Fundamental Audit Concepts and Principles
What this domain tests
This domain tests ISO 19011-style audit concepts: audit types, programme versus plan, criteria, evidence, findings, competence and the seven audit principles. It also tests whether you can distinguish an audit from inspection, consulting or fault-finding.
Core rules and concepts
- An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it against audit criteria.
- Audit types include first-party (internal), second-party (supplier or interested party) and third-party (certification or regulatory).
- Audit principles are integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach.
- Audit criteria are the policies, procedures, requirements or standards used as a reference.
- Audit evidence must be verifiable; findings are the result of evaluating evidence against criteria.
- Sampling is legitimate but must be planned and representative; conclusions should not exceed what the sample supports.
- Auditors need competence in the standard, the FM subject matter, audit methods and the organization's context.
Worked example
During a site tour, an auditor sees a contractor entering a plant room without an escort. The contractor says induction “was done last year.” The auditor interviews the FM supervisor and checks the induction register, which has no entry for the contractor. Reasoning: the observation alone is weak evidence; the interview and record review triangulate it. The finding is against operational control and competence requirements, not against the auditor's personal dislike of the practice.
Traps
Recording opinions or hearsay as findings; treating an audit as an inspection; sampling only convenient records; losing independence by advising how to fix a process; failing to define criteria before evaluating evidence.