# Audit principles

Audit principles are defined in ISO 19011, Clause 4. Adherence to these principles is important to provide audit conclusions that are relevant and sufficient, and to enable different auditors to reach similar conclusions in similar circumstances.

These principles are: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach.

  
**Integrity** is the core principle of professional behaviour.
Auditors, and the individuals managing an audit program, should
- perform their work ethically with honesty and responsibility, 
- only undertake audit activities if competent to do so 
- perform their work in an impartial manner, in other words remain fair and unbiased in all their dealings
- be sensitive to any influences that may be exerted on their judgment while carrying out an audit 
- report truthfully and accurately.

This last obligation means your report should explicate how you performed the audit, who you interfaced with, and at what date and time, the evidence provided to you, etc.

 You should also report on significant obstacles encountered during the audit, and unresolved diverging opinions between the audit team and the auditee.

The communication should be truthful, accurate, objective, timely, clear, and complete. No ambiguity. 

## Due professional care
Due professional care is addressed in ISO 19011 clause 4c.

Because of the importance of their task and the confidence placed in them by the audit client and other interested parties, the auditor should take care that this trust isn't violated.

This means that the context of the organization, critical processes of the organization, the expectations of the clients, complexity of the client activities to be conducted, and the resources needed in order to do the actual audit, should be considered beforehand.

The auditor must exercise **professional judgment** by applying relevant training, knowledge, and experience to make informed decisions in various situations during an audit, while maintaining their independence and objectivity and adopt an attitude of skepticism to reach the audit objectives.

**Professional skepticism** is necessary to reduce the risk of overlooking possible issues or intentional issues that are intentionally being hidden from you, which could obviously lead to incorrect audit conclusions. You should not ever take the word of the auditee as fact – you must look for evidence to support their claims of whatever they're trying to tell you. Always ask for proof. Be on the lookout for evidence that could contradict or question the reliability and validity of the documented information received.

If an auditor encounters exceptional circumstances, such as **significant irregularities or illegal acts** that affect their ability to continue with the audit, they should take into account the legal implications and they should also consider withdrawing from the audit. For example, if during an audit you encounter evidence or suspect issues that could involve national security or child pornography, that's an illegal act that requires reporting to law enforcement. So you need to understand the laws of the countries you're going to be auditing in, and from the country you reside in when auditing remotely.

**Confidentiality**. Auditors should exercise discretion in the use and protection of information acquired in the course of their duties. This information should not be used inappropriately or for personal gain by the auditor or the audit client or in a manner detrimental to the legitimate interests of the auditee.
As an auditor, in most cases you will be required to sign a non-disclosure of some sort, by the audit client or the auditee, and by the certifying body you're working under (as per ISO 17021-1, clauses 8.4.1).

Confidentiality requirements are further explicated in ISO 17021-1, clauses 8.4.3, 8.4.6 and 8.4.7.
Information about a particular certified client or individual shall not be disclosed to a third party without written consent, except as required by law. The certification body shall have processes, equipment and facilities that ensure the secure handling of confidential information, and the auditors must be aware of these.
