Part A: Principles and planning
Auditing principles and terminology
Key takeaways
- KS ISO 19011 defines an audit as a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled.
- Audit criteria are the requirements the evidence is compared against: the standard, the organisation's own procedures, contractual requirements and applicable law.
- Correction eliminates a detected nonconformity and deals with the instance; corrective action eliminates its cause and prevents recurrence.
- Audits are first party (the organisation on itself), second party (a customer on its supplier) or third party (an independent, accredited certification body).
- The seven principles are integrity, fair presentation, due professional care, confidentiality, independence, the evidence-based approach and the risk-based approach; because an audit samples, absence of a finding is not proof of conformity.
An audit is a systematic search for evidence about whether a system does what it says it does. Every mistake candidates make in this paper, and most of the mistakes real auditors make, comes from losing sight of one word in that sentence: evidence.
What an audit is
Audit terminology
Correction is not corrective action, and this paper will test it
If an auditor finds that a scale was not calibrated, correction is to have it calibrated. Corrective action is to establish why the calibration schedule was missed, whether other equipment is affected, and to change the system so that an overdue calibration is escalated rather than passing silently. An organisation that only ever corrects will meet the auditor again at the same finding next year.
Types of audits
Types of audit
| Classification | Type | Conducted by | Purpose |
|---|---|---|---|
| By party | First party (internal) | The organisation on itself | Internal assurance; required by KS ISO 9001 clause 9.2 |
| By party | Second party (external supplier) | A customer on its supplier, or its appointed agent | Assurance to the customer of the supplier's capability |
| By party | Third party (certification) | An independent, accredited certification body | Attestation to the market of conformity to a standard |
| By object | System audit | Any party | Whether the management system conforms and is effective |
| By object | Process audit | Any party | Whether a specific process operates as defined and achieves its outputs |
| By object | Product audit | Any party | Whether product conforms to specification, examined after release |
| By purpose | Compliance audit | Any party or a regulator | Whether legal and regulatory requirements are met |
| By purpose | Follow-up audit | The original audit party | Whether corrective actions were taken and were effective |
| By scope | Combined audit | Any party | Two or more management systems audited together, for example quality and environment |
| By scope | Joint audit | Two or more auditing organisations together | One auditee audited by several clients at once, reducing audit burden |
| By notice | Announced or unannounced | Any party | Unannounced audits test the steady state rather than the prepared state |
| By location | On-site or remote | Any party | Remote auditing uses information and communication technology, and has limits on what it can verify |
Principles of auditing
KS ISO 19011 sets out seven principles. They are the examinable core of this chapter, and they are the standard against which an auditor's conduct is judged.
Sampling is the reason an audit cannot guarantee conformity
Because an audit examines a sample within a finite period, absence of a finding is not proof of conformity. A clean audit report says that within the scope and sample examined, no nonconformity was found. Candidates who write that a successful audit proves the system conforms have misunderstood the evidence-based principle, and so have auditees who treat a certificate as a guarantee.
Dimensions of auditing
- Conformity: does the system meet the requirements of the standard, the organisation's own documented information, and applicable statutory and regulatory requirements
- Implementation: is the system actually operating, as distinct from existing on paper, which is tested by observing work and examining records rather than by reading procedures
- Effectiveness: is the system achieving its intended results, which is a different question from conformity and the one that distinguishes a mature audit from a document check
- Efficiency: are the results achieved with reasonable use of resource, which ISO 19011 does not require but which internal audits increasingly address
- Adequacy: is the system suitable for the organisation's context, size and risks, or has a template been adopted that addresses risks the organisation does not have
- Scope dimension: the locations, functions, processes and period covered, which bounds every conclusion the audit reaches
- Depth dimension: how far the auditor follows a trail, which is a judgement about risk rather than a fixed rule
- Time dimension: the period the evidence covers, since a sample drawn only from the last month says little about the year
Benefits of auditing
- It provides objective evidence to management that the system is or is not operating, which no amount of internal reporting can substitute for
- It detects nonconformities before a customer, a regulator or a certification body does, when correction is cheapest and voluntary
- It identifies improvement opportunities, since an auditor sees across functions in a way that no line manager does
- It verifies that corrective actions from previous audits were effective, which is the only check on whether the corrective action process works at all
- It supports certification and market access, and satisfies customers' second-party requirements
- It develops the auditors themselves: internal auditing is one of the most effective ways to build cross-functional understanding in an organisation
- It spreads good practice, because an auditor who sees a better method in one department can report it as an observation for others
- It supplies a required input to management review under clause 9.3.2 and evidence for clause 9.2.2
- It disciplines the system: processes that are audited are maintained, and processes that are never audited drift
- It reduces risk of regulatory action, product liability and reputational damage by finding the weakness before the failure
Learn the seven ISO 19011 principles verbatim
Integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach. They are asked directly nearly every sitting, and they also supply the framework for scenario questions about auditor conduct: whatever the scenario, the answer is which principle is engaged and what it requires.
