Fundamental audit concepts and principles
Definition
An audit is a systematic, independent and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled.
Principles (ISO 19011)
Integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach. These principles explain why auditors verify rather than assume, and why findings must be traceable to evidence.
Core terms
Audit criteria are the requirements used as a reference: ISO 14001, legal requirements, the organization's own procedures. Audit evidence is records, statements of fact or other information relevant to the criteria and verifiable. Findings result from evaluating evidence against criteria-conformity, nonconformity, or opportunity for improvement. The audit conclusion is the outcome after considering all findings.
Audit types
First-party (internal), second-party (by an interested party such as a customer or supplier chain), third-party (certification or regulatory).
Traps
Independence means not auditing your own work; an internal auditor may audit other functions. A nonconformity is a failure to fulfil a requirement, not a difference of opinion. 'Observation' is not a formal ISO 19011 finding category-use opportunity for improvement carefully. Audit programme and audit plan are different. Auditors verify and report; they do not consult or prescribe solutions. The absence of a finding is not proof of conformity because of sampling risk. A technical expert advises but does not audit.
Worked example
An EHS manager is the only person who runs the wastewater plant. She cannot audit Clause 8.1 for that process, even though she is the most competent person. Another trained internal auditor audits it; she audits a different area. Independence is preserved without sacrificing competence.