Audit principles, audit types and the audit programme (ISO 19011)
Definitions and principles
An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. Learn the trio: audit criteria (the requirements used as a reference), audit evidence (records, statements of fact, observations) and audit findings (the result of evaluating evidence against criteria).
ISO 19011:2018 sets out seven principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach. Nearly every scenario question can be resolved by testing the answer against one of these.
Types
The classic distinction is by party: first-party (internal), second-party (performed by an interested party, such as a customer or its agent auditing a supplier) and third-party (certification and accreditation). Audits are also classified by object - system, process or product - and may be combined (one audit covering two or more management systems) or joint (two or more auditing organizations auditing one auditee).
The audit programme (ISO 19011 clause 5) is the set of arrangements for a group of audits over a period: objectives, extent, resources, procedures, schedule and monitoring, managed with PDCA and prioritised by risk.
Traps
An internal audit outsourced to a contracted external auditor is still first-party; programme is not the same as an individual audit plan; and independence means freedom from bias and from auditing one's own work, not working outside the organization.
Rule of thumb: ask "who commissioned the audit and who receives the result?" - the answer fixes the party type every time.