Independence and impartiality for auditors
Internal auditors should not audit their own work, but small organisations rarely have a dedicated audit team. Here is what the standards actually ask, the practical options, and how to check competence and conflicts before each audit.
Certification auditors often ask a simple question when they sample internal audit records: who audited this, and do they work in the area? If the answer is the purchasing manager auditing purchasing, the audit’s findings carry little weight, and the certification auditor may raise a finding against the audit programme itself. This guide explains what the standards ask for, how organisations with five or fifty staff can meet it, and how to check competence and conflicts before each audit.
What the standards ask for
ISO 9001:2015 clause 9.2.2(c) asks you to select auditors and conduct audits in a way that ensures the audit process is objective and impartial. ISO 14001, ISO/IEC 27001 and ISO 45001 carry the same requirement in near-identical form, because they share the harmonized structure.
Note what the clause does not say. It does not require auditors to be from outside the organisation, to be full-time auditors or to hold a particular qualification. It asks for objectivity and impartiality in the audit process, and leaves you to decide how to achieve it.
ISO 19011:2018 fills in the detail. Its principles of auditing, in clause 4, include independence as the basis for impartial, objective conclusions. It says auditors should be independent of the activity being audited wherever practicable and free from bias and conflict of interest. It also recognises that in small organisations full independence may not be possible, and expects every effort to be made to remove bias and encourage objectivity.
Do not audit your own work
The core rule is simple: an auditor should not audit an activity they perform, supervise or are responsible for. That includes:
- The process they own or manage.
- Work they did themselves, even in another department.
- A corrective action they designed or implemented.
- A procedure they wrote, where the audit will judge whether that procedure is adequate.
The quality manager is the usual blind spot. They can audit production, purchasing or sales, but not document control, management review, the corrective action process or the internal audit process itself if they run them. Those need someone else.
Watch for less obvious conflicts too. A buyer auditing the warehouse that receives their orders may be reluctant to raise findings that reflect on purchasing. A supervisor auditing a manager they report to may soften findings. Independence is about the auditor’s freedom to report what they find, not just their job title.
Options for small organisations
Kestrel Metals, a fictional fabricator with about 60 staff across a Lagos plant and an Ogun plant, has one quality manager, A. Mensah, and no audit department. Its audit programme covers about fourteen audits a year. Here is how organisations of that size typically staff them.
Cross-department auditors. Train four to eight people from different functions as internal auditors and have them audit each other’s areas. At Kestrel Metals, Tunde Bakare from production planning audits purchasing; J. Okafor from purchasing audits maintenance at the Ogun plant; K. Lewis from HR audits dispatch. Auditing other functions is also one of the best ways to build cross-department understanding.
Auditors from another site. Where you have two or more sites, swap auditors between them. The Ogun plant’s auditors audit Lagos and the reverse. Check that the auditor has no line responsibility for the other site.
Pooled auditors across a group or network. Sister companies, members of an industry association or a few small firms can agree to audit one another. Agree confidentiality in writing first, especially where the firms compete or where the audit will see customer, pricing or personal data covered by the Nigeria Data Protection Act 2023.
Outsourced internal auditors. A consultant can carry out some or all of the internal audits. This works well for areas nobody inside can audit impartially, such as the quality manager’s own processes, or where specialist knowledge is needed, such as information security under ISO/IEC 27001. Avoid using the same consultant who wrote your procedures to audit them, and avoid any arrangement where the consultant who audits you also works for the certification body that certifies you.
Most small organisations combine these: cross-department auditors for most processes, and an external auditor once a year for the quality manager’s own activities.
Specialist areas need extra thought. An ISO/IEC 27001 internal audit of access control or backups needs someone who understands the systems well enough to ask for the right evidence, but the obvious candidates in a small IT team usually run those systems. A common answer is to pair a trained internal auditor from outside IT with a technical specialist from another company in the group, or to bring in an external auditor for the technical controls while the internal team audits the policies, training and records around them. The same approach works for ISO 45001 audits of specialist activities such as lifting operations or confined space entry.
Competence matters as much as independence
An impartial auditor who does not understand the process will miss things. ISO 9001 clause 7.2 applies to auditors like everyone else: you need to determine the competence they need and keep evidence of it.
ISO 19011 clause 7 describes auditor competence in some detail. Its main themes are:
- Personal behaviour. Being ethical, open-minded, diplomatic, observant, tenacious and able to reach conclusions from evidence.
- Knowledge of audit principles and methods. Planning, sampling, interviewing, recording evidence and writing findings.
- Knowledge of the management system standard being audited, and of the organisation’s own procedures.
- Knowledge of the discipline or sector, such as welding, food safety or access control.
- Evaluation and maintenance. Setting criteria for auditor competence, evaluating auditors against them and keeping that competence up to date.
In practice, internal auditors typically complete an internal auditor course, carry out one or two audits alongside an experienced auditor, and then audit on their own with periodic review of their reports. A lead auditor qualification is useful for whoever leads the programme, but no standard requires it for internal auditors.
Give the auditor time to learn the area before the audit. A cross-department auditor who spends an hour with the procedure, the last audit report and the process map will ask far better questions.
A conflict-of-interest check before each audit
Run a short check when you assign an auditor to an audit. It takes two minutes and leaves a record that impartiality was considered, which is useful when a certification auditor asks.
| Question | If yes |
|---|---|
| Does the auditor work in, manage or supervise the area being audited? | Assign someone else |
| Did the auditor carry out or approve any of the work in the audit scope? | Assign someone else, or exclude that work from their part of the audit |
| Did the auditor write the procedure being audited? | Assign someone else if the audit will judge the procedure’s adequacy |
| Did the auditor design or implement a corrective action that will be verified? | Have another auditor verify that action |
| Does the auditor report to the auditee, or does the auditee report to them? | Consider another auditor, or pair them with one |
| Has the auditor audited this area in the last two cycles? | Consider rotating for a fresh view |
| Does the auditor have a personal or commercial interest in the outcome? | Assign someone else |
| Does the auditor have the knowledge needed for this audit scope? | Pair with a specialist or provide a briefing |
At Kestrel Metals, the check caught one problem in 2026: K. Lewis had been scheduled to audit training records, which HR maintains. The audit was reassigned to Tunde Bakare.
Keep the record
Keep a simple auditor register: names, functions, training, audits carried out and areas they cannot audit. Review it when you build each year’s programme. When an auditor changes jobs, update the register, because a buyer who moves into a production role may become able to audit purchasing and unable to audit production.
When a certification auditor samples your internal audits, they typically check three things about the auditor: that the person did not audit their own work, that there is evidence of their competence, and that the findings show they looked properly. The third is often the most telling. A run of audits by the same person with no findings at all can raise more questions than a clear conflict of interest, because it suggests the auditor either lacked the knowledge to find problems or was reluctant to report them. Reviewing auditors’ reports once a year, and giving them feedback, is the simplest way to keep standards up.
In Orisynx, the activity log records who changed what and when, including creating, updating and reassigning planned audits, so changes to the programme leave a trail you can show. The guide on planning a risk-based audit programme covers allocating auditors across the year.
Sources
- ISO 19011:2018, Guidelines for auditing management systems: https://www.iso.org/standard/70017.html
- ISO 9001:2015, Quality management systems, Requirements: https://www.iso.org/standard/62085.html