Fundamental audit concepts and principles
Vocabulary that questions turn on
ISO 19011 supplies the definitions. An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria. Criteria are the requirements used as a reference - for 42001, the standard plus the organization's own policies and procedures. Evidence is verifiable information. A finding is the result of evaluating evidence against criteria. Conclusions answer the audit objectives and are not the same as findings.
Principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach. Independence matters most for third-party audits; internal auditors must not audit their own work. Confidentiality binds everyone on the team, including technical experts and interpreters.
Types: first-party (internal), second-party (for example a customer or supplier audit), third-party (certification). Certification-body audits are governed by ISO/IEC 17021-1, with ISO/IEC 42006 adding AIMS-specific requirements for bodies auditing AI management systems.
Traps in this domain:
- Treating a weakness as a nonconformity without citing a criterion - "this is poor practice" is not a finding.
- Confusing an observation or opportunity for improvement with a nonconformity, or inflating severity.
- Assuming independence means the auditor must be external; internal auditors need independence from the activity audited, not from the organization.
- Treating sampling risk as an excuse: a sample-based finding must still be evidenced and defensible.
- Forgetting that audit criteria can include customer, contractual or regulatory requirements adopted by the organization.
Rule of thumb - the three-legged stool: a valid nonconformity needs (1) a requirement, (2) objective evidence, and (3) a traceable link between them. Remove one leg and you have an observation, or nothing at all.