What’s a Professional Auditor’s Role? Do’s and Don’ts for Auditors

Professional Auditor Do’s and Don’ts: Essential Skills for Effective ISO Auditing

Becoming a professional auditor requires more than understanding an ISO standard or completing auditor training. Effective auditors need strong communication skills, sound judgement, professional behaviour and the ability to collect and evaluate objective evidence.

Whether you are conducting an internal audit, supplier audit or external management systems audit, the way you plan, conduct and report the audit can significantly influence its effectiveness.

Auditing is a systematic process used to evaluate whether an organisation's management system meets defined audit criteria. These criteria may include international standards such as ISO 9001, ISO 14001, ISO 45001 or ISO 27001, organisational procedures, contractual requirements or regulatory requirements.

For professionals developing their careers through Internal Auditor or Lead Auditor training, understanding good auditing behaviour is just as important as understanding the requirements of the relevant management system standard.

Here are some important do's and don'ts every professional auditor should consider.

The Do's of Being a Professional Auditor

Do Be Punctual and Prepared for the Audit

Professional auditing starts before the opening meeting.

An auditor should prepare appropriately, understand the audit scope and criteria and communicate the audit plan to the auditee with sufficient notice.

Good audit preparation includes:

• Providing the audit plan before the audit.

• Clearly identifying the audit scope, objectives and criteria.

• Arriving on time for on-site or remote audit activities.

• Starting and finishing audit meetings according to the agreed schedule.

• Communicating any proposed changes to the audit plan with the auditee.

• Reviewing relevant documented information before commencing audit activities.

Effective audit planning helps both the auditor and auditee understand what will be assessed and allows the available audit time to be used effectively.

Do Keep Auditees Informed About Audit Findings

Good communication is one of the most important auditing skills.

Auditees should understand significant observations and potential audit findings identified during the audit. Where appropriate, auditors should discuss these findings with relevant personnel before the formal closing meeting.

A short daily briefing can be particularly useful during multi-day audits.

This gives the auditee an opportunity to provide clarification or additional relevant evidence and helps ensure that potential audit nonconformities are based on complete and accurate information.

The objective is not to negotiate findings, but to ensure that the auditor has correctly understood the available evidence before reaching an audit conclusion.

Do Verify Nonconformities Before the Closing Meeting

A professional auditor should verify potential nonconformities before presenting them at the formal closing meeting.

The closing meeting should communicate the results of the audit rather than introduce unexpected findings that have not previously been discussed with the appropriate auditee representatives.

Before raising a nonconformity, the auditor should be confident that:

• The applicable audit requirement has been correctly identified.

• There is sufficient objective evidence.

• The evidence demonstrates that the requirement has not been fulfilled.

• The finding is clear, factual and understandable.

This approach supports accurate and defensible audit findings and reduces unnecessary disagreement during the closing meeting.

Do Use Objective Evidence to Support Nonconformities

Professional auditors do not raise nonconformities simply because something appears unusual or because they personally prefer another approach.

Audit conclusions should be based on objective evidence.

Objective evidence may include records, observations, statements of fact and other verifiable information relevant to the audit criteria.

When documenting an audit nonconformity, consider three important elements:

1. What is the requirement?
   Identify the relevant audit criterion or requirement.

2. What has not been fulfilled?
   Clearly explain the gap between the requirement and what was observed.

3. What is the objective evidence?
   Record the evidence demonstrating that the requirement has not been met.

Following this approach helps auditors write clear, evidence-based and defensible nonconformity statements.

Do Clearly Communicate Audit Findings and Next Steps

An auditor should communicate findings clearly and professionally.

Auditees should understand what was identified, which requirement relates to the finding and what happens next within the applicable audit process.

Avoid overly technical or confusing language where a simpler explanation will communicate the same information.

A professional auditor should also make sure the auditee understands the audit process, including how findings are reported and any applicable follow-up requirements.

Clear communication is particularly important when discussing audit nonconformities, corrective actions and audit conclusions.

Do Issue the Audit Report Promptly

The audit does not finish when the closing meeting ends.

Audit findings and conclusions should also be documented in an appropriate audit report.

The report should clearly communicate relevant information such as:

• Audit objectives.

• Audit scope and criteria.

• Areas or processes audited.

• Audit findings and nonconformities.

• Audit conclusions.

• Relevant follow-up requirements.

