Audit fundamentals and the principles of auditing (ISO 19011)
Definition
An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. Systematic means planned and consistent; independent means free from bias and conflict of interest; documented means the process and its results are recorded.
Audit types
First-party (internal) audits serve the organisation's own assurance and are required by clause 9.2. Second-party audits are performed on suppliers or partners. Third-party audits lead to certification or accreditation. Independence is a matter of objectivity, not of employment status - an internal auditor must not audit their own work.
The seven principles (ISO 19011:2018)
Integrity; fair presentation; due professional care; confidentiality; independence; evidence-based approach; risk-based approach. Learn them precisely: 'fair presentation' means reporting findings, conclusions and any significant obstacles truthfully, including divergent auditor opinions; 'evidence-based' means samples are verifiable and traceable; 'risk-based' means effort is directed where it matters most.
What auditing is not
An audit is not consultancy and not an inspection. An auditor gathers evidence and evaluates conformity; designing controls or prescribing solutions compromises impartiality, particularly in certification audits. Auditors may report facts and their consequences, but should not propose remedies.
Traps
- Confusing the principles with ISO 9001 quality principles - they are different lists.
- Assuming 'independent' necessarily means 'external'.
- Accepting an assertion ('we always do it that way') as objective evidence.
Worked rule of thumb
Before writing any finding, test it against three principles: is it evidence-based (traceable record), fairly presented (no exaggeration, both sides considered), and risk-based (does it matter to the ISMS's intended outcomes)? If any answer is no, rework the finding.