Fundamental Audit Concepts and Principles
What this domain tests
This domain tests the conceptual toolkit of ISO 19011:2018 - what an audit is, what makes evidence admissible, and the principles that keep audit conclusions credible.
Core rules
- Audit: a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria.
- Audit criteria are the requirements used as a reference (ISO 21001 clauses, the organization's own procedures, regulatory requirements). Audit evidence is verifiable information - records, observations, statements. Findings are the result of evaluating evidence against criteria; conclusions are the overall outcome.
- The principles of auditing: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach.
- Independence means independence from the activity being audited, not from the whole organization - an internal auditor may audit another department but not their own work.
- A risk-based approach directs audit time and sampling toward areas of higher risk and greater significance.
- Audit types: first-party (internal), second-party (supplier or interested party), third-party (certification, surveillance, recertification, special).
Worked example
An auditor samples 20 learner files and finds six with no recorded assessment result, although certificates were issued. Reasoning: the criterion is the requirement for release of educational products and services (clause 8.6); the evidence is a documented sample, corroborated by interviews and by the certificate register; the finding is a nonconformity, not an opinion, because it is verifiable by a second auditor. The sample size and selection method must be recorded so the conclusion is reproducible.
Traps
- Presenting "the tutor seemed careless" as a finding - there is no cited criterion and no objective evidence.
- Accepting a single verbal assurance ("we always mark on time") as evidence without corroborating records.
- Confusing an observation or improvement opportunity with a nonconformity.
- Assuming independence requires an external auditor; internal auditors satisfy it through organizational separation.