Conducting an internal audit based on ISO 19011
Conducting an internal audit based on ISO 19011
This domain tests fieldwork: opening the audit, collecting and verifying evidence, sampling, communicating, evaluating findings against criteria, and closing the audit. The exam expects disciplined evidence collection and fair communication, not confrontational inspection.
Core rules and concepts
- The opening meeting confirms objectives, scope, criteria, schedule, roles, communication channels and confidentiality. It is not a ceremony; it prevents misunderstandings.
- Collect evidence through interviews, observation, document review and tracing transactions. Use open questions, listen, and corroborate what people say with records or observation.
- Sampling must be planned and explained. Increase samples where risk, variation or poor control is indicated; do not select only convenient items.
- Evaluate evidence against the audit criteria. A nonconformity states the requirement, the evidence and the gap. Observations may identify risk or improvement potential but must not be presented as nonconformities.
- Communicate serious issues promptly to the auditee and audit leader without bypassing the agreed channel.
- The closing meeting presents findings and conclusions, confirms factual accuracy and agrees follow-up arrangements, while preserving auditor independence.
Worked example
An auditor interviews a machine operator who says first-off checks are completed every shift. The auditor observes the current first-off sheet and finds three of ten required signatures missing, then traces ten production records and finds two jobs without first-off evidence. The auditor verifies the requirement in the process procedure, confirms the records are controlled, and writes a finding citing the criterion, the sample and the gap. The operator's statement is not sufficient because objective evidence contradicts it.
Traps that cost marks
Do not ask leading questions such as “You do complete the check, don't you?” Do not accept verbal assurance without evidence. Do not audit personalities or argue. Do not write a finding without a criterion and evidence. Do not treat an observation as a nonconformity merely to appear thorough.