Remote vs on-site ISO audits: what mid-market buyers should ask for

This page is a buying guide. It is for operations, quality, IT, and compliance leads at mid-market manufacturers and professional-services firms who need accredited certification to ISO 9001, ISO/IEC 27001, ISO 14001, ISO 45001, and/or ISO/IEC 42001 — and who are arguing about how much of the audit can happen on a video link.

That argument is a procurement fact, not a software preference. Remote, hybrid, and on-site are methods a certification body (CB) uses to sample your system. They change travel. They sometimes change which body can even accept the job. They do not, by themselves, change the standard. If one CB prices a Zoom Stage 2 and another prices a week on the floor, you do not have a bake-off. You have two programmes.

It does not republish Stage 1 versus Stage 2, how to write the outbound RFQ, multi-site certification scope, or surveillance and recertification. Those chapters still apply. This page is only the split: when remote is usually fine, when on-site is expected, which hybrid patterns actually compare, what belongs on the pack, and why “fully remote forever” is an evidence problem.

It does not invent prices, day-rate totals, travel lump sums, or accreditation identifiers.

1. The split is a designed programme, not a Zoom preference

A quote is a designed audit programme. The design includes where the auditor sits. Screen-share, a plant walk, a hybrid week with documents on Tuesday and the coating line on Wednesday — those are different samples of the same scope. Treat them that way on the RFQ.

What remote is not:

• A smaller standard. ISO 9001, 14001, 45001, 27001, and 42001 do not shrink because the auditor is at home.
• An automatic reduction in audit days. Information and communication technology (ICT) for auditing is a method. IAF MD 4 is the usual reference CBs use. It is not a coupon. Days still have to cover the programme. Travel is a separate line.
• A way to hide a site, a shift, or a warehouse. Multi-site still has to name the buildings. Remote is how a visit happens, not permission to leave Dallas off the page.
• A 2020 emergency that you can freeze into the three-year cycle. Temporary remote under a crisis is not the same as a designed hybrid programme your accreditation body will still recognise in year three.

The CB is not free to invent the method either. Accredited procedures have to say when ICT is allowed, how information is protected on the link, and what happens if the connection dies mid-sample. Auditor competence includes the tools, not only the standard. Your preference does not override those procedures. You can write “no remote Stage 2 at plants.” You cannot write “Stage 2 must be fully remote” and expect every competent body to say yes.

What that looks like in ordinary mid-market rooms: procurement wants remote because travel looks messy; operations wants on-site because the second shift has never seen the quality manager’s camera; a salesperson offers “fully remote, very efficient” before anyone has named the press line; two CBs receive the same site list and invent two methods. The numbers move. The scope did not.

Write the constraint. Ask every body to restate the split. Unlike methods are unlike quotes. How to read the line items after replies arrive lives in what CB quotes include. This page is what to demand before anyone is allowed to count travel as TBD.

2. When remote is usually fine

Remote works when the evidence is already in a system of record, the people who own it can share it live, and the sample does not depend on standing next to a machine. Typical mid-market yeses:

Stage 1 documented-information review. Stage 1 is a design review of readiness: is the scope sane, do the procedures exist where the standard expects them, have internal audit and management review touched this system. A central-function records review often travels well over a controlled link. Factories with complex processes still benefit from an on-site Stage 1. That remains a scoping conversation, not a moral failing. It is not “Stage 1 does not matter if it is remote.”

Office-based interviews. Management-system owners, IT control owners, a professional-services delivery lead who works from a laptop. The auditor still has to choose whom to talk to. You still should not hide the people who know where the system is weak.

ISMS evidence in tools you actually use. Access reviews, incident tickets, backup-test records, supplier due diligence in a register someone maintains. The auditor should drive some of the clicking. A ZIP of screenshots emailed on Monday is not a remote audit. It is a staged binder with better resolution.

Part of surveillance. After the certificate exists, a competent programme still samples whether the system lives. Digital control clusters can often be sampled remotely in a year that also puts feet on a plant. Surveillance is designed sampling, not a courtesy coffee. Remote does not make findings informal.

Opening and closing meetings as part of a hybrid visit — when the people who need to hear the findings can actually attend. A remote close that only the quality manager joins, while process owners are on the line, is theatre.

