Yes, an ISO 27001 certification audit can be conducted largely or even entirely remotely, but only when your certification body agrees it can be done credibly. Remote does not mean easier. Auditors still have to verify that your controls work, and for physical controls or complex processes they may still ask to visit. This guide explains what the current rules say, what a remote audit looks like day to day, and how to get your evidence ready so the audit runs smoothly.
TL;DR
- A remote audit uses information and communication technology (video calls, screen sharing, shared evidence) to audit from a place other than your premises. ISO 19011:2026 defines it as synchronous or asynchronous.
- Remote auditing is a tool for efficiency, not a guaranteed replacement for site presence. Physical controls and complex processes can still trigger a visit.
- Since the transition to ISO/IEC 27006-1:2024, the old approval step for remote audits above 30% of audit time is gone, but the audit report must now state how extensive and how effective the remote methods were.
- Read-only access to a static document folder is rarely enough. Plan for live, screen-shared evidence and keep your own log of what you showed.
- Run a gap check before the audit so you are not discovering missing evidence in front of the auditor.
Table of Contents
- What counts as a remote audit under ISO 27001
- What changed with ISO/IEC 27006-1:2024
- What a remote audit cannot fully replace
- Remote audit by stage
- Preparing your evidence for a remote audit
- The technical setup checklist
- Perspective: what we see when teams go remote
- Check your readiness before the auditor does
- Common pitfalls in remote ISO 27001 audits
- How to raise remote delivery with your certification body
- FAQ
- Sources
What counts as a remote audit under ISO 27001
ISO 27001 itself does not describe how an audit is delivered. The rules come from the audit and accreditation standards that sit around it. ISO 19011:2026, the guideline for auditing management systems, defines a remote audit as audit activities conducted from any location other than the auditee’s, using ICT to gather, store, retrieve, process, analyze and transmit information, either in real time or not. The fourth edition also expanded its guidance on remote methods.
For certification audits specifically, the guidance document is ISO/IEC TS 17012:2024, which covers the use of remote auditing methods when auditing management systems. The accreditation community adds its own layer through the IAF Mandatory Document on ICT for auditing, which accredited certification bodies must follow.
In practice, a remote audit usually means some mix of:
- Video meetings for opening and closing sessions and interviews.
- Screen sharing so the auditor can watch you pull evidence from your own systems.
- Document exchange through a secure portal for policies, procedures and records.
- Virtual walk-throughs, for example a camera tour of a server room or office, where the certification body accepts it.
What changed with ISO/IEC 27006-1:2024
If you read older advice, you may see a rule that remote audits above 30% of total audit time needed specific approval from an accreditation body. That practice has been removed. The change came through ISO/IEC 27006-1:2024, the standard for bodies that audit and certify information security management systems, and its transition rules in IAF MD 29. IAF published that mandatory document on 21 May 2024, and the transition was due to be complete by March 31, 2026.
Two consequences matter to you:
- More flexibility. Certification bodies are no longer held to a fixed remote percentage that needs special approval.
- More transparency. The final audit report must include the extent and effectiveness of the remote methods used, and must say if the organization operates with few or no physical sites.
That second point is easy to overlook. Because the auditor now has to write down how well the remote approach worked, they will look for clear evidence that it did. If your screen shares stall, your records are scattered or your access requests drag on, that shows up in the report.
The practical lesson: keep your own record of the audit. Note which sessions were remote, which systems were demonstrated live, which documents were shared and when. It helps the auditor, and it helps you in the next surveillance cycle.
What a remote audit cannot fully replace
The guidance is consistent: remote auditing should be seen as a way to make audits more efficient, not as a complete substitute for being there. The ISO/IEC TS 17012:2024 page positions it that way, and the same material points out that some processes, such as physical risk controls, cannot be fully audited remotely. Expect a hybrid approach when these apply.
Typical areas where an auditor may want eyes on the ground:
- Physical security. Entry points, visitor handling, locked areas, clear desk practice, secure disposal.
- Equipment rooms and data centers you operate. Cabling, environmental controls, rack access.
- Complex or hands-on processes. Where watching people work reveals more than a procedure document does.
