Remote ISO Audits: What a Certification Body Can Audit Online, and What Still Needs a Site Visit
Many certification audits can now run largely online. The rules decide how much, and a risk assessment decides the rest. Here is what changed, what can run remotely, and how to get ready.
A cloud-first company with no server room and a team spread across three time zones often asks the same question: does the auditor really need to fly in? For many ISO certification audits, the answer is no longer an automatic yes.
A remote audit is still an accredited audit. It follows the same standard, gathers the same evidence and leads to the same certificate. What changes is how the auditor reaches the people, records and places in scope. This guide explains the rules behind remote ISO audits, what can run online, and what still needs someone on site.
Quick answer: Accredited certification bodies can run a remote audit using video calls, screen sharing and remote document review when a risk assessment shows the evidence will be reliable. IAF MD 4:2025 sets the rules for using this technology, and accreditation bodies expect certification bodies to apply it from 30 January 2026. For ISO 27001, ISO/IEC 27006-1:2024 removed the old 30% cap on remote audit time, so some ISMS audits can now run fully online. Sites with physical controls may still need a visit.
What Is a Remote Audit in ISO Certification?
A remote audit is any part of a certification audit that the auditor carries out without being physically present. The accreditation rules call this using information and communication technology (ICT). It covers more than video calls.
Interviews
Opening and closing meetings, and interviews with process owners, held over video.
Document review
Policies, records and reports shared securely, often before the interview starts.
Live walkthroughs
Screen sharing of cloud consoles, ticketing tools, HR systems and logs, so the auditor sees records at source.
Remote site views
Live video of a facility, warehouse or plant room, where the risk allows it.
Many audits are hybrid: interviews and system reviews run online, and the auditor visits only the locations that need it. A location where all work happens online, such as a cloud platform, can be treated as a virtual site in the audit plan.
The Rules Behind Remote Audits
Remote auditing is not a shortcut a certification body can choose on its own. Two documents set the rules for accredited management system audits.
| Document | What it sets | Key points |
|---|---|---|
| IAF MD 4:2025 | How certification bodies may use ICT in any accredited audit | Issued 30 January 2025, applied from 30 January 2026. Both sides must agree. The risks are assessed and the technology is checked before the audit. |
| ISO/IEC 27006-1:2024 | Requirements for bodies certifying ISO 27001 | Removed the earlier limit of 30% of audit time for remote ISMS auditing. The share is set by a risk analysis, and up to 100% can be remote. |
| Your scheme or customer | Extra rules for some sectors or contracts | Sector schemes, regulators or customer contracts may require on-site visits. These rules take priority. |
Under IAF MD 4:2025, the audit plan must say when and how far remote methods will be used. The auditors must be competent with the tools, and the report must record how remote methods were used and how well they worked. Time spent auditing remotely counts toward the total audit time.
One more change is worth knowing. Since 1 January 2026, the work of the International Accreditation Forum (IAF) has passed to the Global Accreditation Cooperation Incorporated (Global ACI). Accreditations recognized under the IAF MLA continue to be recognized. If you want to understand how accreditation works, read our guide to what an ISO certification body is.
What Can Be Audited Remotely, and What Still Needs a Site Visit
The deciding question is simple: can the auditor get evidence online that is as reliable as seeing it in person? If yes, that activity can be remote.
| Audit activity | Usually remote? | Why |
|---|---|---|
| Opening and closing meetings | Yes | Video works as well as a meeting room |
| Interviews with process owners | Yes | Answers and records can be checked live |
| Policies, risk assessment and records | Yes | Shared securely and reviewed at source |
| Cloud platforms and software tools | Yes | The auditor sees settings, tickets and logs on screen |
| Offices with physical security controls | Sometimes | Live video may work; visitor, desk and access controls often need a visit |
| Data centres, plants and warehouses | Often on site | Physical conditions are hard to verify on camera |
| High-risk or hazardous operations | Case by case | Remote video can reach hard places, but safety controls usually need a visit |
The certification body makes this call during the application review, before it plans the audit. A sound one will explain which parts it plans to run remotely and why.
Planning an ISO 27001 audit for a cloud-based team? See how our audits work, from scope review to certificate.
See ISO 27001 certificationRemote ISO 27001 Audits for Cloud-First Teams
Information security is where remote auditing fits best. Most ISO 27001 evidence already lives in systems: access reviews, joiner and leaver records, change tickets, vulnerability fixes, backups and incident logs. An auditor can sample them live on screen.
Before ISO/IEC 27006-1:2024, remote auditing of an ISMS was limited to 30% of the audit time. That limit has gone. A certification body now carries out a risk analysis for each client, looking at factors such as the infrastructure, the sector, the type of audit and the scope. For a company whose whole ISMS runs in the cloud, that analysis can support a fully remote ISO 27001 audit.
