Fundamental audit concepts and principles
Audit principles
ISO 19011:2018 sets seven principles: integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach. An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it against audit criteria. Criteria are the requirements used as a reference; evidence is verifiable information; findings are the evaluation results.
Core rules
- A first-party audit is internal; a second-party audit is by an interested party such as a customer; a third-party audit is independent certification or regulatory audit.
- Independence means the auditor does not audit their own work and is free from bias and conflict of interest.
- Sampling is legitimate, but the auditor must justify sample size and selection and recognise sampling risk.
- Findings may show conformity or nonconformity; observations and opportunities for improvement are not nonconformities unless a requirement is missed.
- Auditors report evidence and conclusions. They do not redesign the process or take over management responsibility.
Worked example
An internal auditor is asked to audit the access-management process that they designed six months earlier. They should decline that assignment. The reasoning is independence: they would be evaluating their own design, and a conflict of interest undermines the credibility of the conclusion. Another competent auditor should conduct the audit; the original auditor may provide documents but not audit the process.
Traps
Do not treat an audit as an inspection or a consultancy review. Do not state there is no problem because no incident occurred; controls can fail without an incident. Do not present hearsay as evidence. Do not confuse an audit finding with a root cause.