What Due Professional Care Actually Means
Due professional care is one of the seven principles of auditing set out in ISO 19011. It sits alongside independence, integrity, fair presentation, confidentiality, and the others. But of all the principles, due professional care is perhaps the most misunderstood. Many auditors treat it as a vague obligation to try hard. It is far more specific than that.
On this page
In plain terms, due professional care means applying the diligence, judgement, and skill that a competent auditor would reasonably apply given the circumstances of the audit. It is not about perfection. It is about making sound decisions, pursuing leads with appropriate rigour, and never switching off your professional brain just because the day is going smoothly.
ISO 19011 describes due professional care as the application of diligence and judgement in auditing. It includes recognising that auditors are trusted to form conclusions that organisations and certification bodies will rely on. If your work is sloppy, incomplete, or based on assumptions rather than evidence, you have not exercised due professional care regardless of how many boxes you ticked on your checklist.
This article breaks down what due professional care looks like in practice, where auditors tend to fall short, and how to build it into every stage of your audit work.
Why This Principle Carries Real Weight
Every audit conclusion you reach has consequences. An internal audit that misses a systemic problem gives management false confidence. A certification audit that overlooks a significant gap allows a nonconforming organisation to carry a certificate it has not earned. A supplier audit that fails to probe a critical process leaves your organisation exposed to risk it thought was managed.
Due professional care is the principle that guards against all of these outcomes. It asks you to be thorough, to follow the evidence, and to apply your knowledge and experience to the specific situation in front of you rather than going through the motions.
For internal auditors, this matters because your findings feed directly into management review and corrective action. For lead auditors conducting certification or supplier audits, the stakes are even higher. Your conclusions carry external weight. Exercising due professional care is not optional. It is what separates a credible auditor from someone who fills in forms.
Exemplar Global Recognised Training ProviderRTP No. 310970
Diligence: The Practical Side of Professional Care
Preparing Properly Before You Walk In
Diligence starts before the audit begins. A careless auditor turns up on the day with a generic checklist and hopes for the best. A diligent auditor has reviewed the audit scope and objectives, studied the relevant clauses, looked at previous audit findings, and prepared questions tailored to the organisation and its processes.
If you are auditing a process you have not seen before, preparation is even more important. Reviewing the organisation's documented information, understanding the process inputs and outputs, and identifying the key risks in that area will help you ask the right questions when you get on site. You can read more about how to approach an unfamiliar process in our article on how to audit a process you have never seen before.
Gathering Sufficient Evidence
Diligence during the audit means gathering enough evidence to support your conclusions. Not a token sample. Not three records because that felt like enough. Enough evidence to be confident that your finding, whether it is a conformity, a nonconformity, or an observation, accurately reflects the state of the system.
This requires active sampling, not passive acceptance of whatever the auditee puts in front of you. Ask to see records they did not offer. Follow up on references in documents. Cross check what you are told against what you can observe. If something does not add up, pursue it. That is not being difficult. That is being diligent.
The temptation to accept the first piece of evidence you see and move on is real, especially when you are running behind schedule or the auditee is cooperative and pleasant. Resist it. Audit sampling should be deliberate and representative, not a matter of convenience.
Following Leads Without Prejudging
Diligence also means following leads wherever they go. If an interview reveals something unexpected, explore it. If a record contradicts what you were told, investigate the discrepancy. If a process looks different on the floor to how it is described in the procedure, note it and probe further.
Many auditors stop short of this because they are worried about causing conflict, running over time, or raising a finding they cannot fully substantiate. Due professional care requires you to push through that discomfort. You do not need to be aggressive. You do need to be persistent.
Judgement: The Harder Part
Knowing What Is Significant
Judgement is what separates an experienced auditor from someone who has memorised the standard. It is the ability to look at what you have found and determine what it means. Is this a minor administrative gap or a symptom of a systemic problem? Is this a single instance or evidence of a pattern? Does this finding represent a real risk to the organisation's objectives or is it a technical point with limited practical consequence?
Good judgement does not mean downgrading findings to keep the auditee happy. It means applying appropriate weight to what you have found based on evidence, context, and professional knowledge. A nonconformity that looks minor in isolation may be significant when viewed against the organisation's risk profile, its history of similar issues, or the potential consequences of failure.
Equally, good judgement means not over inflating observations into major nonconformities because you want to look thorough. Grading findings accurately is part of due professional care. If you are unsure how to classify what you have found, our article on audit findings, observations, and nonconformities walks through the distinctions clearly.
Recognising the Limits of Your Competence
Judgement also means knowing when you are out of your depth. If you are auditing a highly technical process and you lack the knowledge to evaluate whether what you are seeing is adequate, due professional care requires you to acknowledge that limitation. This might mean requesting a technical expert to accompany you, seeking guidance from a more experienced auditor, or being transparent in your report about the boundaries of your assessment.
