Audit Fundamentals, Principles and Audit Programme Management (ISO 19011)
Definitions candidates muddle
An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria. Audit criteria are the requirements used as a reference (ISO 14001, legal requirements, the organisation's own procedures); audit evidence is verifiable information; findings are the result of evaluating evidence against criteria; conclusions are the outcome of the audit as a whole. The client commissions the audit; the auditee is audited. They may be different organisations.
Seven principles (ISO 19011:2018)
Integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach. The last was added in 2018 - expect questions on what it means: audit effort concentrated where risk of nonconformity or of environmental harm is greatest, and audit programme risks identified and managed.
Programme versus plan
The audit programme is the set of audits planned for a defined time frame and purpose (for example, a rolling three-year internal schedule). Managing it covers objectives, risks and opportunities, extent, resources, procedures and records (clause 5). The audit plan is the plan for one audit - dates, routes, team allocation, criteria. Confusing the two is the most common exam error.
Audit types
First-party (internal, may be used for self-declaration), second-party (supplier/customer), third-party (certification, accreditation). A combined audit is one audit of two or more disciplines; an integrated audit is one audit of a single management system built to multiple standards; a joint audit uses two or more auditing organisations.
Rule of thumb: if the scenario describes a document that lists all audits for the next 12 months, it is the programme; if it lists times and interviewees for next Tuesday, it is the plan.