Fundamental Audit Concepts and Principles
Definition and principles
An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. Principles to know: integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach.
The building blocks
- Audit criteria - the requirements against which evidence is judged (ISO/IEC 27701, ISO/IEC 27001, the organization's own policies, contractual and legal obligations).
- Audit evidence - records, statements and observations that are verifiable.
- Audit findings - conformity or nonconformity with criteria.
- Audit conclusion - the outcome after considering all findings.
Audits are first party (internal), second party (supplier or customer) or third party (certification); they may be combined, joint or integrated.
Sampling and confidence
Auditors sample because full coverage is impossible; sampling risk never disappears, so audit reports state that findings are based on samples. When a sample reveals a failure, widen or deepen the sample before generalizing.
Competence and impartiality
Auditors must not audit their own work, must declare conflicts of interest, and must not consult or design the controls they later audit. Technical experts advise but do not audit alone.
Traps
Accepting undocumented verbal assurances as objective evidence. Declaring a nonconformity simply because no written procedure exists - the standards require documented information, not necessarily a procedure for everything. Recommending specific solutions as if consulting.
Rule of thumb: a well-formed finding names the requirement, the objective evidence and the gap between them - nothing more.