One worry sits behind most questions about remote audits: "Will my registrar think less of us if we ask for one?" The honest answer is that registrars (the certification bodies that issue your certificate) don't have a blanket preference. They have a set of rules about when remote auditing is allowed, and a set of habits about when they actually like it. Those two things are not always the same, and knowing the difference is where you save time and money.
This article walks through what remote and on-site audits each do well, where each one falls apart, what the governing documents say, and how to decide between them for a management system audit.
What Is the Difference Between a Remote Audit and an On-Site Audit?
An on-site audit puts the auditor physically in your facility. They walk the floor, watch people do the work, open the cabinets, and sit across the table from your process owners.
A remote audit uses information and communication technology (video calls, screen sharing, document portals, sometimes live camera walk-throughs) so the auditor evaluates the system without being present. The International Accreditation Forum covers this in IAF MD 4:2023 (Issue 3), the mandatory document on the use of information and communication technology for auditing and assessment purposes. It is mandatory for certification bodies accredited under ISO/IEC 17021-1:2015 that operate under IAF members' accreditation, which is why you see broadly similar remote audit language from one registrar to the next.
Many audits are neither purely one nor the other. A hybrid audit might run document review and interviews by video, then send the auditor on-site for two days of observation. Hybrid arrangements are common, though how often a given registrar offers them varies, so check its published policy.
What Do the Standards Actually Say About Remote Auditing?
This is the part people skip, and it matters because it sets the boundaries your registrar has to work inside.
- ISO 19011:2018 (guidelines for auditing management systems) treats remote auditing as a legitimate method. Its table of audit methods (Annex A, Table A.1) distinguishes between on-site and remote activities, and between activities with and without auditee interaction. It does not rank one above the other. It asks the audit team leader to choose methods that fit the audit objectives.
- ISO/IEC 17021-1:2015 governs certification bodies. It requires them to plan audits to meet the audit objectives, and it expects a stage 1 audit to achieve specific objectives, such as confirming your readiness for stage 2. How much of that can be done remotely is a judgment the certification body has to justify.
- IAF MD 4:2023 requires the certification body to assess the risks of using ICT, document that assessment, and make sure the technology is suitable. It also expects the audit plan and report to show how ICT was used. If information security or confidentiality can't be assured, ICT shouldn't be used, and that is a hard stop, not a preference.
- IAF MD 5:2019 sets the rules for audit duration for quality and environmental management systems. Audit time for other disciplines, such as occupational health and safety, is covered by ISO/IEC 17021-3 and other discipline-specific documents. Remote audit time is still audit time that has to be justified, and a certification body cannot quietly shorten an audit because it's being done by video.
One thing worth saying plainly: none of these documents say remote audits are second-class. They say remote audits have to be risk-assessed, planned, and recorded. That is a documentation burden on the registrar, which explains a lot of the registrar behavior described below.
What Are the Pros of Remote Audits?
Lower cost and less travel
The most obvious benefit is that the auditor isn't flying in. For a single-site company with a two-day surveillance audit, travel and lodging are usually billed on top of the audit fee. Remote work removes that line item, but not the audit days themselves: audit duration is set under the audit-time rules (IAF MD 5 for QMS and EMS), and ICT-based time still counts as audit time. Ask your registrar to quote remote and on-site days separately so you can see what actually changes. For multi-site organizations the savings compound, because the auditor can cover sites that would otherwise need separate trips.
Scheduling flexibility
Remote sessions are easier to split. Instead of two full days that shut down your quality manager's calendar, you can run four half-days and keep operations moving. This can help small teams where the person who owns the management system also wears three other hats.
Better document review
For clauses that are mostly paperwork, such as management review inputs under ISO 9001:2015 clause 9.3.2, internal audit programs under clause 9.2, or the information security risk assessment process and results under ISO 27001:2022 clauses 6.1.2 and 8.2, a screen share is often cleaner than flipping through binders. The auditor can pull up the record, ask the question, and take a screenshot as evidence on the spot.
Access to remote or hard-to-reach operations
Some sites are in places where an on-site visit is expensive or slow: offshore operations, distant satellite offices, a warehouse three time zones away. Remote methods let the auditor look at them without a full trip.
Less disruption in sensitive environments
In some settings, like cleanrooms or high-containment areas, every extra visitor is a contamination or safety consideration. A live video walk-through led by your own person can be the lower-risk option.
What Are the Cons of Remote Audits?
You lose what the auditor sees without being told
The best audit findings often come from something the auditor noticed on the way to somewhere else: an uncalibrated gauge on a bench, a handwritten workaround taped to a machine, a forklift driver who skips the pre-use check. A video call shows the auditor only what the camera points at. This is the biggest limitation, and no amount of good bandwidth fixes it.
Technology gets in the way
Dropped connections, poor camera quality, and security restrictions on screen sharing eat audit time. Because IAF MD 4 requires the certification body to make sure the technology is suitable, a failed test run can push the audit back on-site.
