Fundamental concepts and principles of assessment
This domain tests the vocabulary and principles of assessment: criteria, evidence, findings, sampling, independence and competence. You must distinguish an audit from an inspection and a finding from a nonconformity.
Core concepts
- Audit: a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria (ISO 19011).
- Criteria: policies, procedures, the standard, contractual requirements and legal requirements.
- Evidence: records, statements and observations; verify by triangulating sources.
- Findings: results of evaluation. A nonconformity is a failure to meet a requirement; an observation identifies risk or improvement potential.
- Types: first-party internal audit, second-party supplier audit and third-party accreditation or certification assessment.
- Principles from ISO 19011: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach.
- Assessor competence includes knowledge of the standard, laboratory operations, audit techniques and communication; technical assessors need subject expertise.
Worked example
An internal auditor sees a raw-data notebook where a value has been covered with correction fluid and overwritten. The laboratory procedure says errors are corrected by a single line, initials and date, with the original visible. The auditor interviews the analyst, who says the first value was a typo. Evidence: the notebook entry and the procedure. Criterion: clause 7.5 on technical records and the laboratory procedure. Finding: the original value is not retrievable and the correction method breaches the procedure, so the record does not permit traceability. This is a nonconformity, not merely an observation. The auditor records the objective evidence and the requirement; ‘analyst careless’ is not a finding.
Traps
- Calling every finding a nonconformity.
- Auditing against personal preference rather than criteria.
- Accepting verbal assurance without records.
- Sampling only convenient records instead of following the audit trail.
- Losing independence by auditing your own work.