Introduction to Management System Auditing

Published 14 September 2026, updated 25 September 2026

A management system audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. That definition comes from ISO 19011:2018, Guidelines for auditing management systems, and every word in it matters.

Systematic, independent and documented

Systematic means the audit follows a planned method. The auditor does not wander through the organisation asking whatever comes to mind. There is an audit programme, an audit plan, a defined scope and criteria, and a repeatable way of gathering evidence.

Independent means the auditor is not auditing their own work and has no conflict of interest in the outcome. Independence is what gives an audit its value. A finding from someone with nothing to gain carries weight that a self assessment never can.

Documented means the process and its results are recorded. An audit that leaves no trail cannot be reviewed, challenged or learned from.

Audit criteria and audit evidence

Audit criteria are the reference against which evidence is compared. For a certification audit the criteria are the requirements of the standard, for example ISO 9001:2026, together with the organisation’s own policies, procedures and legal obligations. Audit evidence is records, statements of fact or other information that is relevant to the criteria and verifiable. An opinion is not evidence. A document, a record, an observation or a demonstrated activity is.

The comparison of evidence against criteria produces audit findings: conformity, nonconformity, or an opportunity for improvement. Findings are then evaluated against the audit objectives to reach the audit conclusion.

The seven principles of auditing

ISO 19011:2018 sets out seven principles. They apply to the auditor as a person as much as to the audit as a process.

1. Integrity. Auditors perform their work honestly, diligently and responsibly, and stay within their competence.
2. Fair presentation. Findings, conclusions and reports reflect the audit activities truthfully and accurately, including unresolved differences of opinion.
3. Due professional care. Auditors apply diligence and judgement proportionate to the importance of the task.
4. Confidentiality. Information obtained during the audit is protected and never used for personal gain.
5. Independence. Auditors are free from bias and conflict of interest.
6. Evidence based approach. Conclusions rest on verifiable evidence gathered through appropriate sampling.
7. Risk based approach. Audit planning and execution consider risks and opportunities, so effort goes where it matters most.

First, second and third party audits

A first party audit is an internal audit: the organisation audits itself, using its own staff or people acting on its behalf. Its purpose is to check that the management system conforms to planned arrangements and is effectively implemented and maintained. Every ISO management system standard requires internal audits at planned intervals.

A second party audit is carried out by, or on behalf of, a party with an interest in the organisation, most often a customer auditing a supplier. The criteria are usually a contract or a supplier code alongside the standard.

A third party audit is carried out by an independent body that has no interest in the organisation, such as a certification body performing an initial certification, surveillance or recertification audit.

What the auditor actually does

The audit process runs from initiating the audit and preparing the plan, through conducting the audit activities, to reporting, completing the audit and following up. In practice this means confirming the scope and criteria with the auditee, reviewing documented information, preparing a plan and checklists, holding an opening meeting, gathering evidence through interviews, observation and record review, evaluating findings, holding a closing meeting, issuing a report and, where required, verifying that corrective action has been effective.

The skill that separates a competent auditor from someone reading a checklist is judgement: knowing what to sample, how to trace a process from input to output, when a gap is a nonconformity and when it is a matter of interpretation, and how to report so that the organisation can act.

Why this matters for your career

Auditing competence is assessed, not assumed. QA Assessor certifies Internal Auditors and Lead Auditors against defined competence requirements that draw directly on ISO 19011:2018. If you are starting out, the Internal Auditor grade is the natural first step. If you already lead audit teams, the Lead Auditor grade recognises that competence formally.