Audit concepts and principles from ISO 19011: first, second and third-party audits, the seven principles of auditing, professional ethics, irregularities and legal obligations, audit evidence types and sufficiency, and auditing outsourced operations and with big data.
5 minutes
5 Questions
In the ISO/IEC 27001 Lead Auditor context, fundamental audit concepts and principles come mainly from ISO 19011 (Guidelines for auditing management systems) and ISO/IEC 17021-1 (requirements for certification bodies). An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. Key concepts include: audit criteria (the requirements used as a reference, such as ISO/IEC 27001 clauses, Annex A controls, policies, and legal or contractual obligations); audit evidence (verifiable records, statements of fact, or observations gathered through interviews, document review, and observation); audit findings (the results of comparing evidence against criteria, classified as conformities, major or minor nonconformities, or opportunities for improvement); and audit conclusions (the outcome reached after considering the audit objectives and all findings). Audits may be first-party (internal), second-party (supplier or customer), or third-party (certification). Third-party certification typically follows a Stage 1 audit (documentation and readiness review) and a Stage 2 audit (implementation and effectiveness), followed by surveillance and recertification audits. Because auditors cannot examine everything, they rely on sampling, which introduces audit risk. ISO 19011 defines seven auditing principles: 1) Integrity, the foundation of professionalism, meaning honesty, diligence, responsibility, and impartiality; 2) Fair presentation, the obligation to report truthfully and accurately, including significant obstacles and unresolved divergent opinions; 3) Due professional care, applying diligence and sound judgment proportionate to the importance of the task; 4) Confidentiality, protecting sensitive information obtained during the audit, which is especially critical in information security; 5) Independence, keeping auditors free from bias and conflicts of interest, for example by not auditing their own work; 6) Evidence-based approach, ensuring conclusions are reliable and reproducible because they rest on verifiable evidence; and 7) Risk-based approach, focusing audit planning, conduct, and reporting on the matters most significant to the client and to achieving audit objectives. A Lead Auditor applies these principles while managing the audit team, planning activities, leading meetings, and producing an objective report.In the ISO/IEC 27001 Lead Auditor context, fundamental audit concepts and principles come mainly from ISO 19011 (Guidelines for auditing management systems) and ISO/IEC 17021-1 (requirements for certification bodies). An audit is a systematic, independent and documented process for obtaining object…
