Fundamental audit concepts and principles
Domain 3 covers the vocabulary and principles in ISO 19011:2018 and ISO/IEC 17021-1. These are cheap marks that candidates lose by jumping straight to clause knowledge.
Definitions that must be exact
- Audit: a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled.
- Audit criteria: the set of requirements used as a reference - ISO 13485, applicable regulations, and the organization's own procedures.
- Audit evidence: records, statements of fact or other information that is verifiable and relevant to the criteria.
- Finding: the result of evaluating collected evidence against criteria; it can be conforming or nonconforming.
- Client vs auditee: the client commissions the audit; the auditee is audited. For an internal audit these are often different people.
The seven principles (ISO 19011:2018)
Integrity; fair presentation; due professional care; confidentiality; independence; evidence-based approach; risk-based approach. Independence is the one examiners probe: auditors must not audit their own work, and under ISO/IEC 17021-1 the certification decision must be taken by someone not involved in the audit.
Types of audit
First party (internal), second party (supplier or customer), third party (certification). Certification follows a two-stage initial audit, surveillance at least once a calendar year, and recertification before the three-year cycle expires.
Worked example
A QA manager asks an auditor to look at the CAPA file her own team wrote. Accepting breaches independence: any finding would be challengeable, and in a certification body it is an impartiality threat that must be recorded and managed rather than absorbed silently.
Traps that cost marks
Calling an observation a nonconformity; grading findings without agreed criteria; confusing an audit programme with an audit plan; forgetting that audit evidence must be verifiable, not merely plausible.