PECB Certified Management Systems Internal Auditor common mistakes
PECB Certified Management Systems Internal Auditor · Understand the traps and how to avoid them.
When asked what an internal audit is for, the candidate describes it as a compliance inspection that produces a pass/fail verdict on the auditee, or says the auditor's job is to prove conformity rather than to evaluate it objectively.
Candidates transfer the mindset of third-party certification or regulatory inspection to internal auditing, where the purpose is to provide the organization with independent information for improvement, not to issue a certificate. The word 'audit' pulls in that baggage.
What to do instead
Before answering, restate the definition: an internal audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria to determine the extent of conformity. Then state the two outputs - findings against criteria and information for management to act on - and note that the auditor evaluates, the auditee owns the process, and the auditor does not prescribe solutions or certify.
The candidate treats the PDCA cycle and risk-based thinking as slogans, listing the four phases without being able to explain what happens in each phase or where a given activity (e.g. management review, internal audit, corrective action) sits in the cycle.
These concepts are introduced early and candidates memorize the diagram rather than the mechanics, so they cannot map a scenario onto Plan, Do, Check or Act or explain how risk-based thinking changes what an organization does.
What to do instead
Build a one-page map: Plan = establish objectives, identify risks and opportunities, allocate resources, define processes; Do = implement and operate; Check = monitor, measure, internal audit, evaluate performance; Act = address nonconformity, take corrective action, improve. For each phase, write two concrete examples from a real or imagined organization and practice placing scenario activities on the map until it is automatic.
When asked to distinguish audit criteria, audit evidence and audit findings, the candidate mixes them up - for example calling a clause of the standard 'evidence', or calling a nonconformity a 'criterion'.
The three terms appear together in the definitions and candidates learn them as a list of words rather than as a logical chain, so under exam pressure they substitute one for another.
What to do instead
Memorize the chain as a sentence: criteria are the set of requirements used as a reference (the standard, procedures, contracts, regulations); evidence is the verifiable information collected (records, observations, interviews); findings are the result of evaluating evidence against criteria (conformity, nonconformity, opportunity for improvement). Practice converting a short scenario into all three explicitly before writing the answer.
The candidate plans an audit by drafting a checklist of clauses from the standard and calling that the audit programme, without defining objectives, scope, criteria, the auditee, the audit team, or the schedule and duration. Scope is often stated as 'the whole management system'.
Checklists feel productive and are easy to memorize, so candidates skip the planning elements that ISO 19011 requires and confuse an individual audit plan with the overall audit programme.
What to do instead
Use a fixed planning template and write each element out: audit objectives (why), scope (what, including boundaries and locations), criteria (against what), auditee and auditee functions, audit team and roles, date, duration, and the sequence of activities. Distinguish the audit programme (the set of audits planned over time, managed by the programme manager) from the audit plan (the arrangement for one audit). If a scope question is asked, state boundaries, organizational units, locations and period explicitly.
The candidate writes an audit plan that allocates time evenly across all clauses or processes, or spends most of the time on documentation review, leaving no time for interviewing operational staff and observing work.
Candidates mirror the structure of the standard rather than the risk profile of the organization, and reading documents feels safer than planning interviews and sampling.
What to do instead
Justify the time allocation by risk and importance: identify the processes with the highest risk, the most change, the most previous nonconformities, or the greatest customer impact, and allocate more time there. Reserve explicit slots for interviews and observation at the point of work. In an exam answer, state the rationale for the allocation in one sentence rather than just listing a timetable.
During an audit, the candidate relies almost entirely on interviews and document review and never plans to observe the actual work, or accepts verbal assurance ('we always do it that way') as sufficient evidence.
Observation requires access and confidence, and interviews are conversational and easy to conduct. Candidates also confuse what people say with what the system actually does.
What to do instead
Plan evidence collection across at least three sources: documents and records, interviews, and observation of activities at the point of work. Treat a statement as a lead, not as evidence, until it is corroborated by a record or by observation. In scenario questions, name the specific observation you would make and the record you would sample.
The candidate writes findings as opinions or as solutions - 'the process is weak', 'the team should retrain staff', 'management does not care' - rather than stating the objective evidence, the requirement, and the gap.
Candidates want to be helpful and slip into consulting, or they lack the discipline of separating what was observed from what it means, so the finding contains no traceable evidence or criterion.
What to do instead
Use a fixed finding structure: requirement (criterion and its source), evidence (what was seen, read or heard, with identifiers such as record number, date and location), and conclusion (the extent of conformity or nonconformity). Keep recommendations separate and optional, and never write a finding that cannot be traced to a specific piece of evidence and a specific criterion.
The candidate classifies every issue as a major nonconformity, or conversely downgrades a systemic failure to an observation, without applying a consistent rule for grading.
The standard does not prescribe a grading scale, so candidates invent their own or default to the most severe label to appear rigorous, and they do not distinguish a single lapse from a systemic breakdown.
What to do instead
State the grading logic explicitly: a nonconformity is a failure to meet a requirement; whether it is graded major or minor depends on the organization's own defined criteria, typically the extent of the gap, whether the system failed to detect it, and the risk or impact. Apply the same rule to every finding in the answer, and justify the grade in one sentence referring to that rule.
In the closing meeting and the report, the candidate presents findings as final verdicts, omits the auditee's perspective, or fails to agree on correction, root cause analysis, corrective action and a timeframe.
Candidates focus on the technical content of findings and treat communication and follow-up as administrative afterthoughts, so they skip agreement on facts and on actions.
What to do instead
Structure the closing sequence: thank and set the purpose, present findings with evidence and criteria, confirm the facts with the auditee, agree on correction and corrective action with owners and due dates, and record any disagreement. In the report, distinguish findings, conclusions and recommendations, and state who receives it and when. Remember that corrective action must address root cause, not just the symptom.
The candidate describes follow-up as 'checking that the corrective action was done' and stops there, without verifying effectiveness or linking follow-up to the audit programme and management review.
Follow-up is the last domain and is often studied briefly, so candidates reduce it to a tick-box verification of implementation and forget the requirement to evaluate whether the action eliminated the cause.
What to do instead
Write follow-up as a three-step verification: was the correction made, was the corrective action implemented as agreed, and was it effective in preventing recurrence, verified by evidence. Then state how the result feeds back into the audit programme (risk update, scheduling of the next audit) and into management review, and what happens if the action is not effective or overdue.