Evidence or Inference? Sharpening Your Judgement as an Internal Auditor

Why This Distinction Matters More Than You Think

Every internal auditor eventually faces this moment. You walk out of an interview, you have a strong feeling something is wrong, but when you look at your notes you cannot point to a single piece of documented evidence that would stand up to scrutiny. You have an inference. You do not yet have a finding.

The ability to distinguish between evidence and inference is one of the most important judgement skills an auditor can develop. Get it right, and your findings are credible, defensible, and drive genuine improvement. Get it wrong, and you either raise nonconformities that collapse under challenge, or you walk past real problems because you talked yourself out of what you were seeing.

This article is about sharpening that judgement. It is aimed at practising internal auditors who want to move beyond checklist compliance and develop the kind of analytical thinking that separates competent auditors from genuinely effective ones.

Defining the Terms Clearly

What Is Audit Evidence?

ISO 19011 defines audit evidence as records, statements of fact, or other information which are relevant to the audit criteria and verifiable. That definition is deceptively simple. In practice, audit evidence comes in three forms: documents you have reviewed, observations you have made directly, and statements you have heard from interviewees.

The critical word is verifiable. Evidence is something another auditor, reviewing the same audit, could independently confirm. A signed training record is evidence. A completed inspection checklist with the auditor's name and date is evidence. A photograph of a missing label on a chemical container is evidence. These things exist in the world. They can be checked.

For a deeper look at how to gather and record different types of evidence, the article on gathering audit evidence: sampling, interviews and document review done well covers the practical mechanics in detail.

What Is an Inference?

An inference is a conclusion you have drawn from evidence, or sometimes from the absence of evidence. It is your interpretation of what the evidence means. Inferences are not inherently wrong. In fact, auditing requires inference. The question is whether your inference is justified by the evidence you have collected, or whether you are filling a gap with assumption.

Here is a simple example. You review five training records and find that two are unsigned by the supervisor. That is evidence. Your inference might be that the training sign-off process is not being followed consistently. That inference is reasonable and supportable. But if you then conclude that workers are therefore unqualified and operating equipment unsafely, you have moved well beyond what the evidence shows. That second inference requires more evidence before you can treat it as a finding.

The Danger Zone Between the Two

The danger zone is where most audit errors happen. It is the space where an auditor has a partial picture, a strong gut feeling, or a pattern that seems obvious, but has not yet gathered enough evidence to support a clear conclusion. Experienced auditors learn to sit in that zone without rushing. They keep asking questions, keep sampling, and keep testing their inference against what they are actually finding.

How Inferences Creep Into Audit Findings

Confirmation Bias in Practice

One of the most common ways inference corrupts audit findings is through confirmation bias. You arrive at a site having heard from the quality manager that the maintenance team is disorganised. Within the first ten minutes you find one overdue calibration record. Your brain immediately says: there it is. You write it up and move on.

But one overdue calibration record might be an isolated data point. It might be explained by a legitimate deviation, a replacement instrument, or an administrative error that was caught and corrected the same day. Without further sampling, you do not know. What you have is one piece of evidence and an inference shaped by a pre-existing narrative.

Confirmation bias is not a character flaw. It is a cognitive tendency that affects every human being, including experienced auditors. The discipline of evidence-based auditing is partly about building habits that counteract it.

Absence of Evidence Is Not Evidence of Absence

Another common error is treating the absence of something as proof that it does not exist. You ask a supervisor to show you the risk assessment for a particular task. They cannot find it immediately. You note it as a finding. But the document might exist in a different location, under a different name, or held by a different person. The absence of evidence in that moment is a prompt to investigate further, not a conclusion in itself.

This does not mean you accept every it exists somewhere response at face value. If you have sampled three different tasks and cannot locate risk assessments for any of them, the pattern of absence becomes evidence in its own right. Context and sample size matter.

Hearsay and Second-Hand Accounts

Interviews are an essential part of auditing, but they require careful handling. When an operator tells you that the procedure changed six months ago but nobody told us, that is a statement of fact from one person. It is a data point. It is not, by itself, a verified finding. You need to cross-reference it. Check the procedure version history. Ask the process owner. Look for training records that correspond to the change.

If the operator's account is supported by the document evidence and corroborated by a second interviewee, you now have a much stronger basis for a finding. The art of triangulating audit evidence across documents, people and observation is precisely what converts a single data point into a defensible conclusion.

Practical Techniques for Keeping Evidence and Inference Separate

Use Two Columns in Your Notes

A simple but highly effective technique is to physically separate your evidence from your interpretation as you go. Keep a running column for raw observations, direct quotes, document references, and record numbers. Keep a separate column for your working conclusions, questions to follow up, and developing inferences.

This forces you to notice when your inference column is getting ahead of your evidence column. If you have written a strong conclusion on the right but the left column only has one or two data points, that is a signal to keep digging before you commit to a finding.

