Fundamental audit concepts and principles
What the domain tests
This domain checks ISO 19011 audit principles and the language of evidence. You need to distinguish audit criteria, evidence and findings, and explain independence, sampling and risk-based auditing in an ISO 37001 context.
Core rules
- Principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach.
- Audit criteria are the requirements used as a reference-ISO 37001, laws, policies and procedures. Audit evidence is verifiable information such as records, interviews and observations. A finding results from evaluating evidence against criteria.
- Conformity means fulfilment of a requirement; nonconformity means non-fulfilment. An observation or opportunity for improvement is not automatically a nonconformity.
- Auditors sample because auditing everything is impossible; sampling must be risk-based and the limitations disclosed.
- Independence means auditors do not audit their own work and are free from bias; it does not mean they must be external.
Worked example
An auditor sees no signature in the gift register for a client dinner. Before writing a finding, the auditor checks the procedure: it requires prior approval, but email approval is acceptable if attached. The auditor samples the email trail and finds approval was given after the dinner and not recorded. The evidence supports a nonconformity against the control, not against the absence of a signature alone.
Traps
Calling hearsay “evidence”; treating an audit conclusion as a finding; using a checklist as the audit criteria; failing to disclose sampling limits; and confusing independence with objectivity or with being an outside auditor.