An audit can find a system fully conformant and completely ineffective
Auditing tests whether the described system is the operating system. Whether that system achieves anything is a separate question, and the standards increasingly ask it.
Management system auditing tests a specific relationship: whether what the organisation says it does is what it does. The auditor reads the documented arrangements, then looks for evidence that they operated, and reports where they did not. Performed properly this is a genuine discipline requiring sampling judgement, evidence evaluation and the ability to interview people who would rather be doing something else.
It is also a check on the system's relationship to itself. An organisation can describe a process, follow it precisely, produce complete records, and be achieving nothing whatever, because the process was designed to be auditable rather than to be useful. That system is fully conformant and the audit that reports it as such has answered accurately a question nobody outside the audit actually cares about.
Continue reading