Fundamental audit concepts and principles
Domain 3 - Fundamental audit concepts and principles
This domain tests the vocabulary and discipline of auditing: audit criteria, evidence, findings and conclusions; the principles in ISO 19011:2018; audit types; and the difference between an internal audit, a second-party audit and a certification audit.
Principles and definitions
- An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled.
- Audit criteria are the requirements used as a reference: ISO/IEC 20000-1, the organization's SMS documents, contracts, legal requirements and its own procedures.
- Audit evidence must be verifiable. It comes from interviews, observation of activities, and review of documents and records. Triangulate: a claim in an interview should be checked against a record or observation.
- ISO 19011 principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach.
- Independence means the auditor is not auditing their own work and is free from bias and conflict of interest. Impartiality is the broader absence of favouritism, especially important in certification.
Worked example
A service desk manager says all major incidents are reviewed. The auditor asks for the major incident register, selects three closed major incidents, and finds review records for two. The third has no review. The finding should state the criterion (the organization's procedure or the relevant ISO/IEC 20000-1 requirement), the evidence (register and missing record), and the conclusion (nonconformity). A single missing record may be an isolated lapse; the auditor should sample more before deciding whether it is systemic.
Traps
- Writing findings based on opinion (the process is weak) without evidence.
- Auditing documents rather than the process and its results.
- Asking leading questions that suggest the expected answer.
- Treating an observation or opportunity for improvement as a nonconformity without a requirement.
- Accepting a verbal assurance as sufficient evidence.