Audit principles, ethics, and professional conduct
This domain tests judgment under pressure: whether you can apply audit principles, protect impartiality, and handle ethical situations without damaging evidence quality. ISO 19011:2018 sets out principles including integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach, and a risk-based approach. These are not slogans; they determine whether findings can be relied upon.
Core rules and concepts
- Integrity and fair presentation: report findings honestly, including inconvenient ones, and do not omit material weaknesses.
- Due professional care: work within your competence; use sampling and evidence checks proportionate to risk.
- Confidentiality: do not disclose audit information without authorization, including in informal conversation.
- Independence: avoid auditing your own work or a process you recently managed. Disclose conflicts and seek reassignment if impartiality is compromised.
- Evidence-based approach: conclusions must rest on verifiable information, not opinion or hearsay.
Worked example
During an audit, the auditee offers an auditor an expensive gift and hints that a problematic waste-storage area is “not worth visiting.” The correct response is to decline the gift politely, document the offer if it could affect independence, and still inspect the area using a risk-based sample. If the auditor previously managed that waste area, they should disclose the conflict and withdraw from that part of the audit. The reasoning: accepting the gift creates a perceived conflict, and avoiding the area undermines the evidence-based and risk-based principles.
Traps that cost marks
Accepting hospitality that creates obligation; treating a friendly auditee as evidence of conformity; discussing findings with unauthorized people; and failing to disclose a prior role in the audited process. Another trap is presenting an opinion as a finding without a verifiable audit trail. Independence is both actual and perceived.