Activity	Remote is often workable when…	Remote is a weak sample when…
Stage 1 records	Central function, documents in a real system, internal audit exists	The plant is the system and nobody has walked it
Leadership / MS owner interviews	They can show decisions, not slides	The only voice is a consultant on the call
27001 / 42001 system evidence	Live tools, auditor-directed sampling	Pre-baked screenshot packs; SoA nobody uses
Surveillance of office controls	The cycle also includes on-site process time	It replaces the only floor visit of the year
Multi-site HQ document review	Plants are still named and still sampled	HQ remote is used to skip the awkward site

Say yes on the pack where this is true. Do not say yes to the whole programme because Stage 1 can be a video call.

3. When on-site is expected

On-site is expected when the certificate will claim physical work, physical conditions, or people who will not be honest on a camera the quality manager is holding.

Stage 2 at a plant. Stage 2 tests whether the system works. In a factory that means the floor, receiving, calibration, nonconforming product, the warehouse dock, the second shift if you claimed one. A handheld tour that follows the yellow line the quality manager painted last week is not that sample. Competent CBs will say so. Bodies that agree to a fully remote Stage 2 on a coating line are advertising a different product.

ISO 45001 worker interviews. Participation, consultation, actual conditions, lock-out points, the job the procedure describes versus the job people do when the auditor is not in the break room. Worker evidence is hard to fake well on a video link and easy to fake badly. If 45001 is on the certificate, budget floor time. The IMS buying chapter is when that stack belongs on the RFQ. This page is only: do not convert the OHSMS sample to a conference camera.

Process sampling you can smell. Solvents, heat-treat, food-contact, a press that has a real setup sheet, a calibration sticker that is or is not on the gauge. ICT does not transmit that. If the work is the product, the auditor has to stand in the work.

Physical security in an ISMS. Annex A is not all tickets. Secure areas, media, a plant that is in the information-security scope, a server room IT will not badge. “We are a cloud company” does not delete a cage you still own. Name the places. Let the CB say which of them need eyes.

Recertification. A fuller look at continued conformity, closer to Stage 2 staffing than to a light surveillance. Do not treat the last visit of the cycle as the one you finally make fully remote to “save travel.”

The site you hoped nobody would visit. The oldest calibration, the warehouse with no internal audit, the overflow building that started certified work in March. Remote is not how those locations disappear. Sampling design still has to reach them on some cadence.

Situation	Usually on-site	Why
Stage 2, manufacturing / warehouse / lab	Yes	The certificate claims that output
45001 worker / workplace sample	Yes	Conditions and participation are the evidence
Second shift you declared — or did not	Yes, if the work runs then	An auditor who only met first shift has not sampled second
27001 secure area, plant-in-ISMS, media	Often yes	Physical controls are not a screen-share
42001 model that runs on a line	Often yes	Approval records can be remote; the production object may not
Recertification at a plant	Mostly yes	Fuller look, not a leftover Zoom from surveillance
Professional-services delivery with no floor	Mixed	Evidence is digital; some on-site or live-system time still belongs

If you need the visit to be on-site, say so. Hoping every CB guesses “we would never allow a remote Stage 2 here” is how you collect a cheap remote proposal and a complete on-site proposal and then argue about price.

4. Hybrid patterns that actually compare

Hybrid is the usual honest mid-market design. It is not a vibe. It is a named split: which activities, which sites, which stages.

Patterns that quoting managers can line up:

Stage 1 remote, Stage 2 on-site. Common when the central function’s records are real and the work is a plant. Stage 1 still has to be ready. Remote Stage 1 is not a courtesy before a Stage 2 date next week.

Document review remote, process days on-site, same stage. A Stage 2 week that spends the first block in the ISMS or the quality system of record, then walks the line. Write it as two methods inside one stage, not as “hybrid” with no hours.

Surveillance rotation. This year the plant is on-site and a control cluster is remote. Next year a different process family, still some floor time in the cycle. “Lighter” is a day-count word. It is not permission to replace the only on-site sample with an opening meeting.

Multi-site: HQ remote, sampled plants on-site. The central function’s documented information can often be reviewed without flying someone in for the binder. The coating plant, the warehouse, and the 45001 interviews usually cannot. Name the constraint per site type on the pack. Do not let remote HQ become “we sampled the network.”

ISMS / AIMS heavy, plant light — on purpose. Professional-services firms, or a factory that split the operations stack and the trust stack across two CBs, often have more remote days on 27001 or 42001 and more on-site days on 9001/14001/45001. That is a design. It is only comparable if the pack said so.

What hybrid is not: converting the floor walk to a phone video in the week of the visit; a remote opening meeting that “counts as the plant”; three years of remote visits sold as hybrid because someone once saw the lobby; a different hybrid story per logo. One pack. One split. Every body.

