Fundamental Audit Concepts and Principles
What an audit is
An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria. Core vocabulary: audit criteria (the requirements used as a reference - ISO/IEC 27001, the organisation's own procedures, contracts, regulation); audit evidence (records, statements of fact or other information that are relevant and verifiable); audit findings (results of evaluating evidence against criteria - conformities as well as nonconformities); audit conclusion (outcome after considering all findings).
Principles (ISO 19011)
Integrity; fair presentation; due professional care; confidentiality; independence; evidence-based approach; risk-based approach. Independence means auditors do not audit their own work and must be free of bias and conflict of interest - an internal auditor may audit colleagues but never their own output.
Types
First party (internal), second party (supplier or customer), third party (certification body). Audits may be combined, joint or integrated. Distinguish an audit programme (arrangements for a set of audits over a timeframe) from an audit plan (activities for one audit) - a classic exam trap.
Traps
- Raising a nonconformity on opinion or an unverified claim: evidence must be verifiable and recorded.
- Expecting the auditor to design the fix; auditors evaluate conformity and may note opportunities for improvement, but do not consult or instruct.
- Confusing 'finding' with 'nonconformity' - findings include conformities.
Rule of thumb
Every nonconformity stands on three legs: criterion + corroborated evidence + gap. Remove one leg and you have an observation, not a nonconformity.