Auditing Fundamentals
What you must know
Understand the audit definition: a systematic, independent, documented process for obtaining objective evidence and evaluating it against audit criteria. Know the three audit types - first-party (internal), second-party (supplier/customer), and third-party (independent certification body) - and their different purposes. Distinguish an audit from an inspection (product-focused) and a surveillance activity. Master the principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach. Know roles: the client sets scope, the audit team leader plans and reports, auditors collect evidence, and auditees provide access and cooperate. Understand findings classification - conformities, nonconformities (major/minor), observations, and opportunities for improvement.
Traps in questions
A common trap is confusing independence with objectivity: an auditor cannot audit their own work, but independence is about freedom from bias and conflict, not physical distance. Another is mislabeling a minor nonconformity (isolated lapse) as major (systemic breakdown or unmet requirement with significant risk). Questions may also misstate who owns the audit programme - that is the client/top management, not the auditor. Watch for claims that auditors must "fix" problems; they report, they do not implement corrective action.
Worked example / rule of thumb
An internal auditor is asked to audit the department they managed last year. Correct answer: decline for independence reasons; the audit is reassigned. Rule of thumb: if you can influence the outcome you are auditing, you are not independent.
Exam angle
Match each principle and role to a scenario; the distractor usually swaps responsibilities between client, team leader, and auditee.