Ask each CB to return days by stage and year, the on-site versus remote split, and the travel policy if more than one site. If two replies used different methods on the same pack, stop scoring and send the pack back.

5. Manufacturing floor versus professional-services ISMS

The same standard does not imply the same method. The work does.

Manufacturers usually need on-site Stage 2. Product realization is physical. Environmental aspects and occupational hazards live in the building. A warehouse that ships certified product is a site, not a PDF. Remote can still take Stage 1 records, some management interviews, and part of later surveillance. It should not take the implementation audit of the line. If you run 9001 + 14001 + 45001 as one operations stack, the on-site expectation stacks with it — worker interviews and process samples do not become remote because the certificates share a cover sheet.

Professional-services firms often reverse the picture. The ISMS lives in identity providers, ticket systems, laptops, a cloud estate, and a headquarters that may be a floor rather than a campus. Access reviews and incident records walk well remotely when the auditor can drive the sample. Physical security, visitor control, media, and any plant or lab that still sits in the ISMS do not automatically vanish. “Everyone is remote” is a scoping fact you put on the pack: where the work is governed, how you meet, how you control devices. It is not a certificate that the CB never has to see a person in a room.

ISO/IEC 27001 versus ISO/IEC 42001. A Statement of Applicability and a risk-treatment plan can be sampled over a link. An AI management system that approves a copilot from a policy pack can often be sampled the same way. A vision model on a production line is closer to the manufacturing sample. Do not infer 42001 method from 27001 method. Do not infer either from 9001 method.

Dual-CB programmes (factory-dense registrar for the operations stack, security-competent body for ISMS/AIMS) will produce two splits. Write both on the pack. Do not let 27001 remote days become an argument that the heat-treat line can be audited from a sofa.

Do not paste plant language onto an ISMS buy, or ISMS language onto a two-shift machine shop. HQ records, a coating plant, and a development office are three methods. The site table already has a remote versus on-site row. Fill it per location. This page will not invent a ratio of remote days to on-site days. Match the method to the work, write it once, and make every CB price that sample.

6. What to put on the RFQ

The outbound artifact is still one pack, same facts to every body. The copyable checklist lives in how to build a registrar RFQ / scope pack. This page does not rewrite that chapter. It only fills the remote versus on-site row so travel and days stay comparable.

Write constraints by stage and by site type, not a global mood:

• Stage 1 remote at the central function is acceptable / not acceptable.
• No remote Stage 2 at plants / warehouses / labs.
• Stage 2 hybrid allowed only if process sampling stays on-site.
• Surveillance: what must remain on-site in the cycle (named process families, 45001 worker sample, physical security).
• Recertification: closer to Stage 2 method, not “whatever we did in year two.”
• IT access for evidence walkthroughs: live system, auditor-directed, not a pre-sent screenshot pack.
• Visitor, union, classified-work, or camera rules that make a plant tour impossible — say so, because that is a method constraint, not a surprise at the gate.

Also say, in one line each:

• Languages of the work, not of the sales office. Remote interviews in the wrong language are still the wrong sample.
• Shifts. Remote does not create a second-shift interview that nobody scheduled.
• Who will be on the link. Process owners, not only the consultant. The implementer versus certifier split still holds: the CB should not be walking a system the implementer is performing for the camera.

Ask every body to return:

• The on-site versus remote split, by stage and year.
• Travel and expenses policy if more than one site — not “TBD” if you have plants in three states.
• What happens if ICT fails mid-audit.
• Confirmation the method fits their accredited procedures, not a salesperson’s preference.

Leave these off:

• A day-count target because “remote should be cheaper.” Ask for the calculation and the method. You can reject unexplained short later. You cannot un-omit a floor sample after Stage 2.
• “Fully remote required” as a loyalty test. Competent CBs will no-bid a plant programme they cannot sample. That is a successful RFQ.
• A different split per logo. Unlike methods are unlike day counts.

If more than one location does certified work, fill the remote versus on-site cell on the site table. If you already hold a certificate and the question is the remaining visits, put the current method on the pack so a transfer quote is not a Stage 2 price in disguise.

7. Independence and evidence risks of “fully remote forever”

Independence usually means the CB did not write the system. Consultant versus certification body is that split. Remote versus on-site is a different risk that lands in the same meeting: whether the sample is of the work, or of a performance of the work.

A certificate is useful because someone who did not design the process sampled it where it runs. Three years of ICT-only visits can quietly become a certificate of documents.

