Fundamental Audit Concepts and Principles
Domain 3 tests ISO 19011:2018 principles and the auditor's professional judgement. You must know what an audit is, what evidence is, how findings are classified, and where independence and ethics bite.
Definitions and principles
- Audit: systematic, independent, documented process for obtaining objective evidence and evaluating it objectively against audit criteria.
- Audit criteria: policies, procedures, standards, contractual or legal requirements used as a reference.
- Audit evidence: records, statements and observations, verified by interviews, document review or site observation.
- Principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach.
- First-party (internal), second-party (supplier or customer) and third-party (certification) audits differ in purpose but share method.
- Findings: conformity, nonconformity (major or minor), observation, opportunity for improvement. Major usually means system failure or significant risk; minor is an isolated lapse.
Worked example
An auditor interviews a warehouse supervisor who says "we test the generator monthly". No log is produced. The auditor asks for maintenance records and observes a dated test sticker. Evidence is incomplete, so the finding is a nonconformity against documented information and operational control, not a personal criticism. The auditor records the exact requirement, the evidence and the risk.
Traps
Auditing against ISO 22313 guidance as a certifiable standard; accepting verbal assurance; writing a finding without citing the clause; consulting for the auditee; confusing an observation with a nonconformity.