how-to
How to Prepare ISO Evidence for a Remote Audit
Last Updated: October 28, 2026
Quick Summary
A remote audit is an ISO audit run over video and secure file sharing, so the auditor must find evidence on screen. Prepare by mapping each clause to its evidence, separating documents from records, and building a clearly named, view-only evidence room. Then test the technology before the audit day.
- Map each clause to the evidence it needs, its owner and its storage location.
- Keep current documents and completed records in separate, clearly labelled folders.
- Use date-stamped file names so auditors can confirm evidence falls within the audit period.
- Give the auditor view-only access, limited to the audit period, using named accounts.
- Test video, screen sharing and file access about one week before the audit.
Table of Contents
- What a Remote Audit Means for Your Evidence
- Step 1: Map Each Clause to the Evidence It Needs
- Step 2: Separate Documented Information From Records
- Step 3: Build a Secure Remote Evidence Room
- Step 4: Run a Remote Audit Technology Check
- Step 5: Prepare Staff for Remote Interviews and Demonstrations
- Booking Your Next Audit Readiness Step With IntegriSURE
- Frequently Asked Questions
What a Remote Audit Means for Your Evidence
A remote audit is an ISO audit carried out over video conferencing and secure file sharing rather than on your site. The auditor still needs to see objective evidence that your management system is in place and working.
Preparing for this well takes planning. Auditors cannot walk past a filing cabinet or ask a supervisor to point at a whiteboard. Every record they need must be reachable, current and clearly linked to the requirement it supports.
The core test does not change, however. The auditor must be satisfied that the system is implemented and operating.
Remote audits are a method, not a lower standard.
Step 1: Map Each Clause to the Evidence It Needs
Start by reading each clause of the standard that applies to your organisation. For ISO 9001, that means the clauses in sections 4 to 10. Note which clauses ask you to retain documented information. These are clauses to consider when identifying records relevant to the audit.
Next, list the evidence each clause needs. Keep the list practical:
- Clause: the requirement you are checking
- Evidence: the record, log or output that shows the requirement is met
- Owner: the person who keeps that evidence current
- Location: where the evidence is stored and how it is named
A common mistake is treating the map as a one-off task. Review it when processes change, roles shift or a new site joins the scope.
Keep the map short enough that your team will use it. A table with one row per clause is usually enough. The aim is to answer one question quickly: "Where is the proof for this requirement?"
Step 2: Separate Documented Information From Records
Auditors look at two different things, and they should not be confused.
Documented information is the material your organisation maintains, such as policies, procedures, process descriptions and work instructions. Some of this is required by the standard.
Records are evidence that something happened or was done. Completed inspection forms, training attendance sheets, internal audit reports, management review minutes and corrective action logs are all records.
For remote audits, keep these in clearly separate folders. For a step-by-step approach to managing ISO documentation online, including how to separate documents from records for a remote audit, see the guide.
It is also worth checking that completed forms feed your registers. The clauses that require you to retain information are important to consider when preparing evidence.
Step 3: Build a Secure Remote Evidence Room
An evidence room is a controlled digital space where the auditor can access the records they need. It does not need expensive software. A well-structured cloud folder with clear permissions can do the job. Traceability helps make records findable by clause, owned by a named person, and dated so the auditor can see whether they are current.
A simple structure works well:
- 00 Index: a single page listing each clause, the evidence location and the owner
- 01 Policies and Procedures: current controlled documents with version numbers
- 02 Registers: risk, training, supplier, nonconformity and other registers
- 03 Records by Process: completed forms and logs, grouped by process and date
- 04 Audit and Review: internal audit reports, management review minutes and actions
Name files so the auditor can trust them
Consistent file naming does more for a remote audit than almost anything else. Use a pattern that carries the date, the process and the record type, for example 2026-09-14_Customer_Complaint_Log.xlsx or 2026-08_Internal_Audit_Report_Operations.pdf. Date-stamped names let the auditor confirm at a glance that the evidence falls inside the audit period.
Avoid names like final_v3_ACTUAL.xlsx. They tell the auditor nothing about what the file is or when it was produced, and they invite the question of which version is the real one.
Map every record to a requirement and a time period
An evidence tracker can help organise information for a remote audit. A practical tracker has one row per evidence item and these columns:
| Column | What it records |
|---|---|
| Clause | The requirement the evidence supports |
| Evidence item | The record, log or output |
| Owner | The person accountable for keeping it current |
| Location | Folder and file name in the evidence room |
| Period covered | The date range the record covers |
| Status | Current, superseded or missing |
| Reviewer | Who last checked it |
| Follow-up | Any gap and the action to close it |
Share the tracker with the auditor before the audit opens. It can help organise the evidence sessions.
Keep versions and freshness under control
Make sure the evidence is genuinely current. Remove superseded versions from the active folders, or move them to an archive folder that is clearly labelled with the date it was retired.
Get Your Free ISO Starter Pack →
Check that completed forms feed the registers they belong to. The clauses that require you to retain documented information are important to consider when preparing evidence, and each completed form should link back to a register that is populated and up to date. To see how to document QMS requirements clause by clause, start by mapping each clause to the evidence it needs.
