Conducting an audit
Fieldwork discipline
Conducting an audit is controlled evidence collection. Use the opening meeting to confirm scope, criteria, schedule and confidentiality. Interview with open questions, then probe for examples and records. Observe activities, review documents and records, and trace transactions. Record evidence as you go: source, date, sample, what was seen, and the requirement it relates to.
Core rules
- Evaluate against the audit criteria. A finding needs a requirement, objective evidence and an explanation of the gap.
- Grade nonconformities consistently. A major nonconformity typically means a systemic failure or an absent required process; a minor is an isolated lapse. Use the organisation's defined grading rule.
- Keep the auditee informed. Daily debriefs reduce surprises at the closing meeting.
- Do not prescribe detailed solutions or take over management's corrective action.
- Verify what you are told. Hearsay and unsupported assurances are not audit evidence.
Worked example
Finding statement: Requirement: A.5.18 requires access rights to be reviewed at regular intervals; the organisation's procedure sets quarterly reviews. Evidence: review records were available for Q1 and Q2 2025 but not Q3 or Q4; the system owner confirmed no review was performed. Gap: the control was not operated for two quarters. This is objective, traceable and avoids attributing motive. Whether it is major or minor depends on scope and effect: if the system holds critical data and no compensating review existed, a major grading may be justified.
Traps
Do not write that the auditee failed without stating the requirement and evidence. Do not argue or audit by ambush. Do not accept a screenshot with no source or date. Do not close a finding during fieldwork just because someone promises a fix.