Fundamental Audit Concepts and Principles
What the domain tests
This domain tests ISO 19011 principles and vocabulary: audit criteria, evidence, findings, conclusions, audit types, and auditor conduct. You must distinguish an audit from inspection or consulting.
Core rules
- An audit is a systematic, independent, documented process for obtaining evidence and evaluating it objectively against criteria.
- Principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach.
- Evidence must be verifiable, recorded, and traceable; findings summarize conformity or nonconformity.
- First-party audit is internal; second-party is by an interested party; third-party is independent, often certification.
- Independence concerns objectivity and freedom from bias; an auditor cannot audit their own work.
Worked example
An auditor reviews 12 work orders and finds two without authorization. The criterion is the organization's work control procedure and ISO 55001 operational control. The evidence is the sampled records and interviews. The finding is a nonconformity if the procedure requires authorization; the reasoning is that sampling must be representative and the audit trail must show how the conclusion was reached. One or two exceptions may indicate a system weakness, not merely isolated error.
Traps
- Calling every observation a nonconformity.
- Giving advice or designing corrective actions while auditing.
- Relying on hearsay rather than verifiable evidence.
- Using criteria that were not agreed or communicated.
- Sampling only convenient records.