Self-check
Define an audit as KS ISO 19011:2018 defines it and explain the significance of each element of the definition. Distinguish an audit from an inspection and from a consultancy assignment. (10 marks)
State the seven principles of auditing and, for each, give one example of conduct that would breach it. (14 marks)
Show worked answer
Definition and distinctions (10 marks: 6 for the definition, 4 for the distinctions).
KS ISO 19011:2018 defines an audit as a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled.
Systematic: the audit is planned and methodical, with a defined scope, a plan, a deliberately chosen sample and a record of what was examined, rather than an opportunistic look at whatever presents itself.
Independent: the auditor is free from bias and conflict of interest and does not audit their own work, because a person examining their own output cannot reach a conclusion others can rely on.
Documented: the process, the evidence and the findings are recorded, so that a conclusion can be traced back to what was actually observed and can be tested by someone else.
Objective evidence: data supporting the existence or verity of something, which is verifiable. This excludes impression, hearsay and the auditor's opinion of a person.
Evaluating it objectively: the evidence is compared against the criteria without regard to who produced it or what the consequence of the finding will be.
Audit criteria: the set of requirements used as the reference, comprising the standard, the organisation's own documented information, contractual requirements and applicable statutory and regulatory requirements. Without stated criteria there is nothing against which evidence can be evaluated, so an audit without criteria is an opinion.
Extent to which criteria are fulfilled: the outcome is a judgement of degree supported by findings, not a pass or fail.
Distinction from inspection: an inspection determines the conformity of an item or a batch by observation and measurement against a specification. Its object is the product; an audit's object is the system or process that produced it. An inspection can tell you this batch conforms; an audit tells you whether the arrangements are such that batches will conform.
Distinction from consultancy: an auditor determines and reports the extent to which criteria are fulfilled. A consultant designs the solution. The roles are incompatible in the same organisation because a person who designed a control cannot independently evaluate it, which is why ISO/IEC 17021-1 prohibits a certification body from providing management system consultancy to its certification clients.
Seven principles and breaches (14 marks, 2 per principle).
1. Integrity, the foundation of professionalism: performing work honestly, diligently and responsibly, complying with legal requirements, demonstrating competence and being sensitive to influences on judgement. Breach: an auditor accepts hospitality or a gift from the auditee before finalising the report, or agrees to record a finding as an observation rather than a nonconformity after being lobbied by the auditee's management.
2. Fair presentation, the obligation to report truthfully and accurately: findings, conclusions and reports reflect the audit activities truthfully, and significant obstacles and unresolved diverging opinions are reported. Breach: the team leader omits from the report a major nonconformity because the auditee promised to fix it before the certificate was issued, or fails to record that the team was denied access to a site within the scope.
3. Due professional care, applying diligence and judgement in proportion to the importance of the task and the confidence placed in the auditor: Breach: an auditor accepts a photocopied calibration certificate without checking its date or its issuing laboratory, or samples only the records the auditee selected and presented.
4. Confidentiality, security of information: exercising discretion in the use and protection of information acquired and not using it for personal gain or to the auditee's detriment. Breach: an auditor discloses an auditee's process parameters or customer list to another client, or uses knowledge of a weakness to obtain consultancy work.
5. Independence, the basis for impartiality: the auditor is independent of the activity audited and free from bias and conflict of interest. Breach: an internal auditor audits the procedure they themselves wrote, or a certification body's auditor audits a client to whom their firm supplied management system consultancy.
6. Evidence-based approach, the rational method for reaching reliable and reproducible conclusions: evidence is verifiable, and conclusions rest on an appropriate sample. Breach: an auditor raises a nonconformity on the strength of a verbal complaint from an employee without corroborating it against a record or an observation, or writes into a report that the auditee 'appeared nervous', which is not evidence of anything.
7. Risk-based approach, considering risks and opportunities so that audit effort is directed at matters of significance: Breach: the audit programme allocates equal time to a low-risk administrative process and to the process on which product safety depends, or the plan is copied unchanged from the previous year despite a major change in the organisation's operations.