Who can audit a process when everyone helps run it?

Choose the auditor for the activity being tested, not simply for their job title. In a small team, someone may understand a process without having made the decisions under examination. A useful starting point is to separate that knowledge from the authority to select evidence, challenge explanations and reach the audit conclusion.

If every available person helped perform or approve the activity, do not disguise a self-check as an impartial audit. Record the gap and arrange a suitable alternative, which may include a competent person from another team or an external auditor. A second signature alone does not create a second examination.

This article helps UK small-business quality coordinators make an internal management-system audit assignment. The worked method is an editorial recommendation, not a certification ruling, a statutory financial-audit rule or a claim that every small organisation must buy external auditing.

The ISO 9001 Auditing Practices Group’s educational paper on internal audits highlights competence, objectivity and impartiality. It also distinguishes its discussion of ISO 9004 guidance from auditable ISO 9001 requirements. Treat that paper as helpful context, not as a new requirement. Source 1

The APG website warns that its papers are not specified requirements or criteria all auditors must follow. Source 2 Your actual criteria come from the applicable standard, your approved audit arrangements and any relevant contractual or sector requirements.

Edition matters. ISO’s current page identifies ISO 9001:2026 as published on 16 September 2026 and directs certified organisations to their certification body for transition information. ISO 19011:2026, published in May, provides auditing guidance and does not itself confer certification. Source 3 Source 4 This article does not reproduce licensed clauses or assert a universal transition deadline. Check the edition governing your audit before applying a clause reference from an older checklist.

Write one sentence defining what you want the audit to establish. “Purchasing” is too broad for an assignment decision. “Whether September supplier approvals followed procedure PUR-02” identifies a bounded activity and a set of decisions someone may already have made.

Then ask three separate questions about each candidate:

• Involvement: Did they perform, approve, design or take responsibility for the activity being examined? Include temporary cover and informal approval routes.
• Capability: Can they understand the criteria, trace the relevant records and evaluate conflicting evidence? A person outside the department may still lack the knowledge to do this.
• Freedom to challenge: Could a reporting relationship, personal interest or reciprocal arrangement discourage a candid finding? Consider who can see the unedited conclusion and resolve a disputed result.

These are proposed assignment checks, not an ISO-prescribed scoring formula. Do not average a serious conflict away with a high competence score. A course certificate also does not answer whether this person can examine this particular process effectively.

All names, roles, records and decisions below are fictional. No client audit or competence assessment was performed.

A service business has three internal candidates. Nadia, its quality coordinator, maintains controlled procedures but did not approve September suppliers or prepare September service reports. Omar, its operations lead, approves suppliers and maintains staff authorisations. Leah, its administrator, assembles service-report packs and checked a delegated supplier approval while covering Omar’s absence.

For this example, the business has already evaluated Nadia as capable of auditing supplier approvals and report-release records, and Omar as capable of auditing document-control records. Leah’s relevant audit competence has not been demonstrated. These are stipulated inputs, not conclusions inferred from their job titles.

The owner proposes the following assignments under an invented internal rule: the lead evaluator must be competent for the scope, must not have performed or approved the activity being evaluated, and must have an unrestricted route to report findings.

1. September supplier approvals — Nadia leads. Omar and Leah made approvals. They explain their records but do not decide the audit conclusion.

2. September report-release records — Nadia leads. Leah prepared the packs. Nadia’s assignment excludes evaluation of the procedure she authored.

3. Use of controlled procedures — Omar leads. Nadia maintains the documents. Omar examines availability and version use; his own approvals are outside this scope.

4. Staff authorisation decisions — external candidate required. Omar owns the activity; Nadia and Leah lack demonstrated competence for this scope. Selection remains open.

The result is three assignments selected and one unresolved, not four completed audits. The owner records the open item, its significance, a person responsible for arranging suitable capability and a justified decision date. Any delay must be handled through the applicable audit programme; this example does not grant permission to miss a required deadline.

For each selected assignment, the evaluator chooses the evidence and reaches the conclusion. The person who performed the work can explain the process and supply records. Their participation is useful, but it does not replace the evaluator’s examination.

Here is the completed assignment note for the first activity:

Record: AA-018-v1. Scope: September supplier approvals against fictional PUR-02 revision 4. Lead evaluator: Nadia. Process witnesses: Omar and Leah. Involvement check: Nadia did not select or approve those suppliers; the criterion was not authored by her. Competence basis: the scenario’s documented evaluation covers supplier-approval records, audit methods and evidence assessment.

Practical safeguards: Nadia selects the cases from the complete approval register, obtains the underlying records directly and records conflicting explanations. Omar and Leah can correct factual errors with evidence, but cannot remove an adverse finding merely because they disagree. Nadia sends her report and any unresolved disagreement to the owner. The owner is not involved in the September approvals in this example.

Limit: This assignment does not cover supplier performance, the adequacy of purchasing policy or decisions outside September. If the examination expands into an area Nadia designed or approved, reassess the assignment before drawing that additional conclusion.

Status: Assignment selected; audit not yet performed. Retain the scope, competence evidence, conflict declaration, safeguards and decision owner together. A signed declaration supports the record; it does not prove the safeguards operated.

When recording a result later, use a finding with a retrievable criterion and evidence. Do not turn the assignment note into a finding before the audit happens.

What if Nadia approved two suppliers while covering leave? Under the fictional rule, she can no longer lead the supplier-approval assignment as defined. The team needs a suitable replacement for that scope, or a genuinely separate evaluator for the affected decisions with clear responsibility for the combined conclusion. Quietly removing her two approvals from the sample would conceal the conflict and weaken the evidence. If no replacement is available, the example now has two selected assignments and two unresolved ones.

What if Omar agrees to audit Nadia only if she gives his process a clean result? Their different departments have not prevented bias. Disclose the arrangement, change the assignments and preserve access to the original evidence. Cross-auditing is a possible organisational arrangement, not automatic proof of impartiality.

What if the external candidate wrote the authorisation procedure? Being external does not settle the question. Check the candidate’s previous work, interests, competence, access and proposed scope before appointment. Separate examination of implementation from evaluation of the design where appropriate; do not promise that this distinction will satisfy every applicable audit scheme.

What if the owner is also responsible for the disputed activity? The reporting safeguard in AA-018-v1 no longer fits. Identify an appropriate route for independent challenge under the organisation’s governance arrangements. If that is unavailable, state the limitation rather than describing management acceptance as proof of impartiality.

Start with one forthcoming audit and map the actual activities performed by each candidate. Select the evaluator only after checking both capability and conflicts. Keep unresolved coverage visible in the audit programme and its resource decisions.

This method cannot guarantee freedom from bias or a certification outcome. Its practical value is a traceable assignment: the reader can see who examined what, why they were suitable, which safeguards mattered and which conclusion remains unsupported. If those answers change, update the assignment before relying on the audit.

Source 1: ISO 9001 Auditing Practices Group, *Internal Audits*, edition 1, amendment 1, 19 July 2020, especially pages 2–3; still linked from the current APG site. Source 2: current APG guidance and disclaimer. Sources 3–4: ISO’s public ISO 9001 and ISO 19011 edition/scope pages. Read on 18 October 2026. The older APG paper is educational context, not verification of the full 2026 clauses.

Assignment method, fictional record and failure tests: original QSE Advisory editorial analysis, prepared with AI assistance. Publisher and author: QSE Advisory, office@qseadvisory.com. Reviewer and Assessor: Laraib Naveed Ahmad.

Spotted an issue? Contact our editorial desk.