Fundamental Audit Concepts and Principles
This domain tests the vocabulary and rules of auditing itself, largely from ISO 19011:2018, and whether you can apply them to security management system evidence.
The seven principles
Integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach. Independence means auditors do not audit their own work; the evidence-based approach means findings rest on verifiable evidence; the risk-based approach means audit effort goes where the risk is.
Core vocabulary
Audit criteria are the requirements used as a reference - ISO 28000, the organization's own procedures, contracts, legislation. Audit evidence is verifiable information. An audit finding is the result of evaluating evidence against criteria: conformity or nonconformity, with nonconformities graded major or minor. Audit conclusions state whether criteria were met, and the report records findings and conclusions.
Roles
The lead auditor manages the audit and reports; auditors collect and examine evidence; technical experts advise but do not audit beyond their competence; observers and guides do not influence the audit; the auditee is the organization being audited.
Worked example
An auditor sees an unattended, propped-open door to a server room. The instinct is to write a nonconformity. The correct reasoning: a finding needs a criterion, and ISO 28000 does not say 'doors must be closed'. The auditor checks the organization's own physical security procedure, its risk treatment plan and access logs. If its procedure requires doors to be secured and records show repeated breaches, the nonconformity is against the organization's control process (Clause 8), with the door as evidence.
Traps
Writing findings with no criterion; relying on hearsay or a single interview; labelling an observation a nonconformity without deciding why; auditing a guidance document as if it were a requirement; and stepping into consultancy by designing the fix.