Fundamental audit concepts and principles
What an audit is, and the rules that govern it
An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. Objective evidence is data supporting the existence or verity of something - it must be verifiable, and it is the only legitimate basis for a finding. Audits are first party (internal), second party (customer/supplier), or third party (certification, accreditation, regulatory).
ISO 19011:2018 sets out seven principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach. Certification bodies additionally work to ISO/IEC 17021-1, which requires a two-stage initial certification audit, competence management, and separation of the audit team's conclusion from the certification decision.
Distinguish three artefacts that questions deliberately mix: the audit programme (arrangements for a set of audits over a time frame), the audit plan (schedule of activities for one audit), and the audit criteria (the requirements used as a reference). Also recall that findings are conformity, nonconformity or opportunities for improvement; conclusions are the audit outcome.
Traps: 'independence' does not mean external - an internal auditor must not audit their own work; auditors must not consult or design the controls they later audit; sampling always carries risk, so an auditor never claims zero risk, only a defensible sampling rationale.
Rule of thumb: no criterion, no nonconformity. Every finding must name the requirement, the evidence, and the link between them.