“Independence is the basis for the impartiality of the audit and objectivity of the audit conclusions. Auditors should be independent of the activity being audited wherever practicable and should in all cases act in a manner that is free from bias and conflict of interest.”ISO · ISO 19011:2026 — Guidelines for auditing management systems · 2026 · ISO 19011:2026, 4.6 «Independence» — ediția a patra, publicată în mai 2026, care înlocuiește ISO 19011:2018
An audit without independence produces calm, not assurance.
At 9.1 the organization decides what it monitors and measures, by which methods, when and by whom, and the chosen methods have to produce comparable and reproducible results to be considered valid. At 9.2 an internal audit programme is required — frequency, methods, responsibilities, planning and reporting requirements — built with the importance of the processes and the results of previous audits in mind; auditors must be selected so as to ensure the objectivity and impartiality of the process. At 9.3 top management reviews the system against a fixed list of inputs: the status of previous actions, changes in context and in interested parties' requirements, system performance, audit results, fulfilment of objectives, risk assessment results and opportunities for improvement. The method guidance is ISO 19011, whose fourth edition appeared in May 2026 and replaces the 2018 edition; being a guidance standard, it applies immediately, with no transition period.
Clause 9 does not ask for three parallel duties, but for a chain where each link feeds on the previous one. The data measured under 9.1 becomes the raw material the internal auditor verifies under 9.2. The audit findings then enter, under 9.3, the fixed input list of the management review, alongside performance and risks. If one link weakens, the whole chain produces only paperwork. Think of a restaurant: the recipes are the measurements, the kitchen check is the audit, and the owner's weekly meeting is the management review. If the cook who prepared the dishes also checks them alone, the check becomes confirmation, not verification. The question that follows: where does this chain actually break in your organization?
Why it matters Whoever implements a process cannot audit it: independence is what makes an internal audit a check rather than a confirmation.