What you save
| Case | Per visit | 4 visits in 3 years |
|---|---|---|
| Drive 150 km each way, 2 hours each way | €595 | €2,380 |
| Fly in, 4 hours each wayplus flight and hotel as incurred | €680+ | €2,720+ |
The 4 visits are Stage 1, Stage 2 and 2 surveillance audits. Audit fees do not change: for 50 people about 17 days in 3 years, remote or not.
What the rules say
- The use of remote audit tools needs the agreement of both sides, with information security and data protection in place.
- Remote time counts toward the total audit time. It can need extra planning, so it can add time.
- A virtual site, where people work online from anywhere, counts as 1 site for the time calculation.
- ISO/IEC 27006-1:2024 dropped the old limit that needed approval when remote work passed 30% of the audit. The body now sets the remote share from a risk review.
When the auditor may still come
- Physical security controls in scope: offices, server rooms, data centres you run.
- Weak connections or tools the body cannot use safely.
- A first audit where the body wants to see the site.
Ask before you sign which audits will be remote, and what travel costs if the body decides to visit.