Information reviewed: 14 November 2026. Global guidance on technology-supported management system assessment.
A remote ISO audit can be effective when the methods allow the necessary evidence to be obtained and evaluated. It can be unsuitable when a convenient video call leaves important activities unobserved or prevents reliable interviews. The decision should follow the assessment objectives and operating circumstances, not the attraction of avoiding travel.
Hybrid assessment combines remote and on-site methods within an appropriate programme. This guide helps organisations prepare an informed discussion with their certification body. It does not promise that any business, standard or scheme can be certified entirely online.
Start with the applicable rules and objectives
The established IAF MD 4:2025 document addresses ICT in conformity assessment. It covers agreement on technology and security, risks to effectiveness, infrastructure, competence, planning and records of use. Other scheme or legal requirements can impose additional limits. The Global ACI catalogue identifies the corresponding current document as Global ACI-TECH-3-003; confirm the applicable version with the provider.
For the buyer, the central question is what the auditor needs to establish and which method can establish it reliably. Remote is a delivery method, not a separate level of certification. A webcam, uploaded documents and a shortened schedule do not automatically provide an equivalent assessment of every activity.
Distinguish location from method
A virtual operation and a remote audit are different concepts. People can work through an online environment, while a physical process can be viewed remotely through a camera. The assessment still needs to understand the activity’s actual setting and limitations.
Explain which functions are digital, which occur physically and where the people responsible are located. A remote document-control discussion may be straightforward while observation of a maintenance task raises access, visibility or safety questions. Treat those activities separately rather than applying one method to an entire organisation by default.
Also distinguish preparatory information exchange from formal assessment activity. Sending records in advance does not settle the method or coverage of the audit. Ask the provider to explain what will be reviewed remotely, what happens during live sessions and what may still require physical access.
Break the scope into activities
Create a list of the significant activities and the evidence needed for each. Identify interviews, live observation, records, physical conditions and interactions between processes. This helps the body plan methods instead of beginning with a percentage target for remote time.
Consider how evidence will be checked. A dashboard may show a result without showing the process that generated it. A camera may show an area while missing labels, background activity or the ability to follow an unexpected issue. A reliable plan anticipates these limitations and provides a way to investigate further.
|
Activity in a fictional organisation |
Possible remote approach |
Question to resolve |
|
Contract review |
Screen sharing and interviews |
Can original records and decision history be examined? |
|
Warehouse handling |
Guided live observation |
Is visibility sufficient for the relevant work? |
|
Specialist production |
Selected records plus appropriate observation |
What cannot be established remotely? |
|
Distributed service team |
Individual interviews and work examples |
Can employees speak and demonstrate work reliably? |
|
Sensitive customer work |
Controlled access to relevant evidence |
What permissions and protections are necessary? |
The table identifies discussion points, not decisions approving a particular activity for remote certification.
Examine the limitations of camera evidence
A camera shows a selected view. The person holding it may unintentionally direct attention away from relevant conditions or struggle to capture detail while working safely. Network quality can reduce resolution at exactly the point where a label or action matters.
Discuss who controls the route, how the assessor requests another view and what happens if the necessary detail cannot be established. Avoid staging a short tour that looks polished but prevents ordinary work from being examined. The organisation should support access to evidence, not act as the editor of a promotional video.
Safety remains important. Do not ask an employee to film while performing a task that requires full attention or entering a restricted area without suitable arrangements. If safe observation cannot be achieved through the proposed method, discuss a different approach with the body.
Make interviews workable
Plan access to employees who understand the relevant activities. Confirm language needs, shift availability and a setting where people can hear and respond without unnecessary interference. A manager answering every question on behalf of the team can conceal gaps in understanding.
Consider how a remote interview connects to evidence. An employee may need to show a record or explain a recent decision. Arrange access without giving the assessor unrestricted control of unrelated systems. Clear preparation helps the interview explore work rather than spend most of its time resolving passwords and permissions.
Where interpreters or support staff are involved, clarify their role. They should facilitate communication rather than change the answer. If the method prevents the assessor from obtaining reliable information, acknowledge the limitation and agree the appropriate next step.
Protect confidential information deliberately
Identify sensitive material before the assessment. Customer contracts, personnel information, technical designs and security details may need controlled access. Decide what can be shared, with whom and through which approved channel.