Setting access levels and sharing rules
Secure sharing matters, because the evidence room may contain personnel records, customer details or commercially sensitive information.
- Give the auditor view-only access, not edit rights
- Share access only for the audit period, then remove it
- Use named accounts rather than a shared login
- Prefer expiring links over permanent ones where your platform supports them
- Store personal information in a restricted folder and redact what is not needed for the audit
- Keep a note of who received access and when
Check your sharing settings before the audit begins. Confirm that the auditor can open each folder and that they cannot see areas outside the audit scope. If a record contains sensitive information the auditor does not need, redact it rather than withholding the whole document.
Step 4: Run a Remote Audit Technology Check
Test the technology before the audit day. A dropped connection or a file that will not open can interrupt an audit.
Run a short check about one week beforehand:
- Confirm the video conferencing link works on the devices you will use
- Test screen sharing and check that the auditor can see the window you present
- Open the evidence room from a second device or account to confirm access
- Check that large files load quickly, and compress them if needed
- Confirm a backup contact method, such as a phone number, in case video fails
- Check camera, microphone and lighting in the room you will use
Plan for failure before it happens
Agree in advance what happens if the connection drops: who calls whom, and how the session will resume. Keep a copy of the key documents on a second device and a second network, such as a mobile hotspot, so you are not dependent on one connection.
Time zones matter for multi-site organisations. Schedule sessions so that the people who must attend are available, and allow a short break between sessions. A back-to-back schedule with no buffer is where most remote audit days fall apart.
Share your screen safely
Screen sharing is where confidential information is most often exposed by accident. Before the audit, close unrelated tabs, turn off desktop notifications and sign out of personal accounts on the device you will use. Share a single application window rather than the whole desktop where the platform allows it.
If a record contains information outside the audit scope, redact it or open a prepared copy rather than scrolling past it live. Auditors understand that organisations hold sensitive information; they do not expect to see it.
Run live demonstrations without exposing unrelated data
Auditors may ask staff to demonstrate a process rather than just describe it. Walk through the process once before the audit and ask the person to show the actual record they complete, not a sample prepared for the day.
A simple script helps:
- State the process and the clause it supports
- Show where the process is described in your documented information
- Open the live system and complete or retrieve a real record
- Show how the record feeds the relevant register
- Offer to answer questions before moving on
Keep the demonstration to the scope of the question. There is no need to show every screen in the system, and doing so increases the risk of exposing unrelated information.
Keep a backup channel ready
Have a phone number and an email address for the lead auditor, and make sure at least two people on your side hold them. If video fails entirely, agree with the auditor how to proceed. Being ready with a backup channel can help the audit continue.
Step 5: Prepare Staff for Remote Interviews and Demonstrations
Auditors do not only read documents. They interview staff and often ask people to demonstrate how they carry out a process. Remote audits make these moments harder, so prepare people in advance.
Hold a short briefing for everyone who may be interviewed. Explain:
- The purpose of the audit and the clauses being checked
- That honest answers are expected, including "I don't know, let me check"
- How to find and share a record during a call
- Who to contact if they are unsure about a question
For demonstrations, walk through the process once before the audit. Ask the person to show the actual record they complete, not a sample they prepared for the day. Ensure the demonstration and the records match.
Internal audits can help assess whether staff can explain their processes and locate evidence. Read how internal audits keep your ISO management system on track and let staff rehearse before the auditor arrives.
Booking Your Next Audit Readiness Step With IntegriSURE
IntegriSURE provides editable management system documents, implementation tools and step-by-step guidance mapped clause by clause to help organisations build and operate their management systems independently.
Packages vary in what they include and how much support they offer, so check the current options on the IntegriSURE website before choosing. You can start with the free ISO Starter Pack at https://integrisure.com.au/iso-starter-pack to see how the structure works for your organisation.
Frequently Asked Questions
What evidence should I prepare for a remote ISO 9001 audit?
Start with the clauses that require you to retain information when identifying relevant evidence. Typical evidence includes completed forms, meeting minutes, training records, nonconformity and corrective action records, internal audit results and management review outputs. Match each item to the clause it supports, confirm it is current and dated, and store it where the auditor can retrieve it without assistance. An auditor may ask to see how records are used, not only that they exist, so have a recent example of each record ready to walk through.
How do you organise documents for a remote ISO audit?
Organise evidence in a folder structure that follows the clauses of the standard, for example one top-level folder per clause or process. Name files consistently with a clause reference, document title, version and date. Keep a simple index that lists each piece of evidence against its clause so the auditor can navigate quickly. Remove superseded versions from the active folders and archive them separately, so the auditor sees only the current controlled documents.
How should I share evidence securely with an ISO auditor?
Use a controlled, access-restricted location rather than sending files by email. Grant the auditor view-only access for the audit period, and remove that access once the audit closes. Avoid sharing personal information or commercially sensitive data unless the auditor needs it for the audit, and redact where possible. Record who was given access and when, so the sharing process itself is traceable.
