Fundamental audit concepts and principles
Domain focus
The exam tests ISO 19011:2018 audit principles and vocabulary, and whether you can distinguish an audit from an inspection, a finding, a conclusion and a certification decision.
Core rules
An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it against audit criteria to determine the extent to which criteria are fulfilled. The principles are integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach. Audit criteria are the requirements used as a reference; audit evidence must be verifiable and recorded; findings are the results of evaluating evidence - conformity or nonconformity - and conclusions are the audit team's judgement on the audit.
Third-party certification follows ISO/IEC 17021-1: stage 1 readiness, stage 2 certification, surveillance and recertification. The auditor gathers evidence by interview, observation and document review; sampling must be justified by risk. The auditor does not consult or design controls, and cannot audit their own work.
Worked example
An auditor sees a guard at a gate without the required high-visibility vest. She records the time, location, guard ID and the site instruction, interviews the supervisor, and samples three shifts' records. The nonconformity cites the requirement (site PPE instruction and clause 8 operational control) and the objective evidence. A verbal assurance that “it is usually worn” is not evidence of control; the finding is valid because the observation is corroborated and the requirement is clear.
Traps
Do not write a recommendation as a nonconformity. Do not confuse a minor lapse with a major system failure without justifying impact. Do not treat the audit conclusion as the certification decision - that belongs to the certification body. Do not accept hearsay; do not audit only documents; do not lose independence by advising on fixes.