CBCA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Audit definition per ISO 19011

A systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled.

Audit criteria

The set of policies, procedures, requirements or standards used as a reference against which objective evidence is compared to determine conformity during an audit.

Audit evidence

Records, statements of fact or other information relevant to the audit criteria that are verifiable and can be used by auditors to reach audit findings.

Independence principle

Auditors must be independent of the activity being audited wherever practicable and free from bias or conflict of interest throughout the audit process and reporting.

Three audit types

First-party audits are internal audits by the organisation; second-party audits examine suppliers or partners; third-party audits are performed by external certification bodies or regulators.

Lead auditor responsibilities

The lead auditor manages the audit, allocates work, represents the team with the client, resolves issues, and signs the audit report and its conclusions.

Technical expert role

A technical expert provides specialised knowledge or experience to the audit team but does not act as an auditor and carries no audit authority.

Audit programme definition

A set of one or more audits planned for a specific time frame and directed at a specific purpose, including schedules, resources, objectives and criteria.

Risk-based audit frequency

Audit frequency and depth are set by risk, so processes with higher impact, weaker audit history or recent change are audited more often.

Audit scope statement

Defines the boundaries of an audit, including organisational units, locations, processes, the time period covered and any stated limitations or exclusions.

Audit plan contents

Objectives, scope, criteria, dates, locations, team roles, sampling approach, documents to review and the schedule of audit activities for a single audit.

Audit sampling risk

Sampling examines less than the full population, so auditors must document the approach and accept that some nonconformities may go undetected.

Programme risk inputs

Inputs to a risk-based audit programme include BIA criticality, previous findings, incident and exercise results, organisational change and regulatory obligations.

Opening meeting purpose

Confirms the audit plan, scope, criteria, communication channels, roles and logistics with the auditee, and resolves objections before evidence collection begins.

Evidence sources hierarchy

Records and direct observation are stronger evidence than interview statements alone; auditors corroborate verbal statements with documents or with observed practice.

Observation versus interview

Observing an activity as actually performed gives evidence of real practice, while interviews give explanations; both are triangulated against records.

Nonconformity definition

A non-fulfilment of a requirement in the audit criteria, supported by objective evidence that the system or practice did not meet the stated requirement.

BIA audit trail

Auditors trace business impact analysis outputs into recovery priorities in plans, and verify that stated RTOs are supported by impact and dependency data.

Exercise record review

Exercise records should show objectives, scenario, participants, date, results and action items, and auditors verify those actions were tracked to closure.

Evidence documentation rules

Each finding cites the criterion and the evidence source, such as document identifier, date and interviewee role, so another auditor can verify the conclusion.

Mandatory audit report contents

Per ISO 19011, reports include audit objectives, scope, client and team, dates and locations, criteria, findings, conclusions and degree of fulfilment of criteria.

Finding structure

A well-written finding states the requirement, the evidence found and the resulting gap, so it is unambiguous, traceable and verifiable by the auditee.

Major nonconformity

A nonconformity affecting the capability of the management system to achieve its intended results, or a systemic failure of a required element of the standard.

Correction versus corrective action

Correction fixes the immediate observed problem; corrective action eliminates the root cause so that the nonconformity does not recur in future.

Follow-up verification

Auditors verify that corrective actions were implemented and effective before closing a finding, using evidence such as revised documents or completed exercise results.

Audit conclusion

The audit conclusion states overall conformity with the criteria, the effectiveness of the BCMS, and whether corrective action or further audit activity is required.

RTO definition

The recovery time objective is the target time set for resuming an activity or resource after disruption, and it must be shorter than the maximum tolerable period.

MTPD definition

The maximum tolerable period of disruption is the time by which unacceptable impacts to stakeholders would arise if the activity were not resumed.

MBCO definition

The minimum business continuity objective is the minimum level of products or services acceptable to the organisation and its stakeholders during a disruption.

ISO 22301 clause 8 elements

ISO 22301 clause 8 requires business impact analysis and risk assessment, continuity strategies and solutions, plans and procedures, an exercise programme and evaluation of continuity capability.

Exercise programme requirement

ISO 22301 requires a documented exercise programme that is planned, conducted, evaluated and used to improve continuity capability, with results fed into corrective action.

Internal audit clause 9.2

ISO 22301 clause 9.2 requires internal audits at planned intervals to determine whether the BCMS conforms to the organisation's own requirements and the standard, and is effectively implemented.