Management Systems Audits cheat sheet

Key terms

Audit

A systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. The definition is from KS ISO 19011 and every word in it is doing work.

Systematic

Planned and methodical rather than opportunistic: a defined scope, a plan, a sample chosen deliberately, and a record of what was examined.

Independent

Free from bias and conflict of interest. An auditor must not audit their own work, which is the practical form the requirement takes.

Documented

The process, the evidence and the findings are recorded, so that the conclusion can be traced back to what was actually seen.

Objective evidence

Data supporting the existence or verity of something: a record, an observation, a statement of fact. It is verifiable, which is what distinguishes it from impression.

Audit criteria

The set of requirements used as a reference against which evidence is compared: the standard, the organisation's own procedures, contractual requirements and applicable law.

What an audit is not

It is not an inspection of product, which examines items rather than the system. It is not a surveillance exercise directed at individuals. It is not a consultancy: an auditor reports what is, and does not design the solution, because designing it would destroy the independence required to audit it later.

Auditee

The organisation, or part of it, being audited.

Auditor

A person who conducts an audit, competent to do so.

Audit client

The organisation or person requesting the audit: the auditee's own management for an internal audit, the customer for a second-party audit, the certification body's client for a third-party audit.

Audit team

One or more auditors conducting an audit, supported where needed by technical experts.

Audit team leader

The auditor with overall responsibility for the audit, who manages the team, decides the conclusions and presents the findings.

Technical expert

A person providing specific knowledge or expertise to the audit team, who does not act as an auditor.

Observer

A person who accompanies the team but does not audit, for example a witness auditor from an accreditation body, or a trainee.

Guide

A person appointed by the auditee to assist the team: to arrange access, to identify people, and to ensure safety rules are observed.

Audit scope

The extent and boundaries of the audit: the locations, functions, activities, processes and period covered.

Audit objectives

What is to be accomplished by the audit, which determine the scope and the criteria.

Audit programme

Arrangements for a set of audits planned for a specific time frame and directed towards a specific purpose.

Audit plan

The description of the activities and arrangements for an individual audit: who audits what, when and against which criteria.

Audit findings

Results of the evaluation of collected audit evidence against the audit criteria. A finding can indicate conformity or nonconformity, or an opportunity for improvement.

Nonconformity

Non-fulfilment of a requirement.

Conformity

Fulfilment of a requirement.

Audit conclusion

The outcome of the audit after considering the audit objectives and all findings; it is the team's overall judgement, distinct from the individual findings.

Correction

Action to eliminate a detected nonconformity. It deals with the instance.

Corrective action

Action to eliminate the cause of a nonconformity and prevent recurrence. It deals with the cause.

Audit trail

The chain of records permitting a transaction or activity to be traced from beginning to end, which is what an auditor follows.

Integrity

The foundation of professionalism. Auditors perform their work with honesty, diligence and responsibility; observe and comply with applicable legal requirements; demonstrate competence; perform impartially; and are sensitive to influences exerted on their judgement.

Fair presentation

The obligation to report truthfully and accurately. Audit findings, conclusions and reports reflect truthfully and accurately the audit activities; significant obstacles and unresolved diverging opinions are reported; and communication is truthful, accurate, objective, timely, clear and complete.

Due professional care

The application of diligence and judgement in auditing. Auditors exercise care in accordance with the importance of the task and the confidence placed in them by the audit client, and a key factor is the ability to make reasoned judgements in all audit situations.

Confidentiality

Security of information. Auditors exercise discretion in the use and protection of information acquired, and do not use it for personal gain or in a manner detrimental to the legitimate interests of the auditee.

Independence

The basis for impartiality and objectivity of audit conclusions. Auditors are independent of the activity being audited wherever practicable, and are free from bias and conflict of interest. For internal audits, auditors are independent of the function being audited.

Evidence-based approach

The rational method for reaching reliable and reproducible conclusions in a systematic audit process. Evidence is verifiable, and because an audit is conducted during a finite period with finite resources, it is based on samples of the information available. The use of an appropriate sample is closely related to the confidence that can be placed in the conclusions.

Risk-based approach

An audit approach that considers risks and opportunities. The risk-based approach substantively influences the planning, conducting and reporting of audits, so that audit effort is directed at matters of significance (see the chapter on the risk-based approach).