Fundamental Audit Concepts and Principles
Domain 3 tests the vocabulary and principles you apply in every audit: criteria, evidence, findings, conclusions, sampling, independence, and professional judgement. Expect scenario questions that ask whether a statement is evidence, an observation, or a nonconformity.
Core rules
- An audit is a systematic, independent, and documented process for obtaining evidence and evaluating it objectively against audit criteria.
- Audit criteria are the requirements used as a reference: ISO 37301, internal procedures, contracts, or legal requirements.
- Audit evidence must be verifiable and recorded. Interviews, observation, and document review are complementary; one source alone is weak.
- Findings summarize conformity or nonconformity. Conclusions answer the audit objectives.
- Auditing principles include integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach, and a risk-based approach.
- Sampling is legitimate but must be planned and recorded. Sample size and selection should reflect risk and population.
Worked example
A compliance manager states that all high-risk third parties are screened before contracting. The auditor samples ten contracts and finds three with no screening record. The procedure requires screening before signature. This is a nonconformity: the criterion is clear, the evidence is verifiable, and the gap is not explained by a different approved process. Because 3 of 10 failed, the auditor considers whether the failure is systemic before deciding severity.
Traps
Do not rely on verbal assurance alone. Avoid leading questions that suggest the expected answer. Do not call every weakness a nonconformity; an observation has no failed criterion. Do not lose independence by advising the auditee during the audit. Do not disclose confidential evidence.