Interviews are harder to read
Operators who are comfortable on the floor often freeze in front of a laptop camera. Auditors lose the ability to read the room, and you lose the chance to show how well your people actually know their jobs. Strong operators sometimes come across as weaker on video than they really are.
Confidentiality and security concerns
Sharing records through a third-party platform raises real questions about customer data, trade secrets, and export-controlled information. If your work involves ITAR-controlled technical data, the constraint is that the regulations restrict access to that data by foreign persons and its transfer outside the U.S. A remote session can amount to an export if the auditor or the platform's servers are outside the U.S. or staffed by non-U.S. persons, so confirm who will see the data and where it is hosted before agreeing to a remote format. Get export-control advice on this early. Our team covers that area at ITAR compliance consulting.
Some clauses are hard to audit remotely at all
Anything involving physical controls is difficult: warehouse conditions, pest control, calibration status, housekeeping, hygiene practices, hazardous-material storage. This is why food safety and manufacturing audits lean on-site.
What Are the Pros of On-Site Audits?
On-site audits are the default for a reason. The auditor sees the real operation, not the curated version. They can follow a product or a record from receiving to shipping, talk to people at their stations, and check that what the procedure says matches what the work looks like.
On-site audits also build trust more quickly. A first visit from a new auditor can also change the tone of the relationship, because the auditor stops being a name on a screen. And for a first-time certification, there is real value in an auditor confirming with their own eyes that the system is implemented, not just documented.
What Are the Cons of On-Site Audits?
The costs are travel, time, and disruption. Your people spend days walking an auditor around, which pulls them off the line. For small companies, a three-day audit can feel like a week of lost capacity. Scheduling is also harder, because it needs the auditor and the right process owners in the same place on the same days.
There is also a subtler downside. When everything happens on a tour, auditors tend to follow the route you chose. A well-run on-site audit pushes past that. A rushed one doesn't, and records review can get squeezed into whatever time is left at the end of the day.
Remote vs On-Site Audits: Side-by-Side Comparison
| Factor | Remote audit | On-site audit |
|---|---|---|
| Travel cost | None or minimal | Auditor travel and lodging typically billed |
| Observing physical operations | Limited to what a camera shows | Direct observation |
| Document and record review | Strong, with good screen sharing | Good, though time for records can be squeezed if the day is spent on a tour |
| Scheduling | Easy to split into short sessions | Requires blocks of days |
| Interview quality | Variable, depends on comfort with technology | Usually more natural |
| Information security risk | Higher, needs a documented ICT risk assessment under IAF MD 4 | Generally lower exposure from third-party platforms, though auditors still access sensitive records on site |
| Best for | Document-heavy clauses, low-risk sites, follow-ups | Stage 2, physical-control-heavy processes, high-risk operations |
| Typical weakness | Misses what the camera doesn't show | Cost and disruption |
What Do Registrars Actually Prefer?
Here is where we move from the written rules to typical registrar practice. These are general patterns rather than requirements, and individual registrars publish their own policies, so check yours.
Registrars are comfortable with remote auditing for the right audits, and cautious about it for the wrong ones. They aren't against it, since it reduces their own travel cost and scheduling headaches. But they carry the accountability. If an accredited certification body signs off on a certificate after a weak remote audit and its accreditation body later challenges it, the registrar pays the price. So they tend to use remote methods where the risk is low and the evidence is mostly records.
In practice, that pattern looks like this:
- Initial certification (stage 2): IAF MD 4 does not prefer on-site for stage 2. It is risk-based and requires the certification body to show that ICT use achieves the audit objectives. In practice, many registrars still lean toward on-site here because the auditor needs to see implementation, but that is registrar habit, not a rule.
- Stage 1: More flexible. Because stage 1 is about readiness and document review, many registrars will do much of it remotely, especially for lower-risk organizations. Some still prefer a site visit if the scope is complex.
- Surveillance audits: The most common place for remote or hybrid. If your system is mature and your last audit was clean, expect more openness.
- Recertification: Often a hybrid. Records and management review remotely, site observation in person.
- Special audits, follow-ups for a major nonconformity: Registrars often want to see the corrective action in place, which pushes toward on-site.
Scheme owners can be stricter than the registrar
If your certificate sits under a scheme owner, the scheme's own rules sit on top of the registrar's. Food safety is the clearest example. GFSI-recognized schemes such as BRCGS, SQF, and FSSC 22000 each set their own conditions on when a remote component is allowed, and some audit types, such as unannounced audits, are expected to happen on-site. These rules have moved over time. GFSI issued temporary remote-audit allowances during COVID-19, and the schemes have since set their own conditions for ICT use in their current standards and rules documents. Check the current version of your scheme's requirements, and the GFSI Benchmarking Requirements it is recognized under, before you assume anything. If you're sorting out which scheme fits your business, our overview of GFSI certification and how to get certified is a good starting point.
