1. Foundations of Quality Auditing and ISO Standardization

Introduction and Context

Quality auditing is one of the principal means by which organizations determine whether their management systems, processes, and results are controlled, effective, and capable of meeting specified requirements. It is more than an inspection exercise. A well-designed audit examines the relationship between intended arrangements and actual practice, evaluates evidence, identifies risks and opportunities, and supports informed managerial action.

The significance of auditing has increased as organizations have become more dependent on complex supply chains, regulated processes, outsourced activities, digital systems, and internationally recognized standards. Customers, regulators, owners, employees, and other interested parties increasingly expect organizations to demonstrate not merely that they produce acceptable outputs, but that they have reliable systems for achieving consistent performance.

Quality auditing must therefore be understood within the broader discipline of quality management. Quality assurance provides confidence that requirements will be met through planned and systematic arrangements. Quality control focuses on monitoring and correcting operational results. Quality improvement seeks better performance through learning, analysis, and change. Auditing connects these activities by providing independent, systematic, and evidence-based evaluation.

ISO standards provide a common vocabulary and internationally accepted frameworks for management systems and technical activities. However, an ISO standard is not a substitute for management judgment. Certification does not guarantee that every product is perfect or that every organizational decision is wise. Rather, it provides a structured basis for evaluating whether defined requirements are being met and whether the management system is capable of supporting intended outcomes.

Learning Objectives

After studying this chapter, the learner should be able to:

1. distinguish quality assurance, quality control, quality improvement, and quality management;

2. explain the purpose, principles, and evidence-based nature of quality auditing;

3. differentiate first-, second-, and third-party audits and explain their uses;

4. interpret conformity, nonconformity, correction, corrective action, certification, and accreditation;

5. describe the roles of ISO and other organizations in the international standards ecosystem;

6. evaluate the managerial value and limitations of certification and auditing;

7. apply audit concepts to organizational and supply-chain situations; and

8. recognize emerging digital, ethical, and governance issues in quality auditing.

Quality Management as the Setting for Auditing

Quality is commonly understood as the degree to which a set of inherent characteristics fulfills requirements. Requirements may be stated by customers, regulators, contracts, technical specifications, internal policies, or other interested parties. This definition is important because quality is not limited to luxury, durability, or customer satisfaction. A low-cost product can be high in quality if it consistently meets relevant requirements, while an expensive product can be poor in quality if it fails to do so.

Quality management is the coordinated activity used to direct and control an organization with regard to quality. It normally includes four closely related dimensions.

Quality planning establishes objectives, processes, responsibilities, resources, and acceptance criteria. Planning answers questions such as: What must be achieved? Which requirements apply? What process is needed? What risks may prevent success?

Quality assurance consists of planned and systematic activities that provide confidence that requirements will be fulfilled. Assurance is primarily preventive and system-oriented. Examples include competence management, supplier qualification, process validation, documented procedures, design reviews, and internal audits.

Quality control concerns operational techniques and activities used to fulfill requirements. It is often associated with inspection, testing, measurement, sampling, statistical process control, and the disposition of nonconforming outputs. Control is closer to the product or service than assurance, although the two cannot be separated completely.

Quality improvement seeks enhanced performance through planned change. It may involve reducing defects, shortening cycle time, improving reliability, increasing process capability, or strengthening customer experience. Improvement depends on evidence, but it also requires leadership, learning, experimentation, and the willingness to challenge established practices.

These distinctions should not be treated as rigid organizational boundaries. An inspection result may reveal a need for assurance, an audit may identify an improvement opportunity, and a corrective action may require changes to both process controls and management planning. Auditing is valuable because it examines whether these elements operate together rather than in isolation.

The Nature and Purpose of a Quality Audit

An audit is a systematic, independent, and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. Each part of this definition has practical significance.

