Auditor Competence, Ethics, and Professional Conduct
Domain 8 tests judgement about the auditor as much as about the client: competence, independence, and conduct under pressure.
Core rules
- ISO 19011 frames competence as knowledge (audit principles, ISO 14001, environmental science, legal requirements, the client's sector), skills (interviewing, note-taking, reporting, sampling), and personal attributes (ethical, open-minded, diplomatic, perceptive, tenacious, decisive).
- Impartiality is a state of mind; independence is an organizational arrangement. Both must show up in assignment decisions, not just in a signed declaration.
- Confidentiality covers documents, conversations, and anything observed on site, and survives the end of the engagement.
- Certification bodies commonly apply a two-year rule for personnel previously employed by the client, and must analyse consultancy, gifts, and financial ties.
- Continuing professional development keeps knowledge current as regulations and standards change.
- If you lack competence in a technical area, say so; the team carries the risk, not your pride.
Worked example
An auditor is offered an audit of a plant where they were the EHS manager until fourteen months ago. Three threats arise: self-review of controls they designed, familiarity that dulls questioning, and personal relationships with staff. The correct action is to decline or be reassigned, and to record the impartiality analysis. Had the situation been unavoidable, safeguards such as a second auditor and restricted scope would be documented - but reassignment is the default, not the fallback.
Traps that cost marks
- Accepting client-paid travel, meals, or gifts beyond a stated policy.
- Auditing processes you designed or currently manage.
- Sliding into advice mid-audit, which later undermines impartiality.
- Discussing one client's findings with another client or with a supplier.
- Claiming technical competence in a specialty you would have to learn during the audit.