Risk drives the decision
Registrar decisions are generally framed in terms of risk, consistent with IAF MD 4. Higher-risk sectors (food, medical devices, aerospace, anything with product safety consequences) get more on-site time. Office-based service organizations and software companies get more remote time. An ISO 27001 audit of a cloud-based software firm with no physical product is a very different case from an ISO 13485 audit of a device manufacturer with a cleanroom.
How Should You Decide Which Format to Ask For?
I'd go through these questions in order.
1. What does your scheme or registrar allow? Read the certification agreement and the scheme rules first. Everything else is a negotiation inside those limits.
2. How much of your system is physical? If most of your risk sits in what happens on a floor, in a kitchen, or in a lab, plan on-site. If most of it sits in records, people, and software, remote is a reasonable ask.
3. How mature is the system? A company three years into certification with clean surveillance results has earned the benefit of the doubt. A company preparing for its first stage 2 hasn't yet.
4. Can you protect the information? If sharing records over a video platform would put customer data or controlled technical data at risk, say so before the audit. A registrar would rather hear about it in planning than discover it during the call.
5. Is your team ready? Remote audits go badly when the host hasn't done a technology check, doesn't have records indexed, or hasn't told staff what to expect. It takes preparation, and it is not an easier version of the same audit.
How Do You Prepare for a Remote Audit?
If your registrar has agreed to a remote or hybrid format, a few practical steps change the outcome:
- Run a technology test a few days ahead. Confirm the platform, camera, microphone, and screen sharing all work, and confirm your IT security team will allow it.
- Index your records. Auditors lose patience when the quality manager is hunting through folders on a shared screen. Build a simple evidence index tied to the standard's clauses.
- Plan the live walk-through. If the auditor will ask to see the facility by camera, rehearse the route with someone who has a steady hand and a good connection.
- Brief your interviewees. Tell them the format and remind them they can say "let me show you" and then actually show the record.
- Agree on what happens if the connection fails. Settle the fallback beforehand, whether that's rescheduling, switching platforms, or moving that portion on-site.
Recording the audit is a separate question. Many registrars and auditees don't allow it, and the rules around it depend on the certification body and the confidentiality terms you've agreed to. Ask early.
Common Mistakes
The first is treating remote as a shortcut. Companies sometimes request it hoping for a lighter audit, and then find that the auditor, with fewer visual cues, asks for more records to compensate. The workload doesn't shrink, it moves.
The second is waiting until the audit week to raise the question. Ask when the audit is scheduled, not when it's about to start, so the registrar has time to adjust the plan.
The third is assuming last year's format will repeat. Hybrid arrangements tend to be decided audit by audit, based on the last results and any changes in your scope. A major nonconformity or a new process can flip you back to on-site.
If you're unsure how your registrar will treat your situation, an independent view helps. Our ISO consulting team can look at your scope, your sector, and your certification body's rules and tell you what to ask for.
So, Which Is Better?
The question is slightly off. A better one is: which parts of my system are best evidenced in person, and which are fine on a screen? Registrars weigh the same question, and a hybrid for mature systems with on-site time for new or high-risk ones is a common outcome.
The practical takeaway is that remote auditing is an accepted, rule-bound tool, not a loophole, and the companies that get the most from it are the ones that treat it as seriously as a visit. If your auditor can see the work, whether through a doorway or a camera, you're in good shape.
Last updated: 2026-10-23
Frequently Asked Questions
Are remote audits accepted for ISO certification?
Yes. ISO 19011:2018 recognizes remote auditing as a valid method, and IAF MD 4 sets the conditions certification bodies must meet when using information and communication technology, including a documented risk assessment. Whether a remote audit is allowed for your specific audit type depends on your registrar and any scheme rules.
Do registrars prefer on-site audits over remote audits?
Not across the board. Registrars generally prefer on-site for initial stage 2 audits and high-risk operations, and are more open to remote or hybrid formats for stage 1, surveillance, and document-heavy audits at mature, lower-risk organizations.
Is remote audit time shorter than on-site audit time?
No. Audit time is determined by factors such as the standard, scope, and complexity (for example under IAF MD 5 for quality, environmental, and OH&S systems). Doing the audit by video does not by itself justify cutting the time.
Can food safety audits like BRCGS, SQF, or FSSC 22000 be done remotely?
Only to the extent each scheme owner permits. Many food safety audit types, including unannounced audits, are expected on-site, and scheme rules on remote components have changed over time. Check the current scheme requirements and your certification body's policy before planning.
How early should I ask my registrar for a remote audit?
As soon as the audit is scheduled. The certification body needs time to assess ICT risks, confirm the technology and security arrangements, and adjust the audit plan.
Jared Clark
Principal Consultant, Certify Consulting
Jared Clark is the founder of Certify Consulting, helping organizations achieve and maintain compliance with international standards and regulatory requirements.