Summary
4Cs) model provides a practical lens through which the auditor or Assessor can validate documented information before accepting it as objective evidence of conformity in accordance with the international standards. The model is based on four considerations: the Documented Information should be Correct, Complete, Current, and Consistent. It concludes that the quality of auditing is measured by the standardization of the lens through which evidence is examined before a judgment is made on it.
Introduction
The (4Cs) Model for Evidence Verification
What is striking about the nature of the relationship between knowledge and experience is that they are intertwined and reciprocal to such an extent that it is difficult to determine which has the greater influence on the growth of the other! Nevertheless, it is important—in any case—to recognize that knowledge alone is not sufficient to achieve sustainable value in the field of auditing and assessment in accordance with the requirements of management systems and accreditation associated with international standards. Experience inevitably results from practicing and applying the knowledge we acquire; then, the experience gained in itself drives us to establish new, specialized knowledge arising from the arts and practices generated by accumulated experience. And so, the cycle continues.
Auditors and Assessors need continuous capability development through the ongoing acquisition of professional arts and practices, in addition to the established knowledge and skills acquired through recognized learning pathways. The arts of auditing and assessment remain that human dimension which continues to evolve and enables experienced practitioners to transfer their expertise and impart it to others. This is an intrinsic value that should be preserved in our professional character, away from purely “business” considerations. I believe it has a significant role in building the reputation and impact of experts and consultants who possess both concern and determination.
Here, I will attempt to transform one of these professional arts into documented knowledge that may contribute to supporting our colleagues involved in auditing and assessment processes, whether experienced practitioners or newcomers to the profession. Here, then, is the (4Cs) model, derived from the guidance of our primary references in the field of auditing and reviewing management systems in accordance with the international standard SO 19011:2026.
We should recognize that auditing and assessment processes in the fields of management systems and accreditation are not merely a matter of ticking boxes on a checklist. The real moment begins when documented information appears before you in the form of a document, evidence, a system, a record, or otherwise—electronically or manually—and the question then becomes: Is this evidence worthy of having a judgment based upon it?
International standards issued by ISO do not merely require “documented information”; they implicitly assume that such information is suitable to serve as objective evidence of conformity and that it can be verified, as stipulated by the principle of evidence-based auditing. This condition is what the auditor’s or accreditation assessor’s practical experience tests—not the text alone—and this is what distinguishes professional judgment from mere formal verification.
Based on practice, and with reference to the international standard, four considerations can be summarized that determine whether any documented information—whether a document or a record—may be accepted as objective evidence. Together, they form a simple model I have called (4Cs) so that it can be easily used and recalled from memory when needed.
- Correct: Here, the auditor/assessor should ensure that the document or other item being examined is fundamentally correct in both form and substance, and that its content conforms to the requirements and criteria targeted by the audit and assessment.
Example: A calibration record that refers to a device using specifications that do not match its actual specifications; a procedures manual that refers to an incorrect clause in a regulation or standard; or a document that appears formally sound but is, in essence, misleading and could lead its reader to an incorrect conclusion if taken at face value. - Complete: This means that it contains all the elements and data necessary to fulfill the purpose for which it exists.
Example: A nonconformity report that does not include an analysis of the root causes of the case; reports for a training program that include the results of trainee satisfaction measurements but contain no analysis of those results or evaluation of training effectiveness; or two documents that appear complete in form but are missing certain data, rendering them insufficient as evidence. The fundamental question of how conformity with the requirement is achieved therefore remains without a documented answer. - Current: This means that the documented information is valid for use and that the version being used is the current version at the time of use, rather than an earlier version. This is a common issue that reveals weaknesses in document control more than it reveals an incidental error, and it warrants auditing the mechanisms of distribution and withdrawal, not merely the content itself.
Example: Work instructions being used at the workplace while the electronic system contains a version that is several months newer. - Consistent: This means, first, that the document contains information that is internally consistent with the rest of the information within it in a logical manner; and second, that the document is also consistent with any other related documented information within the management system subject to auditing and assessment.
Example: A procedures manual assigns a procedure to a job title in a way that contradicts the roles and responsibilities matrix contained in the same manual (internal inconsistency); or assigns the procedure to a position in a way that conflicts with the duties and responsibilities stated in the job description (external inconsistency); or corporate risk registers fail to adhere to the approved risk classification stated within the same register (internal inconsistency); or those same risk registers make no mention of any risks or opportunities resulting from an analysis of the organization’s operating context (external inconsistency).
This type of discrepancy often reveals weakness in the integration of the system’s own components and is a deeper indication than the mere unsuitability of documented information as objective evidence of a particular requirement. It therefore warrants further tracing and investigation rather than merely being observed and recorded.
(4Cs) model should not be treated as an additional checklist that burdens the work of auditors and assessors. Rather, it is one of the professional arts of assessment, providing us with a single lens through which we examine the evidence presented before considering it sufficient objective evidence that a requirement or criterion has been fulfilled.
The absence of any element of our model may not necessarily indicate a Nonconformity Report (NCR) case, but it means that the targeted requirement or criterion requires further verification before a direct judgment can be made. The auditor or assessor should therefore look a little deeper before approving the conclusion.
The quality of auditing and assessment -my friend- is not measured by the quantity of documented information and practices that have been verified, but by the standardization of the lens through which they have passed. This is what gives the “evidence verification process” in auditing and assessment a meaning that goes beyond form and reaches value.
References
- ISO 19011:2026 - Guidelines for auditing management systems
- ISO 9000:2026 - Quality management systems: Fundamentals and vocabulary
- ISO 9001:2015 - Quality management systems: Requirements
- ISO/IEC 17021-1:2015 - Requirements for bodies providing audit and certification of management systems
- ISO/IEC 17011:2017 - Requirements for accreditation bodies