Audit Principles, Concepts, and Planning

The International Organization for Standardization (ISO) defines an audit as follows:

A systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled. (ISO 19011:2018 – Guidelines for Auditing Management Systems)

In July 2018, in response to the demand for guidelines on integrated management system audits, the International Organization for Standardization published ISO 19011:2018, titled Guidelines for Auditing Management Systems.

It is a meta-standard that details the audit principles, planning, and execution processes for several types of management system audits including information security, environmental, and quality management audits.

One of the most important components of this guidance is to make sure that the objectives of the audit program are well-aligned with an entity’s basic business objectives...

Different types of ISO audit

The ISO 19011 standard is intended to help businesses in auditing processes. In ISO standards, there are mainly two kinds of audits that can be carried out (see also Figure 8.1):

• Internal audits (first - party): Internal audits are assessments and analyses made by businesses on their own management systems. These audits are carried out by the company. There are several resources available to guide businesses on how to carry out internal audits, but the ISO 19011 standard is the most important of them. Internal audits are a crucial part of meeting the requirements of most standards for management systems. Internal audits for any management systems do not lead to ISO certifications.
• External audits (second -party and third - party): When relevant stakeholders outside the business conduct an audit, it is called a second-party audit (such as those carried out by suppliers). Third-party audits are the most crucial ones and result in certifications...

Seven principles of auditing

Auditing principles are needed for an audit to be an effective and reliable technique for supporting management systems and providing entities with chances for continual improvement. By adhering to these principles, audits can become effective and dependable tools in supporting management policies and controls. They provide essential information that organizations can act upon to enhance their performance. Following these principles is vital for generating relevant and comprehensive audit conclusions while enabling independent auditors to reach similar conclusions in similar situations.

Figure 8.2 depicts the seven principles laid out by ISO 19011:2018, Clause 4, followed by an explanation of each one.

Figure 8.2 – Seven principles of auditing

Integrity – the foundation of professionalism

Auditors and individuals in charge of the audit program must conduct themselves ethically, honestly, and responsibly...

Additional guidance for auditors

Annex A of ISO/IEC 19011:2018 provides additional guidance for auditors on different aspects explained in the following subsections.

Audit methods

An audit can be conducted using a number of methods including on-site audit and remote audit, with or without human interaction, in different combinations. On-site audits are those performed at the location of the auditee, and remote audits are those performed at a place different from the location of the auditee, regardless of the distance, using digital interactive communication means. Interactive audits involve the interaction of the auditee’s representative(s) and the audit team. Non-interactive audits do not involve human interaction but involve interaction with equipment, facilities, and documents.

The objectives, scope, and criteria of the audit, as well as the audit’s duration and location, all have a role in determining the audit techniques used. The audit process and its results...

Audit program

An audit program is the master plan for conducting an audit or set of audits that are to be undertaken in a specific timeframe and for a specific purpose. For example, the purpose could be to certify the information security management system of a company against ISO 27001. It gives a direction for the proper execution of audits. The ISO 19011:2018 standard offers instructions on how to manage audit program improvements in a systematic manner.

The objectives of the audit program should align with the policies and goals of the management system in addition to meeting regulatory and statutory requirements.

For third-party audits, the audit program must comprise an initial audit (Stage 1 – document review and Stage 2 – evaluating the implementation and effectiveness of the management system[s]), surveillance audits in the first and second years (after certification audits), and a recertification audit in the third year prior to the expiration of certification...

Summary

ISO 19011 can be used by anyone who conducts or participates in audits or audit programs. It is intended for those who are tasked with overseeing audit program management and conducting audit participant evaluations. ISO 19011:2018 is a useful resource for anyone who has been entrusted with enhancing an audit program. The standard outlines the seven auditing principles, how to manage an audit program, and methods for determining an auditor’s level of competence. This chapter covered the theory, principles, and planning parts of conducting an audit, which may help you in better decision-making and planning for an audit in your organization.

In the next chapter, we will see how to conduct an ISO 27001 audit. Again, the steps and processes involved are stated in the ISO 19011 standard.