A remote ISO 27001 audit is not a lighter audit. Stage 1 still reviews your ISMS documents, risk assessment and Statement of Applicability. Stage 2 still tests that controls work in practice. If you sell software, our page on ISO 27001 for SaaS explains how to scope a cloud product, and how to get ISO 27001 certified covers the full process.
Do Remote Audits Reduce Audit Days or Cost?
Remote audits do not cut audit days. Under IAF MD 4:2025, time spent auditing remotely counts toward total audit time, and audit days are still calculated from the rules for each standard. For ISO 27001, that means ISO/IEC 27006-1:2024 and the people within your ISMS scope.
The saving is mostly in travel. With no flights or hotels, travel and expenses fall away, and audits are easier to schedule around your team. Read our ISO 27001 certification cost guide for what drives the price.
How to Prepare for a Remote Audit
Most problems in a remote audit are practical, not technical. A dropped call or a missing login wastes audit time you are paying for. Before the audit:
- Agree the video and file-sharing tools with the certification body, and test them with the auditor before the first session.
- Set up secure, read-only access to the systems the auditor needs to see, and remove it after the audit.
- Name one coordinator who can share screens and find records quickly.
- Put key documents in one shared folder: scope, policies, risk assessment, Statement of Applicability, internal audit and management review.
- Make sure interviewees can join from a quiet place with a camera, and book them into the audit plan.
- For any site visit, confirm which locations, dates and contacts are in scope.
Questions to Ask a Certification Body About Remote Audits
| Question | What a good answer covers |
|---|---|
| Which parts of our audit will run remotely? | A clear split between remote and on-site work, with reasons |
| How did you decide that? | A risk assessment during application review, in line with IAF MD 4:2025 |
| Which tools will you use, and how is our data protected? | Agreed tools, secure sharing and clear rules for handling your data |
| Does remote change our audit days? | No reduction just for being remote; savings come from travel |
Comparing several bodies? Our guide to ISO 27001 certification companies has a full scorecard, and you can check any certificate we issue on our certificate verification page.
Auditing teams in India?
See how remote and hybrid audits work for Indian IT, SaaS and GCC teams.
Remote and Hybrid Audits with Accredify Global
On-site, remote or hybrid
We confirm the format at your scope review, based on a risk assessment and the accreditation rules.
Cloud-first teams
Teams with no physical infrastructure in scope can be audited largely online.
Senior auditor
A senior auditor leads every audit, whether it runs on screen or on site.
Fixed fee
One fixed-fee proposal for your real scope, with no hidden costs or scope creep added later.
We are accredited by UAF, an IAF MLA signatory, and audit organizations in 71 countries for standards including ISO 27001, ISO 9001 and ISO 42001. Our trust and impartiality page explains the rules we follow, and teams in the US can see ISO certification in the USA.
Want to know how much of your audit can run remotely?
Tell us your scope, sites and systems. We'll explain which parts can be remote, suggest dates and send a fixed-fee proposal.
Book your free scope review →Remote ISO Audit FAQ
What is a remote audit in ISO certification?
It is any part of an accredited certification audit carried out without the auditor on site, using video calls, screen sharing and remote document review. It follows the same standard and leads to the same certificate as an on-site audit.
Are remote ISO audits allowed by accreditation rules?
Yes. IAF MD 4:2025 sets the rules for using information and communication technology in accredited audits, and accreditation bodies expect certification bodies to apply it from 30 January 2026. Both sides must agree, and the risks must be assessed first.
Can an ISO 27001 audit be done fully remotely?
It can. ISO/IEC 27006-1:2024 removed the earlier 30% limit on remote ISMS audit time. The share that runs remotely is set by a risk analysis, so a company whose ISMS runs entirely in the cloud may be audited fully online.
What parts of an audit still need a site visit?
Locations with physical controls that are hard to verify on camera, such as data centres, plants, warehouses and some offices. Sector schemes, regulators or customer contracts may also require on-site visits.
Do remote audits reduce audit days?
No. Time spent auditing remotely counts toward total audit time, and audit days are still calculated from the rules for each standard. The saving comes mainly from travel and expenses.
Is a remote audit certificate as valid as an on-site one?
Yes. An accredited certificate is issued against the same standard and scope whichever way the evidence was gathered. The audit report records how remote methods were used.
How do I prepare for a remote ISO audit?
Test the agreed video and file-sharing tools with the auditor, set up secure read-only access to the systems in scope, name one coordinator, gather key documents in one folder, and book interviewees into the audit plan.
What is IAF MD 4:2025?
It is the mandatory document on using information and communication technology for conformity assessment. Issue 3 was issued on 30 January 2025 and extends the rules to validation and verification as well as certification.
Does Accredify Global offer remote ISO audits?
Yes. Accredify Global audits on site, remotely or in a hybrid format, and confirms the format at a free scope review based on a risk assessment and the accreditation rules. A senior auditor leads every audit, and you get a fixed-fee proposal.