Auditing Fundamentals
What the candidate must know
Auditing fundamentals establish the vocabulary and logic that the rest of the exam assumes. A quality audit is a systematic, independent, and documented process for obtaining objective evidence and evaluating it against audit criteria to determine the degree of conformity. Distinguish the three audit types: first-party (internal, performed by or for the organization on itself), second-party (performed on a supplier or other interested party, often by the customer), and third-party (independent external body, e.g., certification). Know the difference between an audit criterion (the requirement: standard, procedure, contract, regulation), objective evidence (records, statements, observations verifiable), finding (result of evaluation), and conformity/nonconformity.
Understand the audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach. Independence means freedom from bias and conflict of interest, not that an auditor must be an outside firm.
Traps
Questions often swap correction (fix the immediate problem) with corrective action (eliminate the cause). Another trap conflates audit scope (what is covered: processes, locations, period) with criteria (what it is judged against). Watch for items implying internal auditors cannot audit their own work - they cannot; independence is compromised. Also, an audit is not a fault-finding exercise; the purpose is verification and improvement.
Worked example / rule of thumb
Rule of thumb: Criteria + Evidence → Finding. If a question gives you a requirement and an observation but no comparison, it is not yet a finding. Example: procedure requires calibration every 12 months; record shows 18 months. Criterion = 12-month interval; evidence = the record; finding = nonconformity. The correction is recalibrating; the corrective action is investigating why the schedule failed.