Audit Fundamentals, Standards, and Ethics
This domain tests whether you can tell an audit from an inspection, apply the ISO 19011 principles that give an audit its credibility, and act ethically when commercial pressure points the other way. Most exam items here are scenarios about conflicts of interest, independence, and objectivity rather than definitions.
Audit, inspection, assessment
An audit is a systematic, independent, documented process for obtaining objective evidence and evaluating it against audit criteria. Inspection examines product, equipment, or a lot directly. An assessment is a broader evaluation that may not follow audit rules. Audits sample processes and conclude on the management system; they never certify every unit of product.
Types: first-party (internal), second-party (supplier or customer), third-party (certification or accreditation). Internal auditors must be independent of the activity being audited, not of the entire company - a QA auditor can audit production but not their own laboratory work.
The governing principles
ISO 19011 lists seven: integrity, fair presentation, due professional care, confidentiality, independence, and the evidence-based and risk-based approaches. Certification adds impartiality rules from ISO/IEC 17021-1: a certification body cannot certify an organization to which it provided management-system consultancy within two years, and cannot audit its own training product as certification.
Worked example
An auditor arrives to audit a site's HACCP plan and the plant manager says, "you wrote this plan for us in 2023, right?" The auditor did indeed consult on it. The threat is self-review - auditing one's own work - plus the two-year cooling-off rule for certification. The correct action is to disclose to the client and the certification body, decline, and have the audit reassigned. Proceeding "carefully" or auditing everything except the HACCP plan is wrong, because the conflict taints the whole certification decision, not one clause.
Traps that cost marks
- Claiming an internal auditor must come from outside the company; independence is from the activity, not the employer.
- Treating independence as "no contact with the auditee"; it means freedom from bias and undue influence.
- Writing findings as personal blame ("the operator was careless") instead of against a criterion.
- Accepting gifts, hospitality, or a job offer without disclosure.
- Confusing the audit standard (ISO 19011 guidance) with certification requirements (ISO/IEC 17021-1).