Fundamental concepts and principles of auditing
Fundamental concepts and principles of auditing
This domain tests your grasp of what an audit is, the principles that make an audit credible, and the distinctions among audit criteria, evidence, findings and conclusions. The exam expects ISO 19011 language and practical judgment about independence, objectivity and competence.
Core rules and concepts
- An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled.
- ISO 19011 principles are integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach.
- Independence is freedom from bias and conflict of interest; it does not require an external auditor. Internal auditors must not audit their own work or a process for which they are accountable.
- Audit criteria are requirements, policies or standards used as a reference. Audit evidence is verifiable information. A finding describes conformity or nonconformity; a conclusion is the audit outcome after considering findings.
- First-party audits are internal, second-party audits are performed by an interested party such as a customer, and third-party audits are performed by an independent organization such as a certification body.
- Competence combines education, training, experience and personal attributes, and must be appropriate to the audit scope.
Worked example
An internal auditor is assigned to audit purchasing, but the same auditor negotiates and approves key supplier contracts. The auditor should disclose the conflict rather than rely on personal integrity alone. The self-review threat is significant: the auditor would evaluate work they performed. Reassigning the audit or narrowing the scope preserves independence; documenting the rationale demonstrates due professional care. Competence alone does not cure a conflict.
Traps that cost marks
Do not claim independence means external. Do not accept undocumented hearsay as objective evidence. Do not confuse an audit with an inspection or a consultation. Do not issue a finding without a criterion, evidence and a clear explanation of the gap.