Audit fundamentals, professional standards, and auditor roles
The definition is the exam
An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria. Most fundamentals questions test one of those words. Remove independent and you have a self-assessment; remove criteria and you have an opinion; remove documented and you have a conversation.
Roles and the independence trap
The auditor gathers and weighs evidence and reports conclusions. The auditee owns the risk and the corrective action. The client (audit sponsor) sets the objective and receives the report. Audits may be first-party (internal), second-party (supplier or customer) or third-party (certification body, regulator). The classic trap: a candidate who designed the continuity plan, wrote the exercise, or previously managed the function now audits it. Competence is not a substitute for objectivity - the right answers are recusal, a separate team, or a technical expert used as a non-voting adviser.
Auditor versus consultant
An auditor may report that a control is absent and state the risk. Recommending a specific product, drafting the plan, or instructing on implementation converts the audit into consultancy and destroys the independence needed for the next cycle. Observations and good-practice suggestions are acceptable when clearly separated from findings; designing the remedy is not.
Professional standards
Expect ethics - integrity, fair presentation, due professional care, confidentiality - plus evidence-based and risk-based approaches, competence, and protection of information obtained. Findings must rest on evidence, and judgement must be free of bias, including the bias toward "no findings" to preserve the relationship.
Rule of thumb: if the auditor built it, approved it, or owns the risk it mitigates, they cannot audit it.