Remote ISO/IEC 27001 audits: what the rules allow

The rules since 2026-01-30

A mandatory document of the accreditation community sets them for every accredited body.

Rules for remote audits

Rule	What it means
Remote audits need agreement	You and the certification body must agree on the use of remote audit technology before it is used. The agreement covers information security and data protection.
No agreement, no remote audit	When you do not agree, or the security measures are not met, the body must use other methods, for example an on-site audit.
The body checks the technology first	When remote audit is proposed, the body checks that both sides have the tools and the connection to support it.
A virtual site counts as 1 site	A company that works in an online environment can be a virtual site. For audit time, a virtual site counts as 1 site.
Remote is not shorter by rule	Remote audit time counts in the total audit time. It can need extra planning, so the duration does not drop because the audit is remote.
The report says what was remote	Audit reports state how far remote methods were used and how well they worked. If the scope includes virtual sites, the documents say so.

What to agree before the audit

1. The video tool, and who hosts the call.
2. Screen sharing instead of file transfers for sensitive evidence.
3. Recording: allowed or not, and who keeps it.
4. Read access to your compliance platform, if you use one, and when it ends.
5. A test call before stage 1.
6. What happens if the connection fails during the audit.

When a virtual site is not possible

A virtual site cannot cover work that needs a physical place: a warehouse, manufacturing, a lab or repairs. For SaaS, an office with physical controls in scope or an own data centre can need a visit. With cloud hosting, the auditor checks how you manage that supplier.