Sometimes. Whether an audit can use remote methods is decided by your certification body, not by you, under the IAF mandatory document on information and communication technology (MD 4). Remote work suits organizations that work in a virtual environment. Controls tied to physical places may still call for a visit.
What the rule says
One certification body's summary of IAF MD 4:2023 says the use of ICT can be one option in an audit, but not in every case. The assessment of whether an audit can be carried out using ICT is performed by the certification body. It looks at security and confidentiality of the technology used and whether use can be agreed mutually. It also looks at risks and opportunities that could affect audit effectiveness. The same summary notes that a design and development organization where everyone works remotely in a cloud environment is an example of a virtual site. Processes that need a physical environment cannot be audited fully by ICT.
IAF issues new editions of its documents. Ask your certification body which edition it applies now.
What usually works remotely and what may not
| Activity | Remote friendly? |
|---|---|
| Reading policies and the Statement of Applicability | Usually yes |
| Screen shares of cloud consoles and ticket systems | Usually yes |
| Interviews with staff | Usually yes |
| Office access, clean desk, visitor handling | Depends on the body and scope |
| Data centre or hardware rooms you own | Often needs a visit |
This table is a planning aid, not a rule. The certification body makes the call for each audit.
What changes in preparation
Remote audits need more planning. The summary notes that ICT use can affect total audit time because extra planning may be needed. So plan for these:
- Agree the tools, such as video platform and screen sharing, and check security and confidentiality needs beforehand.
- Prepare a shared folder of evidence, with a clear structure and read-only access for the auditor.
- Book interviews in advance, with backups for people on leave.
- Test your connection and screen sharing the day before.
- Decide what you will and will not show on screen. Customer data and secrets should not appear in shared views.
Scope and remote work
If your company is fully remote, say so in the scope and show how you manage endpoints, access and home working. That is evidence for the ISMS, not just a logistics issue. For cloud heavy teams, evidence from source hosts and CI is often easy to show on screen.
Questions to ask your certification body
- Which parts of Stage 1 and Stage 2 can be remote for our scope?
- What do you need for security of the remote session?
- Does remote work change audit duration?
- Which documents do you want in advance?
Quick check
Is a remote audit worth less than an on-site one?
The certificate is issued by the certification body under the same rules. Whether they use remote methods depends on their assessment. Ask them for their policy.
Can we insist on a remote audit?
You can ask. The decision belongs to the certification body, which has to agree the use of ICT with you.
Safeguard's compliance and evidence automation can organise evidence you share with an auditor. The audit method is agreed between you and your certification body.
Sources
Last reviewed: 19 October 2026.
