Audit fundamentals: principles, types, objectives and auditor competence
This domain tests whether you can distinguish audit types, state objectives in operational terms, and judge whether a nominated auditor is competent and independent for a given audit. ISO 19011:2018 is the reference for principles and competence.
The seven principles (ISO 19011:2018, clause 4)
- Integrity - the foundation of professionalism.
- Fair presentation - report findings, conclusions and reports truthfully and accurately, including significant obstacles encountered.
- Due professional care - diligence and judgement in auditing.
- Confidentiality - discretion with information.
- Independence - impartial and objective; auditors do not audit their own work.
- Evidence-based approach - conclusions only on verifiable evidence.
- Risk-based approach - focus on matters important to the client and audit objectives.
Types and objectives
A first-party audit is internal. A second-party audit is performed by an interested party, commonly a customer auditing a supplier. A third-party audit is performed by an independent external body, such as a certification body. A combined audit covers two or more management systems together; a joint audit involves two or more auditing organizations; an integrated audit is a single audit of an integrated management system. Objectives are set by the client: verify conformity with criteria, evaluate effectiveness, identify improvement opportunities, or meet certification or regulatory needs.
Competence
Competence is the ability to apply knowledge and skills to achieve intended results. ISO 19011 groups it into personal attributes (ethical, observant, perceptive, diplomatic, tenacious, decisive, culturally sensitive, collaborative) and knowledge and skills: audit principles and methods, management system standards, organizational context, applicable legal requirements, sector and technical knowledge, and risk. Lead auditors additionally need to plan, lead a team, resolve conflict and represent the audit. Competence is demonstrated through education, training, experience, audit observation and feedback - not by a certificate alone.
Worked example
A team is auditing a hazardous waste contractor. One nominated auditor was the contractor's EHS manager and left 16 months ago. Verdict: unacceptable for that audit. Independence is compromised by self-review; the auditor would be evaluating decisions they made. The sector knowledge is valuable, but the conflict is unresolved. The correct action is to replace the auditor for this audit - not to add a confidentiality agreement and proceed.
Traps
- Calling a supplier audit a third-party audit.
- Stating "find nonconformities" as the objective of every audit.
- Treating combined and integrated audits as synonyms.
- Assuming a lead auditor competent in one sector is competent in another.
- Reading independence as purely financial - prior roles and personal links matter too.