Issuing the audit report promptly allows the organisation to review the findings and begin addressing identified issues without unnecessary delay.

Timely and accurate audit reporting is an important part of professional management systems auditing.

The Don'ts of Being a Professional Auditor

Don't Be Rude or Confrontational

Professional auditors should remain respectful, objective and courteous throughout the audit.

Auditing often involves asking challenging questions and identifying weaknesses within a management system. The way these discussions are handled can significantly affect the quality of communication and the evidence obtained.

During an audit:

• Don't interrupt auditees unnecessarily while they are answering questions.

• Don't use judgemental or argumentative language.

• Don't make discussions personal.

• Don't attempt to intimidate the auditee.

• Don't assume that a different approach automatically means nonconformity.

Instead, use open questions, active listening and constructive professional communication.

Strong auditor communication skills can help establish an environment in which people are comfortable providing accurate and relevant information.

Don't Go Looking for Nonconformities

The purpose of an audit is not to find as many nonconformities as possible.

The auditor's role is to evaluate available evidence against the established audit criteria and determine whether requirements have been fulfilled.

This distinction is important.

A professional auditor approaches the audit objectively rather than assuming that something must be wrong.

Where requirements are fulfilled, conformity should be recognised. Where objective evidence demonstrates that a requirement has not been fulfilled, an appropriate nonconformity may be raised.

The value of an audit comes from an accurate and impartial assessment—not from the number of findings produced.

Don't Become the Consultant

One of the most important principles for professional auditors is maintaining objectivity and impartiality.

An auditor's role is to evaluate conformity against the audit criteria. It is generally not the auditor's responsibility to design the organisation's management system or tell the auditee exactly how a problem should be corrected.

For example, an auditor may explain:

• The requirement that has not been fulfilled.

• The objective evidence supporting the finding.

• Why the issue has resulted in a nonconformity.

• The applicable audit or follow-up process.

The auditor should avoid prescribing a specific solution simply because it is the approach they personally prefer.

This distinction between auditing and consulting is particularly important for auditors involved in independent or third-party audits.

Don't Investigate the Root Cause for the Auditee

Identifying the root cause of a nonconformity is normally the responsibility of the organisation, not the auditor.

An auditor may identify and document the evidence demonstrating that a requirement has not been fulfilled, but a proper root cause investigation may require considerably more information than is available during the audit.

Root cause analysis may involve examining processes, responsibilities, resources, systems, training, human factors and other organisational conditions.

The auditee should therefore investigate the cause and determine appropriate corrective action.

The auditor's role is to evaluate the audit evidence and, where applicable, subsequently assess whether corrective actions adequately address the identified nonconformity.

What Skills Does a Professional Auditor Need?

Technical knowledge of ISO standards is important, but effective management systems auditing requires a broader range of competencies.

Professional auditors should continue developing skills in:

• Audit planning and preparation.

• Interviewing and questioning techniques.

• Active listening.

• Evaluating objective evidence.

• Sampling.

• Writing audit findings and nonconformities.

• Audit reporting.

• Managing opening and closing meetings.

• Professional communication.

• Time management.

• Critical thinking and professional judgement.

• Maintaining objectivity and impartiality.

These skills are relevant whether you are developing your capabilities as an Internal Auditor, Lead Auditor or management systems professional.

Develop Your Auditing Skills with LMS TRG

LMS TRG is an ISO management systems and auditor training provider specialising in practical, online and self-paced training.

Our auditor training programs are designed to help professionals develop the knowledge and practical auditing skills required to plan, conduct and report management systems audits.

Training is available across:

• ISO 9001 Quality Management Systems

• ISO 14001 Environmental Management Systems

• ISO 45001 Occupational Health and Safety Management Systems

• ISO/IEC 27001 Information Security Management Systems

• ISO 13485 Medical Devices Quality Management Systems

• Integrated Management Systems (IMS)

LMS TRG offers Foundation, Internal Auditor and Lead Auditor training, providing learning pathways for professionals at different stages of their auditing and management systems careers.

As an Exemplar Global Recognised Training Provider, LMS TRG provides practical auditor training developed for auditors, managers, consultants and management systems professionals.

Whether you are beginning your auditing career, developing your internal auditing skills or progressing towards Lead Auditor responsibilities, professional auditor training can help build the knowledge and competencies required to conduct effective management systems audits.