Discuss screen sharing, file transfer, access duration and recording in advance. Do not assume that recording is necessary or automatically permitted. A meeting invitation should not silently authorise capture of everything displayed. Establish how the body handles relevant information and how your organisation manages its own permissions.
Redaction can protect unrelated information, but it should not remove the evidence needed to evaluate the activity. If a restriction prevents an objective from being met, explain it early. The solution may involve controlled access, a different sample or an alternative method rather than pretending the missing evidence has been reviewed.
Test technology against the actual work
A successful introductory call does not establish that a connection will work in a plant, warehouse or remote project location. Test the devices and access conditions relevant to the planned sessions. Include audio, screen sharing and any live observation equipment.
Assign a coordinator who can resolve practical issues while process owners participate in the audit. Keep a backup contact route and identify which activities can continue if one connection fails. Technology support should help the assessment proceed, not become a substitute for technical participation.
Use equipment appropriate to the setting. A laptop may be suitable for records but impractical for a guided site view. Discuss restrictions on devices, photography or wireless access before scheduling. These details can materially affect whether the proposed method works.
Design a useful hybrid programme
A hybrid approach can allocate different methods to different objectives. For example, a fictional group might discuss central management records remotely while arranging physical observation of relevant operations. The exact balance needs the responsible body’s review.
Think about the sequence. Information gathered remotely may help focus a later visit, while a site observation may create questions requiring further records. The programme should allow those connections instead of treating each session as an isolated event.
Do not assume that hybrid means incomplete. Its credibility depends on coverage, evidence and judgement. Equally, do not assume that combining two methods automatically resolves all limitations. Each unresolved issue still needs an appropriate response.
Plan for failed connections and unavailable evidence
Agree what happens if access fails, a key person is unavailable or live observation cannot be completed. Identify when a session can be rescheduled and when another method may be necessary. The plan should not force the assessor to accept inadequate evidence because the calendar is full.
Clarify commercial implications before appointment. Additional time, travel or a follow-up visit may affect cost. Request the charging basis and approval process without asking the body to promise that no further assessment will ever be needed.
Keep a factual record of material interruptions. A dropped connection may be a minor inconvenience or a barrier to achieving an objective. The response should reflect the actual effect, not simply whether the meeting software eventually reconnects.
Use a fictional suitability decision
Imagine an invented repair business with electronic job records, a central scheduling team and workshops handling specialist equipment. It asks whether its next audit can be entirely remote to reduce travel disruption.
The discussion identifies records that can be reviewed through controlled screen sharing and interviews that can be conducted effectively online. It also identifies workshop activities for which camera access and visibility are uncertain. The business tests the method, discloses the limitations and asks the body to determine a suitable programme.
The useful outcome is a reasoned plan, which may be remote, hybrid or require more on-site work than initially expected. The example does not establish a universal rule for repair businesses. It demonstrates how a request based on convenience can become a decision based on evidence.
Compare providers without rewarding shortcuts
Ask each provider to explain methods against the same operational profile. If one offers a fully remote programme and another proposes physical visits, investigate the reasoning. The shorter or cheaper option is not automatically improper, but the difference needs an explanation.
Look for understanding of limitations, suitable technical resources and a practical contingency process. A guaranteed online pass before review is a warning sign to clarify. Appropriate remote assessment still requires evidence and an independent certification decision.
Public reviews may describe ease of scheduling, but convenience alone cannot establish assessment adequacy. Consider the proposed scope, applicable rules and evidence route. Global ISO Register’s methodology explains how its research considers capability; an individual buyer still needs a suitable plan.
Keep the result and public claims clear
After assessment, review the outcome through the body’s normal process and address any findings. Do not describe remote delivery as a different certificate entitlement or imply that physical operations were assessed in a way that did not occur.
Retain the agreed arrangements and material changes with your certification records. For authenticity and status checks, use the separate verification guide. A video meeting record alone does not establish certificate validity.
Sources and article note
The ICT reference and current Global ACI catalogue above provide the framework context. The table, scenarios and preparation questions are original editorial guidance. Confirm current standard, scheme, accreditation and information-protection conditions with the responsible body.
Use the directory for provider research and the contact page for corrections. Certification bodies may submit organisation details for review; listing does not approve a particular remote assessment method.
