Auditing Fundamentals
What you must know
An audit is a systematic, independent, documented process for obtaining objective evidence and evaluating it objectively against audit criteria. Learn three ways to classify audits. By party: first-party (the organization audits itself, i.e., internal audit), second-party (a customer or contracted representative audits a supplier), third-party (an independent body such as a certification body, registrar, or regulator). By object: system, process, or product audit. By purpose: compliance, effectiveness, supplier qualification, certification, or surveillance.
Separate the vocabulary cleanly. Audit criteria are the requirements used as a reference (standards, SOPs, contracts, regulations). Audit evidence is what you find (records, statements, observations). Audit scope is the extent and boundaries; audit objectives are what the audit is supposed to achieve. The ISO 19011 principles are integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach, and a risk-based approach. Independence means auditors do not audit their own work; objectivity is the mindset that flows from it.
Traps that show up in questions
- Confusing inspection with audit: inspection judges product or lots; an audit judges processes and systems against criteria.
- Assuming third party always means regulator; certification bodies count too.
- Believing an audit proves conformity. Auditors sample, so they provide assurance, not proof.
- Mixing criteria (what should be) with evidence (what is).
- Calling a surveillance audit first-party; it is normally a third-party follow-on.
Rule of thumb
Classify by asking who benefits commercially: the organization itself is first party, the customer is second party, and a body with no direct commercial stake is third party. Example: a plant quality team audits its own sterilization process against internal SOPs, so it is a first-party process audit with the SOPs as criteria.