1.3Auditor independence, professional ethics, and objectivity

A systems audit's findings and opinions are trusted because the auditor is independent of the audited target and evaluates from a fair, unbiased position. This independence has two aspects, and both are required: the auditor's own inner attitude, independence in mind (substantive independence), and being recognized as independent by a third party, independence in appearance (formal independence). This section develops not the rote memorization of "what is independence," but the ability to spot, in a concrete situation (such as being asked to audit a system one helped build), whether independence is impaired, and to judge how the auditor should act.

1.3.1Independence in mind and independence in appearance

• Independence in mind (substantive independence) is the auditor's inner attitude to make objective, fair, and unbiased judgments unswayed by external pressure or their own interests. Even if formally independent, if deference to the audited department or the auditor's own interests distorts judgment, independence in mind is lacking.
• Independence in appearance (formal independence) is a state in which the auditor is objectively recognized as independent of the audited target even from a third party's viewpoint. Even if the audit is actually fair, facts such as having been the audited department's former manager or the developer of the audited system cause external doubt about independence, undermining trust in the audit results. An audit requires both kinds of independence.

1.3.2Objectivity, professional ethics, and due professional care

• Objectivity means judging based on facts and evidence, without bias toward preconceptions or a particular position. An audit opinion must be backed by the obtained audit evidence, not the auditor's subjective impression. Professional ethics are the norms an auditor must observe as a professional—confidentiality (not disclosing information learned in the audit without just cause), integrity, and maintaining and improving professional competence.
• Due professional care means the auditor plans, executes, and reports the audit exercising the care a professional should naturally take. Independence, objectivity, and due care, if any is lacking, cause the credibility of the audit itself to collapse, so the auditor must recognize on their own a situation that impairs independence and, where applicable, take measures such as recusing from the audit assignment or declining to undertake the audit work.

Suppose you are a systems auditor in an internal audit department who transferred from the information systems department, and for next year's audit plan you are approached to take charge of auditing "the new sales-management system you yourself deeply engaged in—requirements definition and acceptance testing—and brought into service last year." Thinking "I know this system best, so I'm the right person" is natural, but a problem of independence lurks here. You are a party who was personally involved in building this system, and evaluating it in the audit would substantively mean evaluating your own work. Even if you sincerely attempt a fair evaluation (i.e., try to maintain independence in mind), objectively negating the validity of the requirements definition and acceptance decisions you yourself made is psychologically difficult, and independence in mind may be impaired. More serious is independence in appearance: from a third party's viewpoint (management, other departments, external parties), the mere fact that "the development party is auditing their own deliverable" causes the objectivity and credibility of the audit results to be doubted. The correct judgment, therefore, is not "I'm the right person because I know it well," but to declare that you lack independence regarding this audit target and recuse yourself from the assignment (another auditor takes charge, or an external audit is used). If your knowledge must be leveraged, limit it to providing information as a reference witness rather than as the auditor, arranging for an independent, separate auditor to perform the evaluation and express the opinion. Do not dispose of an independence problem on self-assessment alone that "I can do it fairly, so it's fine"—the core of the auditor's professional ethics is to make whether one is recognized as independent by a third party, including independence in appearance, the criterion for judgment.

1.3.3Section summary

• Independence has both independence in mind (a fair, unbiased inner attitude) and independence in appearance (a state recognized as independent by a third party); both are required
• Someone personally involved in the audited work lacks independence—it is appropriate to recuse from an assignment structured as auditing one's own deliverable
• An audit opinion is backed by audit evidence, not subjective impression (objectivity); maintaining professional ethics, confidentiality, and due care underpins the audit's credibility