If you run a cloud-only company with remote staff, much of this shifts to your providers and to staff home-working controls. In that case the question becomes who is responsible for what. Our guide to ISO 27001 shared responsibility and Annex A mappings shows how to document that split so an auditor can follow it without a site visit.
If you do have an office with access control, a remote walk-through only works if the auditor accepts it. Having your access control and camera setup properly documented and maintained, whether you manage it in-house or with a local security installer, makes either route simpler, remote or on-site.
Remote audit by stage
The audit has two main phases, and remote delivery plays out differently in each. Whether either can be remote is a decision between you and your certification body.
| Audit activity | What the auditor does | Remote-friendly? | What to have ready |
|---|---|---|---|
| Stage 1 (documentation review) | Reviews scope, policies, risk assessment, Statement of Applicability | Usually yes, subject to your certification body | Current, version-controlled documents; clear scope statement |
| Stage 2 (implementation audit) | Tests whether controls are operating, interviews staff, samples records | Partly, often hybrid | Live access to systems, sample records, named interviewees |
| Surveillance audits | Samples parts of the ISMS, checks corrective actions and internal audit | Often yes | Updated risk register, internal audit results, management review minutes |
| Recertification | Reviews overall ISMS performance over the cycle | Depends on body and history | Full-cycle evidence, trend data |
The table shows common patterns, not guarantees. Your certification body sets what it will accept based on your scope, sites and risk profile.
Preparing your evidence for a remote audit
In a face-to-face audit, an auditor can point at a binder or ask someone to open a screen. Remotely, everything has to be reachable through the connection. The IAF guidance warns that both sides must verify their ICT is compatible and secure. It also makes the practical point that auditors often need real-time, synchronous access to evidence, so a read-only folder of static files is rarely sufficient for a Stage 1 or Stage 2 audit.
Build an evidence map
List each control you claim in your Statement of Applicability and next to it write where its proof lives: the ticketing system, the HR platform, the cloud console, the training records. Then decide who will demonstrate it live. Our practical guide to types of evidence for ISO 27001 audits breaks down what auditors accept and how to present it.
Show effectiveness, not just existence
A policy that exists is not the same as a control that works. NIST makes this point in SP 800-53A Rev. 5: assessments, remote or not, should deliver credible inputs to risk management by verifying how controls actually perform, rather than serving as a check-the-box exercise. For a remote ISO 27001 audit, that means being ready to show:
- A recent access review with the removals that came out of it.
- A ticket trail from a real incident or change, start to finish.
- Backup restore test results, not only the backup schedule.
- Evidence that corrective actions from your last internal audit were closed.
If you want to test whether technical controls hold up before the auditor does, a practical web security checklist can give your IT team a quick way to check the externally visible basics, such as headers and certificates.
Make your risk work easy to follow
Auditors spend a lot of remote time on the risk assessment and treatment plan, because they are document-heavy and easy to share. Make sure the logic reads cleanly on a screen. Our guides on ISO 27001 risk assessment methodology and the risk treatment plan template show how to structure them so a reviewer can trace each risk to a decision and a control.
The technical setup checklist
Book a dry run a few days before the audit. Remote audits fail in boring ways.
- Agree the platform. Confirm with the certification body which video tool they use or accept, and whether your security policy allows it.
- Test screen sharing from the actual machines and accounts that will be used, including any VPN or virtual desktop.
- Prepare restricted access. If the auditor needs to see a system directly, use a time-limited, least-privilege account and log it. Do not share personal credentials.
- Handle confidentiality. Agree up front what may be recorded or screenshotted, and how audit material is stored and deleted afterward.
- Plan for interruptions. Have a backup dial-in, a second presenter and a plan for time zones if staff are spread out.
- Schedule interviewees. Give each person a slot, tell them what will be asked, and make sure they can reach their own evidence without fumbling.
- Name a coordinator who keeps the evidence log, tracks requests and closes them the same day.