Treat these as stops, or as programme changes you make in writing — not as items to “see how it goes.”

The camera is held by the auditee. The quality manager walks a rehearsed path. The awkward cell is out of frame. Worker interviews happen with a supervisor in the shot. That is not ICT competence. That is a guided tour. On-site, the auditor still chooses the next door.

Staged evidence. Screenshot packs, a sandbox tenant, a “demo” incident record, an SoA that lists a cloud estate the site list never named. Remote makes staging easier because the auditor cannot glance at the next screen. Demand live systems and auditor-directed sampling. If the CB is happy with a ZIP file, the CB is not sampling.

Physical work that never gets feet. A plant Stage 2 that never leaves the laptop. A 45001 certificate with no workplace sample. A warehouse on the scope that has only ever joined the opening meeting. Customers who walk your dock will notice before your reception sign does.

ICT as a substitute for competence. Remote auditing needs auditors who can use the tools and still follow a process. A technically fluent person who has never stood at a wastewater skid is still the wrong IMS lead. Method does not fix sector competence. How to choose still starts with live accredited scope and the work they can actually sample.

Information security of the audit itself. Screen-share of an ISMS can expose personal data, incident detail, or credentials in a browser password prompt. Competent CBs have rules for that. Ask. A body that wants your production admin password in chat is a weak proposal.

“Fully remote” as the sales differentiator. Efficiency is real when the evidence is digital and the procedures allow it. It is a red flag when it is how a body wins a plant bake-off on travel. Shortest travel is not the same as a competent sample. Under-sampling is how certificates get challenged later.

None of this requires you to become an MD 4 specialist. It requires you to notice when three years of convenience have replaced the audit of the work the wall certificate names.

8. How to read the split when quotes come back

After replies arrive, line the methods up before you line the numbers up. The anatomy page is what a CB quote should include. On this page, only the method columns: on-site versus remote days by stage and year; which sites are on-site in the cycle; travel policy (not “TBD” with plants in three states); what happens if ICT fails; hybrid detail inside a stage, not the word “hybrid” alone.

Score scheduling honesty the way the shortlist already tells you to. A body that cannot live with “no remote Stage 2 at plants” should no-bid. A body that “fits you in” on Zoom without reading the constraint is a weak proposal. Do not convert day counts into a fake savings score for remote. Remote can remove airfare and still be the right Stage 1 design. Remote that deletes the floor sample is a different certificate.

Verify the legal entity and live accredited scope before you treat a glossy remote offering as awardable (accreditation lookup). This site’s directory tags are editorial, not a live feed.

9. Decision checklist, then send the pack

Work top to bottom. If you cannot tick a row, that row is the programme — not a footnote for after kickoff.

1. Name the work. Plant and warehouse processes, 45001 workplace, physical security, and production AI objects usually need on-site Stage 2 (and on-site time in the cycle). Central-function records, office interviews, and live ISMS/AIMS tools often allow remote. Match method to work.
2. Write the split by stage and site type. Stage 1, Stage 2, surveillance, recertification. Plants versus HQ versus development office. One pack, every CB.
3. Hybrid means named activities, not a slogan. Document review remote plus process days on-site is a pattern. A remote opening meeting is not a plant sample.
4. Do not freeze 2020 emergency remote into years two and three. Surveillance still samples live work. “Fully remote forever” is an evidence risk.
5. Ask them to return the split plus travel policy and what happens if ICT fails. Restated assumptions, not a vibe in the cover letter.
6. Leave day-count targets off the pack. Remote is not a coupon. Compare designed programmes. Anatomy: what quotes include.
7. Keep independence and evidence separate from convenience. The implementer should not perform the system for the camera. The CB should not certify a binder they never sampled in the work.
8. Staff the method you bought. Remote still needs process owners on the link. On-site still needs the shift you claimed. Hiding weak voices wastes the visit either way.
9. Score methods before logos. A famous brand that under-samples the floor is a weak proposal. A smaller body that will walk the second shift is information, not a defect. Shortlist is the scorecard.
10. One pack, then quotes. Submit the registrar pack — with the remote versus on-site row filled — with the Get quotes button below. Then open the directory and keep the shortlist to names you can actually award.

If the split is written and the pack is honest, send that pack. Do not send a Zoom-only version to the body that already likes remote. Do not collect travel-TBD numbers before the plant constraint is on the page. Do not treat a video tour as Stage 2 of a line.

This page is the method, not a substitute for competence and independence. When you are ready, the next action is the same as the other buying chapters: one registrar scope pack, several CBs.