The 7 Principles of Auditing (ISO 19011:2018)
Understanding the core principles that make auditing an effective and reliable tool for management.
Introduction
ISO 19011:2018 provides guidelines for auditing management systems. At its heart are seven principles. Adhering to these principles is a prerequisite for providing audit conclusions that are relevant and sufficient.
1. Integrity: The Foundation of Professionalism
Auditors and the people managing an audit program should:
- Perform their work with honesty, diligence, and responsibility.
- Observe and comply with any applicable legal requirements.
- Demonstrate their competence while performing their work.
- Perform their work in an impartial manner.
- Be sensitive to any influences that may be exerted on their judgment.
2. Fair Presentation: The Obligation to Report Truthfully and Accurately
Audit findings, audit conclusions, and audit reports should reflect the audit activities truthfully and accurately. Significant obstacles encountered during the audit and unresolved diverging opinions between the audit team and the auditee should be reported.
3. Due Professional Care: The Application of Diligence and Judgment
Auditors should exercise care in accordance with the importance of the task they perform and the confidence placed in them by the audit client and other interested parties. An important factor is having the ability to make reasoned judgments in all audit situations.
4. Confidentiality: Security of Information
Auditors should exercise discretion in the use and protection of information acquired in the course of their duties. Audit information should not be used inappropriately for personal gain by the auditor or the audit client, or in a manner detrimental to the legitimate interests of the auditee.
5. Independence: The Basis for Impartiality
Auditors should be independent of the activity being audited wherever practicable, and should in all cases act in a manner that is free from bias and conflict of interest. For internal audits, auditors should be independent from the operating managers of the function being audited.
6. Evidence-Based Approach: The Rational Method
Audit evidence should be verifiable. It will in general be based on samples of the information available, since an audit is conducted during a finite period of time and with finite resources. An appropriate use of sampling should be applied, since this is closely related to the confidence that can be placed in the audit conclusions.
7. Risk-Based Approach: An Audit Approach that Considers Risks and Opportunities
The risk-based approach should substantially influence the planning, conducting, and reporting of audits in order to ensure that audits are focused on matters that are significant for the audit client and for achieving the audit program objectives.