The policy states that access is reviewed quarterly. The procedure exists, the person responsible is designated, the checklist item closes itself. When I ask for the system’s technical log, the last actual review was nine months ago. No step in the audit plan required that log. Judgement required it.
I call this the order of the profession · the auditor precedes the method. The method makes the audit legible to third parties. Judgement determines what to examine when the method runs out of questions. An auditor is someone who knows that a completed checklist is still not the truth.
What the method resolves
The method has documented authorship · ISO 19011 for management systems auditing, the IIA Global Standards for internal auditing and ISO/IEC 17021-1 for certification. These are published frameworks, subject to formal review. They structure evidence gathering, sampling, documentation of findings and closure.
The method also serves a function that no individual practice can replace · it makes the audit legible to third parties. Without method, two auditors facing the same case produce two incompatible audits. With method, a third party can reconstruct what was examined, against which criterion and with what result. Legibility is the public half of the profession.
What professional practice resolves
Professional practice has accumulated authorship · organisations read, minutes reviewed, incidents reconstructed and an operational memory of what tends to fail. It cannot be downloaded. It is built through cases, supervision and sustained signing responsibility.
Practice resolves questions the method does not ask · what question the committee is avoiding, what evidence is missing when everything appears to comply, where the risk that no one inventoried is concentrated. Triangulation is the clearest example of the order between the two. The method requires cross-checking documents, logs and testimony; judgement determines what to do when the three sources say different things. Sources diverge when the problem is poorly framed · that is why the expert response is often to reframe the question, not force the finding. Without that judgement, the finding is an opinion issued with decorative methodology.
The case the method does not call for
I return to the opening scene · it is the case this criterion owes the reader. The sampling plan closed the item with two pieces of evidence · the current policy and the interview with the person responsible. Both were in order. The departure consisted of requesting a third piece that the plan did not require · the machine log, with the actual date of the last access review. Nine months against the stated three. The finding existed because judgement required reading the distance between the map and the territory. The policy states one frequency, the system records another · auditing means reading that distance with technical honesty.
The reverse case is public and has been sanctioned. APAS concluded that there had been professional breaches in the Wirecard audits: it imposed a fine of 500.000 euros on the firm, individual fines on five auditors and two years without new engagements from public-interest entities (APAS, 2023). The case file does not allow for a comfortable reading: working papers can exist while professional judgement continues to fail.
The two scenes are the same thesis with opposite signs. When practice comes first, the auditor enters with questions and uses the method to support them. When method comes first, the auditor enters with lists, the organisation learns to present what the list is looking for, and the system confirms itself.
From that order comes the auditor’s second job, the one no contract spells out · beyond verifying conformity, the auditor sees in advance the crisis the organisation has not yet named. It is prevention disguised as review.
The broken ladder
This decade’s question has two levels. The first · when the method is an AI copilot that pre-fills the checklist, the risk changes scale. The copilot produces method without judgement at machine speed · it completes the items, drafts plausible findings, closes the working paper. Everything becomes legible. What it leaves undone is precisely what defines the auditor · asking for the log the plan did not require. The tool accelerates the public half of the profession and leaves the other untouched. That is why the signature remains human.
The second level is less visible. If the tool absorbs junior work, it also reduces the space where people learn to review minutes, cross-check logs and make mistakes under supervision. The profession needs to decide where it will train those who, ten years from now, must recognise when the plan is no longer enough.
The judgement test
Three interview questions before hiring an auditor · each with its expected answer.
Question one · ask them to describe an audit where the method was not enough. Expected answer · a specific case, with the technical decision they made and the reason departing from the plan was the right thing to do · process, year and outcome. Anyone who answers in generalities, or claims that the method is always enough, has not yet been where the method ends.
Question two · ask them for three patterns that predict future nonconformities in your sector. Expected answer · patterns of their own, expressed in field terminology and tied to cases. The threshold is specificity · someone who repeats patterns from training material has method; someone who names those they learned by observing has professional practice.
Question three · ask them to recount what they did when they detected something the organisation preferred not to examine. Expected answer · they maintained the question, documented the finding and accepted the cost of discomfort. A proud description of how they avoided conflict answers a different question · how much their signature is worth under pressure.
The order of the profession can be verified in a conversation and is built over twenty years in the field. The organisation that hires an auditor hires that order · first judgement, then the instrument that makes it legible.