Perspective: what we see when teams go remote
We build tools that help organizations estimate the cost and effort of ISO 27001, and one pattern shows up repeatedly in the planning data: teams budget for documentation and consultants, then underestimate the effort of making evidence retrievable on demand. A remote audit exposes that gap quickly. In a room, a friendly pause while someone hunts for a record is tolerable. On a video call it eats the audit clock and, now that reports must describe how effective the remote methods were, it leaves a mark.
Our view is simple. Treat evidence retrieval as a designed process, not a scramble. Decide in advance where each piece of proof lives, who can show it, and how long it takes. Then measure it in a rehearsal. We would also resist the idea that remote is a shortcut: it shifts effort from travel and logistics to preparation, and organizations with weak controls cannot hide them behind a screen.
Finally, budget honestly. Remote delivery may change how audit time is spent, but your certification body decides what it will accept, so confirm the approach before you build a plan around it.
— Martin
Check your readiness before the auditor does
The cheapest time to find a missing record is before the audit. If you are not sure where you stand, start with our free 2-minute check for a quick read on readiness, then go deeper with the ISO 27001 readiness assessment, which covers maturity across the four Annex A control themes. If you are still budgeting the certification project, the ISO 27001 cost calculator gives a real-time estimate based on company size, industry and security maturity, with no signup needed for the first calculation.
For a structured path from gaps to a certifiable ISMS, our gap analysis guide and 80-step certification checklist are good companions.
Common pitfalls in remote ISO 27001 audits
Assuming remote equals convenient. Auditors want live access to evidence. Sharing a folder and waiting is slow for everyone.
Scope drift. If you claim a remote-first scope, you must still show how controls apply to home offices, personal devices and cloud services. The audit report now has to note when an organization has few or no physical sites, so be clear about this in your scope.
Thin audit logs. Practitioners note that with the removal of the remote-percentage approval step, auditors expect clearer evidence of how remote methods worked. Keep a log of sessions, evidence shown and requests closed.
Overlooking project risks. Remote delivery adds its own risks to the certification project, from connectivity to key staff availability. Our overview of ISO 27001 project risks helps you plan for them.
Weak risk criteria. A vague risk matrix is hard to defend on a call. See our guides to risk criteria and the 5x5 risk matrix for defensible templates.
How to raise remote delivery with your certification body
Ask early, in writing, and ask specific questions:
- Which parts of Stage 1 and Stage 2 can be remote for our scope?
- Which tools do you use, and what do you need from us technically?
- Will you require a site visit for any physical controls?
- How will remote effectiveness be recorded in the report?
- How are recordings, screenshots and shared files handled and retained?
Their answers shape your plan, your internal schedule and, often, your costs. Get them before you fix dates.
FAQ
Can an ISO 27001 certification audit be done entirely remotely?
Sometimes, but it depends on your scope and your certification body. Guidance treats remote auditing as a way to improve efficiency, not a full replacement for site presence, and physical controls may still need a visit. Ask your certification body what it will accept for your specific scope.
Is there still a 30% limit on remote audit time?
The old practice of seeking accreditation body approval for remote audits above 30% of total time was removed with the transition to ISO/IEC 27006-1:2024. The audit report must now describe the extent and effectiveness of remote methods instead. Your certification body may still apply its own policies.
What does a remote audit mean in practice?
It means the auditor works from a location other than yours, using technology such as video calls, screen sharing and document exchange. ISO 19011:2026 allows this to happen in real time or asynchronously, though live access is usually needed for certification audits.
How should I prepare staff for a remote audit?
Give each interviewee a time slot, tell them the topics, and have them practice pulling their evidence on screen. Appoint one coordinator to keep a log of what was shown and what remains open. Run a short technical rehearsal a few days earlier.
Sources
- ISO 19011:2026, Guidelines for auditing management systems
- ISO/IEC TS 17012:2024, Guidelines for the use of remote auditing methods
- IAF Mandatory Document for the Use of ICT for Auditing/Assessment Purposes
- IAF MD 29: Transition Requirements for ISO/IEC 27006-1:2024
- IAF news: MD for transition to ISO/IEC 27006-1:2024
- ISO/IEC 27006-1:2024, Requirements for bodies providing audit and certification of ISMS
- NIST SP 800-53A Rev. 5, Assessing Security and Privacy Controls