Audit principles, ethics and impartiality
Seven principles
ISO 19011 lists integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach. ISO/IEC 17021-1 builds certification on impartiality: the body must identify, analyse, evaluate and document threats and apply safeguards.
Threats and safeguards
Common threats are self-interest (a fee dependent on passing), self-review (auditing work you performed), familiarity (long personal relationships), intimidation (a client who threatens complaint or litigation) and advocacy (promoting the client's product). Safeguards include refusing management system consultancy, rotating auditors, conflict-of-interest declarations, separating sales from audit delivery, contractual limits on contingent fees, and an impartiality committee with stakeholder representation.
Trap: confidentiality is not absolute - disclosure is permitted where required by law or by contractual arrangements, and the auditee is told what will be shared.
Trap: independence does not mean the auditor must be ignorant of the sector. Sector knowledge is a competence; independence concerns freedom from pressure and from auditing one's own work.
Trap: 'fair presentation' means reporting obstacles encountered, unresolved divergences of opinion and sampling limitations honestly - not writing a bland, agreeable report.
Worked example
A certification body also delivers 'gap analysis and implementation support' to the same client. That is management system consultancy and creates a self-review threat that cannot be adequately safeguarded: the body must not certify the system it helped build, and the cooling-off period applies. Training that merely delivers public, non-client-specific knowledge is different from advice tailored to the client's system.