PECB Certified Management Systems Internal Auditor flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Management system definition

A set of interrelated or interacting elements of an organization used to establish policies and objectives, and processes to achieve those objectives.

PDCA clause mapping

Plan covers clauses 4, 5 and 6; Do covers 7 and 8; Check covers 9; Act covers 10. Auditors use this to trace where a requirement sits in the standard.

Documented information

Information required to be controlled and maintained by an organization and the medium on which it is contained. Combines the former concepts of documents and records.

Process approach

Management by interrelated processes, where inputs are converted into outputs. Auditors examine process inputs, outputs, sequence, interaction, controls and performance indicators.

Risk-based thinking

The approach in ISO 9001:2015 and ISO 14001:2015 clause 6.1 requiring the organization to determine risks and opportunities and plan actions to address them.

Outsourced process responsibility

Outsourced processes remain the organization's responsibility. The organization must control them, and the type and extent of control must be defined in the management system.

Audit definition

A systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled.

Objective evidence

Records, statements of fact or other information that are verifiable and based on observation, measurement, test or other means. It is evaluated against the audit criteria.

Audit criteria

The set of requirements used as a reference against which objective evidence is compared. Examples include standard clauses, internal procedures, legal requirements and contracts.

Audit finding

The result of evaluating collected audit evidence against the audit criteria. Findings indicate conformity or nonconformity and may indicate risks or opportunities for improvement.

First-party audit

An internal audit performed by, or on behalf of, the organization itself for management review and other internal purposes. It may support a self-declaration of conformity.

Auditing principles

Integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach. These seven principles guide auditors under ISO 19011:2018.

Independence for internal auditors

Internal auditors need not be external to the organization, but must not audit their own work and must be free from bias and conflict of interest.

Audit programme

Arrangements for a set of one or more audits planned for a specific time frame, directed at a specific purpose, including all activities needed to plan and organize them.

Audit plan

A description of the activities and arrangements for a specific audit, including objectives, scope, criteria, dates, locations, team roles and time allocation.

Audit programme indicators

Measures of programme performance such as conformity of audits to plans, conformity of audit teams to competence requirements, auditee feedback, and effectiveness of programme implementation.

Initiating the audit

Determining feasibility of the audit, establishing contact with the auditee, confirming authority to conduct the audit, and obtaining information about the auditee's activities and processes.

Audit objectives vs scope

Objectives state what the audit intends to accomplish; scope states the boundaries covered, such as sites, functions, processes, and the time period.

Audit sampling

Selecting less than the total population of evidence, based on risk and significance. The sampling plan should be documented; ISO 19011 does not mandate statistical sampling.

Audit plan versus checklist

The audit plan is a required arrangement document describing the specific audit. A checklist is an optional auditor tool; ISO 19011 does not require or prescribe checklists.

Opening meeting purpose

To confirm the audit plan, explain how activities will be carried out, confirm communication channels, confirm resources, and clarify that the audit is sampling-based.

Information sources in audit

Interviews with auditees, observation of activities and conditions, and review of documents and records. Evidence from one source should be verified against another.

Triangulation of evidence

Verifying a statement from an interview against records or direct observation before treating it as objective evidence. This reduces reliance on unverified assertion.

Open versus leading questions

Open questions invite description and cannot be answered yes or no. Leading questions suggest the expected answer and should be avoided in audit interviews.

Major nonconformity

A nonconformity where a requirement is not addressed, or where the situation would cause the management system to fail to achieve its intended results.

Minor nonconformity

An isolated lapse or single observed departure from a requirement that does not indicate a systemic failure of the management system to meet requirements.

Closing meeting purpose

To present findings and conclusions, explain the sampling basis, agree on timeframes for corrective action, and inform the auditee that the audit report will follow.

Audit conclusions

Conclusions prepared before the closing meeting that address achievement of audit objectives, conformity of the management system, effectiveness of implementation, and opportunities for improvement.

Audit report content

Objectives, scope, client, audit team, auditee, dates, locations, criteria, findings, conclusions, and any deviations from the audit plan. The report is dated and approved.

Correction versus corrective action

Correction eliminates the detected nonconformity itself. Corrective action eliminates the root cause so the nonconformity does not recur elsewhere or later.

Finding structure

State the requirement (criteria), the objective evidence observed, and the nonconformity statement. Adding the risk or consequence strengthens the finding.

Follow-up on audit

Verification of the implementation and effectiveness of corrective actions. The audit is not closed until follow-up is completed and the results are recorded.

Escalation of findings

If corrective action is not taken or is ineffective, the finding is escalated to top management and may become input to management review under ISO 9001:2015 clause 9.3.