4.1 ISO 19011:2018 Seven Principles of Auditing

4.1 ISO 19011:2018 Seven Principles of Auditing

Quick Answer: ISO 19011:2018 Clause 4 establishes seven core principles that govern all management systems audits: Integrity, Fair Presentation, Due Professional Care, Confidentiality, Independence, Evidence-Based Approach, and the Risk-Based Approach (introduced in the 2018 edition). These principles ensure that audits provide reliable, objective, and reproducible information that management and certification bodies can trust for decision-making.

---

1. Overview and Purpose of Audit Principles

Auditing is not merely a checklist-ticking inspection; it is a formalized, systematic, and independent evaluation process. For an Environmental Management System (EMS) audit to deliver genuine value, stakeholders—including top management, regulators, accreditation bodies, and the public—must have absolute confidence in the competence, impartiality, and findings of the audit team.

ISO 19011:2018 Clause 4 outlines seven fundamental principles. Adherence to these principles is a prerequisite for providing audit conclusions that are relevant, sufficient, and consistent across independent auditors evaluating the same evidence under similar circumstances.

                    [ ISO 19011:2018 Clause 4 ]
                Seven Core Principles of Auditing
                               │
       ┌───────────────────────┴───────────────────────┐
       ▼                                               ▼
[ Auditor Professionalism ]                  [ Process Reliability ]
 • Integrity (a)                             • Evidence-Based Approach (f)
 • Fair Presentation (b)                     • Risk-Based Approach (g)
 • Due Professional Care (c)                 • Independence (e)
 • Confidentiality (d)

---

2. In-Depth Breakdown of the Seven Principles

Principle 1: Integrity — The Foundation of Professionalism (Clause 4a)

Integrity requires auditors and audit program managers to:

• Perform work ethically, with honesty and responsibility.
• Undertake audit assignments only if competent to do so.
• Perform work impartially, remaining fair, unbiased, and objective in all dealings.
• Be sensitive to any influences that may be exerted on their judgment while conducting an audit.

Environmental Audit Application: Consider an auditor auditing a chemical facility who is offered an expensive meal or pressured by a plant manager to omit a recorded breach of effluent pH discharge limits. Upholding integrity means resisting commercial or emotional coercion, refusing improper hospitality, and accurately recording the factual data regardless of uncomfortable confrontations.

Principle 2: Fair Presentation — The Obligation to Report Truthfully and Accurately (Clause 4b)

Fair presentation mandates that audit findings, audit conclusions, and audit reports reflect truthfully and accurately the audit activities. Significant obstacles encountered during the audit (e.g., access denied to hazardous waste storage yards or missing continuous emissions logs) and unresolved divergent opinions between the audit team and the auditee must be fully documented.

Environmental Audit Application: If an auditee argues that an unmonitored storm drain discharge point was installed temporarily and should not be cited, the auditor must not negotiate away the finding. Under fair presentation, the nonconformity must be documented against ISO 14001:2015 Clause 8.1 and 9.1.1, while recording the auditee's stated perspective in the audit notes if consensus cannot be reached.

Principle 3: Due Professional Care — The Application of Diligence and Judgment in Auditing (Clause 4c)

Auditors must exercise care corresponding to the importance of the task they perform and the confidence placed in them by the audit client and interested parties. Having the necessary competence is a vital factor. Due professional care requires auditors to apply reasoned judgment in all audit situations, recognizing that sampling introduces inherent uncertainty.

Environmental Audit Application: An auditor reviewing groundwater monitoring records notices a slight, steady upward trend in chlorinated hydrocarbon concentrations over the past three quarters. Although current levels remain just beneath statutory intervention thresholds, an auditor exercising due professional care does not ignore the trend; they investigate baseline hydrogeological surveys, underground storage tank integrity test logs, and spill containment records to evaluate whether a latent leak exists.

Principle 4: Confidentiality — Security of Information (Clause 4d)

Auditors must exercise discretion in the use and protection of information acquired in the course of their duties. Audit information must not be used inappropriately for personal gain by the auditor or the audit client, or in a manner detrimental to the legitimate interests of the auditee.

