The Seven Principles of Auditing

The International Organization for Standardization (ISO) publishes ISO 19011, the guidance for auditing management systems. It is a guidance standard: organisations are not certified to it. Its value is that it sets out how a good audit is run, and it starts with principles. The principles explain why audit methods exist, which helps an auditor choose well when a situation is not covered by a procedure.

Why principles matter

An audit produces conclusions that managers act on. If the audit is biased, careless or built on weak evidence, those actions will be wrong. The principles protect the reliability of the conclusions. When an auditor is unsure what to do, asking "which principle applies here?" usually gives the answer.

Worked example: fair presentation

During an audit of a maintenance department, the auditor could not access the computer system that holds work orders because it was offline. She could not confirm whether planned maintenance was done on time. A careless report would simply leave this out. A fair report states that the work order system was not available, so the conclusion on planned maintenance is limited. Readers then know what was and was not tested.

Worked example: confidentiality

An auditor sees salary data on a screen while auditing the training records in human resources. It is not part of the audit. He does not record it, does not mention it, and asks for the screen to be closed. The principle protects the trust that makes people willing to show auditors their real work.