PECB Certified Management Systems Internal Auditor key terms

A set of interrelated or interacting elements an organization uses to establish policies and objectives, and the processes needed to achieve those objectives. It includes structure, roles, planning, operation, and improvement activities.

Managing activities as interrelated processes that transform inputs into outputs, so that the system's results are understood and controlled as a coherent whole rather than as isolated tasks.

A recurring cycle of Plan, Do, Check, Act used to manage and continually improve processes and systems. Planning sets objectives, doing implements them, checking monitors results, and acting addresses gaps.

Considering uncertainty and its potential effects when planning and operating a management system, so that preventive action is built into processes rather than added afterwards.

The effect of uncertainty on objectives, which can be negative or positive. In management systems it is usually addressed by identifying what could go wrong and putting controls in place.

A favourable circumstance or possibility that can support the achievement of objectives. Management systems require organizations to identify opportunities as well as risks and to plan actions for both.

A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity. Their needs and expectations inform what the management system must address.

The combination of internal and external factors, including legal, technological, competitive, cultural, and social conditions, that are relevant to the organization's purpose and affect its management system.

The documented boundaries and applicability of a management system, stating which activities, products, services, and locations are covered and which are excluded, with justification for exclusions where required.

The person or group at the highest level who directs and controls an organization. This level provides leadership, approves policy and objectives, and ensures resources for the management system.

A statement of the organization's overall intentions and direction, formally expressed by top management. It provides a framework for setting objectives and a reference point for auditors judging alignment.

A result to be achieved, set at relevant functions and levels, consistent with policy, measurable where practicable, monitored, and updated as needed. Objectives translate intent into something auditable.

Information the organization must control and maintain, covering both documents that provide guidance and records that evidence results. It includes creation, approval, distribution, version control, and retention.

A recurring activity to enhance performance, not a one-time fix. It uses monitoring results, corrective actions, and management review to raise the system's effectiveness over time.

A systematic, independent, and documented process for obtaining objective evidence and evaluating it against audit criteria to determine the extent to which those criteria are fulfilled.

An audit conducted by the organization itself, or by a party on its behalf, to review its own management system. It supports improvement and provides input to management review.

The set of requirements, policies, procedures, standards, or contractual obligations used as a reference against which audit evidence is compared to reach findings.

Records, statements of fact, or other verifiable information relevant to the audit criteria. Evidence is gathered through interviews, observation, and document review, and should be traceable and corroborated.

Data or information that can be verified and that supports the existence or truth of something. In auditing it distinguishes demonstrable facts from opinions, impressions, or unconfirmed statements.

The result of evaluating collected audit evidence against audit criteria. Findings may indicate conformity or nonconformity and are the basis for the audit conclusion and report.

A failure to meet a requirement. It may relate to the management system standard, the organization's own procedures, or applicable legal and contractual obligations, and it must be clearly evidenced.

A statement of fact or a noted weakness that does not yet constitute a nonconformity against criteria but carries improvement potential. Observations are reported separately and do not require formal corrective action.

Arrangements for one or more audits planned for a specific time frame, including objectives, scope, frequency, methods, resources, and responsibilities, directed at meeting a defined purpose.

A description of the activities and arrangements for a specific audit, covering objectives, scope, criteria, schedule, audit team, and logistics. It is agreed with the auditee before the audit begins.

The extent and boundaries of an audit, stating which functions, units, processes, locations, and time period are covered. It must be consistent with the audit programme and the audit objectives.

One or more auditors conducting an audit, supported as needed by technical experts and observers. Members share the workload and report to the audit team leader.

The person who manages the audit, including preparing the plan, allocating tasks, leading meetings, resolving issues, and approving the report. This role carries responsibility for the audit's overall conduct.

A person who provides specific knowledge or expertise to the audit team on the subject being audited, such as a process specialist or a regulatory adviser. Experts advise but do not audit as auditors.

The demonstrated ability to apply knowledge and skills to achieve intended results. Auditors need education, training, audit experience, and personal attributes, which should be evaluated and maintained.

Freedom from bias, conflict of interest, and undue influence, so that audit conclusions rest only on evidence. Auditors should not audit their own work and should disclose any relationships that could impair judgement.

The quality of reaching conclusions based on evidence rather than preconception, personal interest, or pressure. It is supported by impartial selection of samples, balanced questioning, and transparent reporting.

Selecting less than the total population of available items to gather evidence and draw conclusions about the whole. Sample size and selection method should be justified and documented.

The documented sequence that allows an activity to be traced from start to finish, including who did what, when, and with what authorization. It supports verification and reconstruction of events.

A short meeting at the start of an audit where the audit team confirms objectives, scope, criteria, schedule, methods, and reporting arrangements with the auditee and clarifies practical matters.

A meeting at the end of an audit where findings and conclusions are presented to the auditee and management, ambiguities are clarified, and agreement is sought on facts and timelines for action.

The documented output of an audit, recording objectives, scope, criteria, team, dates, findings, conclusions, and any agreed actions. It is the formal record distributed to those entitled to receive it.

Action taken to eliminate the cause of a detected nonconformity so that it does not recur. It differs from correction, which only fixes the immediate problem, and its effectiveness should be verified.

An activity to verify that corrective actions from a previous audit have been implemented and are effective. It may be a separate audit or part of the audit programme's next cycle.

A periodic review by top management of the management system's suitability, adequacy, and effectiveness, using audit results and other inputs, and producing decisions on improvement and resources.