Environmental Audit Application: During an audit of a specialty polymers manufacturer, the audit team reviews proprietary product formulation sheets to verify compliance with REACH chemical authorizations and life cycle raw material choices. The lead auditor must ensure these records are kept secure, never photocopied without explicit authorization, never discussed outside the audit team, and securely purged or archived in accordance with certification body protocols.

Principle 5: Independence — The Basis for Impartiality and Objectivity (Clause 4e)

Auditors must be independent of the activity being audited wherever practicable, and must in all cases act in a manner that is free from bias and conflict of interest.

• For internal (first-party) audits: Auditors should be independent from the operating manager of the function being audited (e.g., the EHS coordinator should not conduct the formal internal audit of the EHS department or waste storage facilities they personally manage).
• For external (second- and third-party) audits: Auditors must be completely independent from the audited entity, possessing no commercial, financial, consultancy, or close personal ties.

Environmental Audit Application: If an auditor provided fee-based environmental consultancy (such as designing their ISO 14001 aspect register or engineering their wastewater treatment plant) within the past two years, they cannot audit that facility. Doing so fundamentally compromises independence and creates an indefensible self-review conflict.

Principle 6: Evidence-Based Approach — The Rational Method for Reliable Conclusions (Clause 4f)

Audit evidence must be verifiable. It is generally based on samples of the information available, since an audit is conducted during a finite period and with finite resources. A rational use of sampling is closely related to the confidence that can be placed in the audit conclusions.

Environmental Audit Application: An auditor cannot raise a nonconformity based on a subjective feeling, suspicion, or rumor that "operators probably dump solvent into the grease trap at night." A defensible finding requires verifiable objective evidence: physical observation of residue, solvent purchase-versus-waste disposal mass balances, analytical test reports, or signed operator admissions.

Principle 7: Risk-Based Approach — An Audit Approach that Considers Risks and Opportunities (Clause 4g)

Introduced in the 2018 revision of ISO 19011, the risk-based approach requires that audit planning, execution, and reporting explicitly focus on matters that are significant for the audit client and for achieving the audit program objectives. Audit resources and sampling intensity must be directed toward processes with high environmental risk and significant potential impacts.

Environmental Audit Application: In an industrial electroplating facility, an auditor allocating equal time (two hours each) to administrative office paper recycling and toxic cyanide plating effluent detoxification violates the risk-based approach. The auditor must allocate substantial sampling and interview time to the cyanide bath bunds, scrubber efficiency, emergency stop interlocks, and continuous toxic gas sensors.

---

3. Real-World Applications & Environmental Nuances

Applying these seven principles requires balancing complex competing pressures on site:

1. Managing Sampling Uncertainty (Principle 6 & 7): Because auditors sample only a fraction of records (e.g., 5 out of 100 hazardous waste manifests), due care requires that sample sizes expand when discrepancies appear. If the first two manifests show missing licensed carrier signatures, the auditor must broaden the sample rather than accepting the auditee's explanation that "it was an isolated oversight."
2. Handling Commercially Sensitive Effluent Data (Principle 4 & 2): When an auditor identifies illegal bypass piping or undisclosed effluent exceedances, auditees often claim commercial sensitivity or legal privilege to withhold records. The auditor must maintain fair presentation by reporting the limitation in scope or evidence obstruction, while respecting confidentiality by keeping the discovered data within authorized reporting channels.
3. Navigating Internal Independence Constraints (Principle 5): In small enterprises with limited staff, complete independence can be difficult. ISO 19011 notes that where internal auditors cannot be entirely independent of the operational unit, the audit program manager must make every effort to eliminate bias and ensure objective reporting.

---

4. CQI/IRCA Exam Traps & Pitfalls

Candidates routinely lose marks on CQI/IRCA Lead Auditor assessments due to specific conceptual confusions:

---

5. Principles Synthesis Table