Audit

“An audit is not a search for reassurance; it is a disciplined test of whether evidence meets a requirement. ”

Audit is one of the most familiar words in assurance and one of the easiest to overstate. Organisations speak of audited suppliers, audited farms and audited data as though the word itself guarantees safety, legality or responsible performance. It does not. An audit is a method for examining defined evidence against defined criteria within a defined scope and period.

ISO 19011:2026 describes audit as a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. The definition matters because each element limits the claim. Systematic means planned rather than improvised. Independent means judgement is sufficiently free from the activity being examined.

Documented means the method and conclusion can be followed. Criteria establish the requirement. Evidence supports the finding.

The audit does not create the criteria. A weak standard can be audited competently and still produce a weak conclusion. Nor does an audit examine everything. Scope may exclude subcontractors, seasonal labour, purchasing practices, environmental effects outside a site or events that occur when the auditor is absent. A clean conclusion therefore means that the evidence sampled within scope supported the criteria used.

It does not mean that no problem exists elsewhere. The 2013 Rana Plaza disaster became a global reminder of this limitation. Factory assessment had become routine across apparel supply chains, yet catastrophic building, governance and worker-safety risks were not prevented. The lesson was not that audits have no value.

It was that a periodic site visit cannot compensate for fragmented responsibility, narrow criteria, weak worker voice, purchasing pressure or absent remediation. Sampling is unavoidable. Auditors cannot interview every worker, inspect every plot or recalculate every transaction. They select evidence according to risk, materiality and professional judgement. The conclusion is therefore supported, not omniscient.

Management may also prepare records for the visit, workers may fear retaliation, and conditions may vary by season or shift. Triangulation across documents, observation, interviews and external data helps, but uncertainty remains. Independence is similarly more than organisational distance.

A third-party auditor can face commercial dependence on the client, pressure to finish within an unrealistic number of days or incentives to preserve a long relationship.

Internal auditors can be highly objective where governance protects their authority. The relevant question is whether conflicts are identified and controlled, whether evidence can be challenged and whether an unfavourable conclusion is genuinely possible. Audit quality depends on competence. A financial auditor, agronomist, labour-rights specialist and geospatial analyst bring different capabilities.

Complex sustainability claims often cross several disciplines. A technically neat checklist cannot substitute for understanding local law, seasonal work, land-use change, gendered risk or chain-of-custody controls. Findings are not the end of the process. An audit that records the same issue each year without effective corrective action becomes a ritual of recurrence.

The value lies in precise findings, proportionate response, verification of effectiveness and learning across sites. Where harm has occurred, remediation may also be required; closing a finding administratively is not the same as repairing its effects.

The discipline is to describe the audit honestly. State the criteria, scope, period, sites, sampling, method, assurance limitations and conclusion. Do not let the single word audited carry meanings the engagement never tested. Audit can strengthen accountability, but only when users can see what was examined, what was not and what happened after the finding.

Practical application

Define the audit objective and criteria before selecting the method. Build the programme around risk rather than a fixed checklist, and assign competent auditors with sufficient time, language and subject expertise. Protect confidential worker and community interviews and use multiple evidence sources. Report scope and limitations with the conclusion.

Track findings to correction, root-cause analysis, corrective action and effectiveness review. Analyse repeated findings across suppliers or regions for system causes, including buyer practices and scheme design.

Why it matters

Audits often sit between a sustainability claim and the people expected to trust it. When they are well designed, they reveal evidence gaps, test controls and support improvement. When their limits are hidden, they can provide confidence greater than the work justifies.

Common misconception

Audit is often treated as proof that an organisation or site is compliant in every respect. An audit provides a conclusion against specified criteria using selected evidence within a defined scope and time. It reduces uncertainty; it does not eliminate it.

Connections

ISO 19011 guides the audit process. Non-conformity translates evidence and requirements into a precise finding. Corrective Action addresses causes after findings, while Certification and Verification use audit evidence within different assurance arrangements.

A question worth asking

If a reader saw only the phrase independently audited, which boundary, exclusion or uncertainty in the actual engagement would they fail to understand?

Selected references

ISO 19011:2026. Guidelines for Auditing Management Systems. International Labour Organization. 2013. The Rana Plaza Accident and Its Aftermath. Power, M. 1997. The Audit Society: Rituals of Verification. Boiral, O. 2012. ISO Certificates as Organisational Degrees? Beyond the Rational Myths of the Certification Process. Organization Studies 33(5-6): 633-654. ISEAL Alliance. 2018.

Assuring Compliance with Social and Environmental Standards, Version 2. 0.