Pretending to understand something you do not, or worse, issuing a finding based on a misunderstanding of the technical requirements, is a failure of due professional care. Competent auditors know their limits and manage them openly.
Staying Objective When It Is Uncomfortable
One of the most demanding aspects of judgement is maintaining objectivity when circumstances push you toward a more convenient conclusion. The auditee is friendly and clearly stressed about the audit. The organisation has made genuine effort to improve. The finding is going to cause a difficult conversation. The client wants a clean report.
None of these factors should change what you report. Due professional care requires you to present your findings accurately regardless of the social or commercial pressure around you. This connects directly to the principles of fair presentation and integrity, but it also sits at the heart of professional care. An auditor who softens a finding because of relationship dynamics has not exercised due professional care. They have exercised conflict avoidance.
Due Professional Care Across the Audit Lifecycle
During Planning
At the planning stage, due professional care means setting objectives that are genuinely focused on what matters, allocating enough time to cover the scope properly, and designing your checklist or audit plan to probe the areas of highest risk rather than the areas of greatest convenience.
It also means being clear about what the audit can and cannot achieve. If the scope is too narrow to draw meaningful conclusions, say so. If the time allocated is insufficient to audit the process adequately, raise it with the audit programme manager before you start rather than after you have delivered a shallow report.
During Evidence Collection
We have covered sampling and following leads above. There is one more dimension worth addressing: documentation. Diligent auditors record their evidence as they go. Not a summary at the end of the day, not a vague note that says records reviewed, but specific references to what was seen, what was asked, and what was observed.
Good audit notes are the foundation of defensible findings. If a finding is challenged, you need to be able to point to the specific evidence that supports it. If you cannot, the finding is vulnerable regardless of whether your professional instinct was correct. Record keeping is not a bureaucratic exercise. It is part of exercising due professional care.
During Reporting
At the reporting stage, due professional care means presenting your conclusions accurately, completely, and in a way that reflects the evidence you gathered. It means not burying significant findings in diplomatic language that obscures their severity. It means not padding the report with minor observations to compensate for a lack of substantive findings.
It also means being precise about what you found and what you did not assess. If you did not audit a particular process or area because it fell outside the scope or you ran out of time, say so clearly. Ambiguity in a report can create false assurance. False assurance is a failure of professional care.
In Follow Up
Due professional care does not end when you submit the report. If you are responsible for verifying corrective actions, verify them properly. Check that the root cause has been addressed, not just that a corrective action form has been completed. If the evidence of correction is inadequate, say so rather than closing the finding to tidy up the paperwork.
Exemplar Global Recognised Training ProviderRTP No. 310970Common Failures of Due Professional Care
Understanding where auditors fall short is as useful as understanding the principle itself. Here are the patterns that come up most often in practice.
- Checklist dependency: Ticking boxes without genuine inquiry. The checklist becomes the audit rather than a tool to support it. The auditor asks the questions on the list and accepts the first answer without probing.
- Evidence acceptance without verification: Taking documents at face value without cross checking them against practice. A procedure says one thing. The floor does another. The auditor never notices because they never left the meeting room.
- Relationship bias: Softening findings because the auditee is cooperative, senior, or visibly anxious. Professionalism requires reporting what you found, not what will cause the least friction.
- Time pressure shortcuts: Rushing through the last process on the schedule because you are running late. Allocating five minutes to an area that warranted thirty. Skipping follow up questions because the closing meeting is in an hour.
- Inadequate note taking: Relying on memory rather than contemporaneous records. This is particularly risky on multi day audits where the volume of information makes accurate recall unreliable.
- Overconfidence in familiar industries: Assuming you know what you will find because you have audited similar organisations before. Every audit is different. Familiarity breeds complacency.
Building Due Professional Care Into Your Practice
Due professional care is not a switch you turn on at the start of an audit. It is a habit built through deliberate practice and honest self reflection. After each audit, ask yourself whether you prepared adequately, whether your sampling was representative, whether you followed every significant lead, and whether your report accurately reflects what you found. If the answer to any of those questions is no, identify what got in the way and address it before the next audit.
Seek feedback from auditees and from more experienced auditors who have observed your work. Feedback is uncomfortable but invaluable. The auditors who improve most quickly are those who treat every audit as a learning opportunity rather than a performance to get through.
Continuing professional development also matters here. Staying current with the standards you audit against, understanding how audit practice is evolving, and building your technical knowledge in the industries you audit all contribute to your ability to exercise sound judgement. Our article on the ISO 19011 audit principles provides a useful foundation for understanding where due professional care sits within the broader framework of auditing ethics and conduct.
If you are building your auditing skills and want structured training that emphasises practical competence rather than just passing an exam, Audit Workshop offers Internal Auditor and Lead Auditor courses across ISO 9001, ISO 14001, and ISO 45001. The training is built around real audit scenarios and is designed to develop the kind of judgement and diligence this article describes. You can explore the available courses at auditworkshop.com.