Test Your Inference With a Colleague

Before you write up a finding, try articulating it out loud to your co-auditor or, in a solo audit, to yourself. Say: I am going to raise a finding that the organisation is not maintaining calibration records in accordance with clause X. My evidence is Y and Z. Then ask: would a reasonable auditor, looking only at Y and Z, reach the same conclusion?

If the answer is yes, you have a defensible finding. If you find yourself adding qualifiers like and I also had a feeling that or the supervisor seemed evasive when I asked about, you have identified the inference that needs more support.

Distinguish Between What You Saw and What You Concluded

When writing nonconformities and observations, train yourself to lead with what you observed before stating what it means. A well-structured finding reads like this: During review of calibration records for the production line, three of five instruments sampled had no record of calibration within the required 12 month interval. The most recent calibration certificate for instrument X was dated 26 months prior to the audit date. That is evidence. The conclusion, that the organisation is not meeting its calibration requirements, follows naturally and is clearly supported.

Compare that to: The calibration system appears to be poorly managed and records are not being kept properly. That is inference masquerading as a finding. It is vague, it is not grounded in specific evidence, and it will not hold up if challenged.

The article on how to write nonconformities that hold up goes into the mechanics of structuring findings in detail, and it is worth reading alongside this one.

Follow the Evidence Where It Leads, Not Where You Expected to Go

Sometimes the evidence takes you somewhere you did not anticipate. You went in to audit the corrective action process and you stumbled across a pattern of incomplete management review outputs. Do not dismiss it because it is outside your planned scope. Do not chase it so hard that you abandon your original objectives. Note it, assess whether it needs to be raised as a finding or referred to the audit programme manager, and keep your evidence column specific.

Good auditors are intellectually flexible. They follow the evidence rather than forcing the evidence to fit a predetermined conclusion.

When Inference Is Legitimate and Necessary

Pattern Recognition Across a Sample

Inference becomes legitimate when it is based on a consistent pattern across an adequate sample. If you review twelve corrective action records and nine of them have no root cause analysis documented, the inference that root cause analysis is not being performed systematically is well supported. You do not need to review all two hundred records in the system. The pattern across your sample is sufficient to draw a reasonable conclusion.

This is why sampling strategy matters so much. A sample of two tells you very little. A sample of twelve, drawn from different time periods, different process areas, and different risk levels, gives you a much more reliable basis for inference. For guidance on how to approach this, the article on audit sample sizes and how many records are enough is directly relevant.

Systemic Inferences vs Isolated Findings

One of the most valuable things an experienced auditor does is distinguish between an isolated failure and a systemic weakness. An isolated failure is a single instance where something went wrong. A systemic weakness is a pattern that suggests the underlying process or control is not functioning as intended.

Making that distinction requires inference, but it is inference grounded in evidence. You are not just saying the system is broken because one thing went wrong. You are saying that the pattern across multiple samples, combined with what you heard in interviews and what you observed in practice, suggests the control is not consistently applied. That is a legitimate and important conclusion for an auditor to draw.

Reasonable Professional Judgement

ISO 19011 expects auditors to exercise professional judgement. That means you are not required to have a photograph of every nonconformity. You are required to have sufficient evidence to reach a reasonable conclusion. The standard for sufficiency is not certainty. It is whether a competent auditor, reviewing the same evidence, would reach the same conclusion.

Professional judgement also means knowing when you do not have enough. It means being willing to say: I have a concern here but I need more evidence before I can raise it as a finding. That intellectual honesty is a mark of a mature auditor.

Red Flags That You Are Operating on Inference Rather Than Evidence

Here are some warning signs to watch for in your own auditing practice:

• You cannot name the specific record, document, or observation that supports your finding. If you cannot point to it, you do not have evidence for it yet.
• Your finding relies on what someone told you, with no corroboration from documents or observation. Unverified interview statements are a starting point, not a conclusion.
• You are describing a general impression rather than a specific instance. Words like appears to, seems like, and generally are signals that you are in inference territory.
• You are drawing conclusions about intent or culture. Auditors assess conformance and effectiveness, not motivations. If you find yourself writing about why people are not following the procedure, you have moved beyond what the evidence supports.
• Your sample size is too small to support the conclusion you are drawing. One data point is rarely enough for a systemic finding.

Building This Skill Over Time

The evidence-versus-inference distinction is not something you master in a single audit. It develops through practice, through reviewing your own findings after the fact, and through exposure to how more experienced auditors construct and challenge findings.

One of the most useful habits you can build is to review your draft findings before the closing meeting and ask yourself: if the auditee challenges this, what is my evidence? If the answer makes you uncomfortable, revise the finding or go back and gather more evidence before the closing meeting.

Peer review of audit reports is another powerful tool. Having a colleague read your findings and ask what is the evidence for this? will quickly surface any inferences that have crept into your conclusions.

If you are looking to build these skills in a structured environment, Audit Workshop's internal auditor and lead auditor training courses are designed around practical audit scenarios that specifically develop this kind of analytical judgement. The training is built by someone who has conducted over 500 external certification audits across multiple industries and standards, so the scenarios reflect real-world complexity, not textbook simplicity. You can explore the available courses at auditworkshop.com.