Auditing Fundamentals, Principles, and Types of Audits
The definition that answers half the exam
An audit is a systematic, independent, and documented process for obtaining objective evidence and evaluating it objectively against audit criteria. Four words carry the weight: systematic (planned, sampled, repeatable), independent (free of bias and of auditing your own work), documented (evidence and conclusions recorded), and criteria (regulations, standards, SOPs, contracts - never the auditor's personal preference).
Types you must be able to distinguish
- By relationship: first-party (internal), second-party (supplier, contract manufacturer, sterilizer), third-party (notified body, certification body, regulatory inspection).
- By object: system, process, product, and - in mature programmes - data or software-system audits.
- Adjacent activities that are NOT audits: inspection (examining product, facilities, or people), gap analysis, readiness assessment, and verification of a single corrective action.
Principles
Integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach, and a risk-based approach. Independence does not require being external: an internal auditor is independent when they did not perform the work being audited. A consultant likewise cannot audit a system they designed or implemented.
Traps
- Calling a plant walkthrough, a gap analysis, or an inspection an audit.
- Confusing criteria (the requirement) with evidence (the proof).
- Assuming “independent” equals “third party.”
- Believing a good outcome proves a good system - audits judge conformity, not luck.
Rule of thumb
Before accepting that an activity is an audit, ask three questions: is there a documented criterion, is there sampled objective evidence, and will an independent person draw a conclusion from it? If any answer is “no,” it is something else.