Fundamental Audit Concepts and Principles
Definitions that carry marks
An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled. Keep three nouns apart: criteria (what you measure against - ISO 45001, legal requirements, the organization's own rules), audit evidence (records, observations and statements gathered), and findings (the auditor's evaluation of evidence against criteria). Conclusions aggregate findings; they are not a new category of evidence.
ISO 19011:2018 principles: integrity, fair presentation, due professional care, confidentiality, independence, and the evidence-based and risk-based approaches. Independence means the auditor does not audit their own work and is free from bias and conflict of interest.
Audit types: first party (internal), second party (supplier or contractor), third party (certification, typically an accredited body operating to ISO/IEC 17021-1). A combined audit covers one auditee against two or more management systems; an integrated audit examines a single system that integrates several; a joint audit involves two or more auditing organizations.
Evidence hierarchy: documentary and physical observation generally outweighs interview alone, and verbal claims should be corroborated. Sampling must be representative and risk-based, and the auditor must state that sampling limits certainty.
Traps: an auditor who consulted on the system they now audit lacks independence; personal opinions and hearsay are not objective evidence; a nonconformity is a statement of fact against a requirement, not a criticism of a person; "the procedure says X" only matters if the procedure is part of the audit criteria.
Rule of thumb: no finding without (1) a requirement, (2) evidence, and (3) a sentence linking the two.