can stop, observe, and ask questions in real time.
Food Safety and Environmental Audits
Standards like ISO 22000 and ISO 14001 often require observation of actual processes and physical conditions. If you are certifying a food processing operation, an environmental monitoring program, or a facility with significant environmental aspects, expect your certification body to require at least some on-site time.
First-Time Certification
Even for businesses where remote audits are theoretically possible, many certification bodies are cautious about conducting a fully remote initial certification audit for a business they have never audited before. There is a higher level of risk involved in certifying a new client without any physical verification, and responsible certification bodies reflect that in their approach.
What the IAF Says About Remote Audits
The International Accreditation Forum has been clear that remote audits are a legitimate tool, but not an automatic replacement for on-site auditing. IAF MD 4 outlines that the use of ICT-based auditing must be planned carefully, that the risks of using remote methods must be assessed, and that certain audit activities may still require physical presence.
Importantly, the decision about whether a remote audit is appropriate sits with the certification body, not the client. You can request a remote audit, but your certification body makes the final call based on your scope, your risk profile, and the requirements of the standard you are being audited against.
It is also worth noting that accreditation bodies like JAS-ANZ in Australia oversee how certification bodies apply these rules. If a certification body is offering fully remote audits for every client regardless of scope or industry, that should raise questions about whether they are meeting their accreditation obligations. This is one reason why understanding the role of JAS-ANZ matters when you are choosing a certification body.
Practical Requirements for a Remote Audit to Work
If your situation is suitable for a remote audit, there are practical things you need to have in place to make it work properly. Do not assume that because the audit is remote, it will be easier or require less preparation.
Reliable Technology Infrastructure
You need stable internet, a functioning camera, and a quiet space for interviews. If your connection drops every ten minutes or your team is trying to participate from a noisy open-plan office, the audit will be frustrating for everyone and the quality of the evidence gathered will suffer.
Organised and Accessible Documentation
In an on-site audit, an auditor can ask to see a document and you can walk to a filing cabinet or pull it up on a shared screen. In a remote audit, everything needs to be accessible quickly and in a format that can be shared electronically. If your documentation is scattered across different systems, email folders, and shared drives, a remote audit will expose that very quickly. Good controlled document management is not just good practice, it is essential for remote audits.
Staff Availability and Preparation
Your auditor will need to interview different people across your organisation. In a remote audit, scheduling these interviews across a day or two requires more coordination than an on-site visit where the auditor can simply walk to someone's desk. Make sure your team knows in advance who will be interviewed, when, and what to expect.
Camera Walkthroughs Where Required
If your certification body agrees to a remote audit but wants to see your physical space, you will need someone on-site with a camera, ideally a tablet or phone with a good camera and a stable connection, who can walk the auditor through your premises in real time. This person needs to know your facility well enough to answer questions on the spot.
How to Prepare for a Remote ISO Audit
Preparation for a remote audit is not fundamentally different from preparing for an on-site one, but there are some specific things worth focusing on. We have a detailed article covering tips before running a remote ISO certification audit that goes deeper on the practical side, but here are the key points.
- Test your technology before the audit day. Do a trial run with your auditor or at least with a colleague to confirm your video, audio, and screen sharing all work properly.
- Organise your documents into a shared folder or portal that the auditor can access easily. Label everything clearly so you are not hunting for files during the audit.
- Brief your team. Everyone who might be interviewed should understand what the audit is for, what questions they might be asked, and how to present evidence clearly.
- Confirm the audit plan in writing. Make sure you know exactly what the auditor will be covering each day, who needs to be available, and what documents they will want to review.
- Have a backup plan. If technology fails on the day, know what the contingency is. Will you reschedule? Can you switch to a phone call? Agree this with your certification body in advance.
The Risks of Agreeing to a Remote Audit When It Is Not Appropriate
This is something I want to be direct about. Some businesses push for fully remote audits because they seem cheaper or more convenient. Some certification bodies offer them because they reduce travel costs. But if a remote audit is not genuinely appropriate for your scope and operations, agreeing to one creates real problems.
The most obvious risk is that your certificate may not reflect the true state of your operations. If an auditor cannot physically verify certain processes and has to take your word for it, non-conformances that would have been caught on-site may be missed. That is not a win. It means your system has gaps that are not being addressed.
There is also a credibility risk. If your clients or a government tender evaluator ever scrutinise how your audit was conducted and it appears that key physical processes were never actually inspected, that can undermine confidence in your certification. A certificate that was earned through a genuinely rigorous audit is worth more than one that was issued after a convenient video call.
Understanding what determines the number of audit days you need is also relevant here. Remote audits sometimes result in fewer audit days being quoted, but that does not always mean less rigour. Make sure you understand what is actually being covered.
Choosing a Certification Body That Handles Remote Audits Well
Not all certification bodies are equally experienced with remote auditing. When you are comparing providers, ask specific questions about how they conduct remote audits, what technology they use, how they handle situations where physical verification is needed, and what their policy is if the remote audit reveals limitations that require an on-site visit.
A good certification body will be transparent about the limitations of remote auditing and will not simply offer it as a blanket option to win your business. If a certification body tells you that everything can be done remotely without asking any questions about your operations, that is a flag worth paying attention to.
If you are comparing multiple certification bodies and want to make sense of the different approaches and quotes you are receiving, CertBetter makes that process straightforward. You submit one form, receive up to three competing quotes from vetted certification bodies, and can compare them side by side without spending hours chasing providers individually. It is free for businesses and takes the guesswork out of finding a provider that suits your specific situation.
