Audit principles, audit types and the audit programme
This domain tests how you select audit types and build, run and review an audit programme, and whether you can keep programme-level decisions separate from plan-level ones.
Core rules and concepts
- ISO 19011:2018 lists seven audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach.
- Audit types: first party (internal, feeding management review and improvement), second party (supplier, contractor or outsourced process, driven by contract), third party (certification body, regulator or other independent body).
- Attributes: a combined audit covers two or more management systems against their respective criteria; a joint audit involves two or more auditing organisations; an integrated audit treats an integrated management system as one object.
- The audit programme (ISO 19011 clause 5) sets objectives, risks and opportunities, extent, schedule, resources, and its own monitoring and review. It belongs to the programme manager, not the team leader.
- An audit plan is per-audit - dates, areas, auditors, time. An audit programme is the multi-audit portfolio. Keeping these apart is a favourite exam distinction.
- For certification, ISO/IEC 17021-1 governs: two-stage initial audit (stage 1 readiness, stage 2 implementation and effectiveness), surveillance at least once a year within 12 months of the last day of stage 2, and recertification before the three-year cycle expires.
- Programme content is risk-based: incident history, complexity, legal exposure, prior findings, complaints, contractor intensity, shift patterns and multi-site sampling all justify more or less audit time.
Worked example
A construction contractor has a head office, two permanent yards and 14 project sites, plus a fatal fall in the past year. Programme decisions: shorten surveillance intervals, add site-specific checks on work at height and contractor induction, and sample sites by risk rather than round-robin. Each audited site's legal compliance is checked on site, not inferred from head-office documents. The November audit plan then allocates two days to the two highest-risk sites and half a day to head office - the plan executes the programme's risk decisions.
Traps that cost marks
- Confusing programme with plan in a scenario question.
- Calling an internal audit 'third party' because an external consultant performed it.
- Assuming unannounced audits are an ISO 45001 requirement - they are a scheme decision.
- Sampling only head office and calling a multi-site organisation covered.