A systematic audit follows an organized plan. It defines scope, objectives, criteria, methods, resources, responsibilities, and timing. A documented audit leaves an appropriate record of the plan, evidence, findings, conclusions, and follow-up. Independence means that auditors should be free from bias and conflicts of interest to the extent practicable. The auditor need not be external to the organization, but should not audit work for which he or she is directly responsible. Objective evidence includes records, statements of fact, observations, measurements, and other verifiable information relevant to the audit criteria. Finally, the auditor evaluates evidence against criteria rather than against personal preference.

Audit criteria are the policies, procedures, requirements, standards, contractual clauses, laws, regulations, or other expectations used as the reference point. Audit scope defines the boundaries of the audit, such as departments, locations, products, processes, time periods, or virtual activities. Audit objectives explain what the audit is intended to accomplish, for example assessing conformity, evaluating supplier capability, verifying corrective action, or identifying improvement opportunities.

An audit is not the same as an inspection. Inspection usually evaluates a product, service, or activity at a particular point. An audit examines arrangements and their implementation over a defined scope. Nor is an audit the same as a financial investigation, although financial, operational, and quality audits may overlap in risk-based organizations. Auditing is also not primarily a search for individual blame. Its more mature purpose is to understand whether processes are designed and controlled effectively and whether the system learns from failure.

Principles That Give Auditing Professional Credibility

The internationally recognized guidance for management-system auditing emphasizes principles that protect the reliability and usefulness of audit results. These principles can be interpreted as professional disciplines rather than ceremonial statements.

Integrity requires honesty, responsibility, competence, and ethical conduct. Auditors must report significant evidence even when findings are inconvenient to management.

Fair presentation requires accurate, balanced, and timely reporting. Audit conclusions should not exaggerate isolated weaknesses, conceal serious problems, or imply certainty beyond the available evidence.

Due professional care means applying sound judgment and diligence appropriate to the importance and complexity of the audit. An auditor should know when evidence is insufficient and when specialist assistance is necessary.

Confidentiality protects information obtained during the audit. Confidentiality does not authorize concealment of unlawful conduct or misrepresentation; rather, it requires responsible handling and disclosure through appropriate channels.

Independence supports impartiality and objectivity. The degree of independence may vary according to the audit type, but conflicts must be recognized and controlled.

Evidence-based approach means that conclusions are based on verifiable information. Audits rarely examine every transaction, so sampling is normally used. The auditor must therefore understand the limitations of sampling and avoid presenting a sample as complete proof of universal conformity.

Risk-based approach directs attention toward matters that can significantly affect intended outcomes. High-risk processes, critical suppliers, regulatory obligations, safety controls, information integrity, and repeated failures generally deserve greater audit attention than routine low-risk activities.

Together, these principles distinguish a professional audit from an informal tour, a compliance checklist, or a management inspection designed to confirm predetermined conclusions.

Audit Types and Their Organizational Uses

A first-party audit is conducted by, or on behalf of, the organization itself. Internal audits are first-party audits. They may assess conformity to an ISO management-system standard, internal procedures, legal obligations, customer requirements, or strategic objectives. Internal audits provide management with feedback before problems become external failures. Their value depends heavily on auditor competence, independence, and the willingness of leadership to act on findings.

A second-party audit is conducted by an organization on another organization with which it has, or intends to have, a relationship. Customers commonly audit suppliers to assess capability, production controls, traceability, change management, or compliance with contractual requirements. Second-party audits are particularly important when the customer cannot directly control outsourced processes.

A third-party audit is conducted by an independent organization that is not the customer or the audited organization. Certification audits performed by accredited certification bodies are a common example. Third-party audits may provide confidence to customers, regulators, and markets, but their value depends on the competence and impartiality of the certification body and on the adequacy of the certification process.

Audits may also be classified by purpose. A compliance audit evaluates conformity with specified requirements. A system audit examines the overall management system or a defined subsystem. A process audit evaluates how a process is planned, performed, controlled, and improved. A product or service audit examines whether outputs meet specified requirements. A follow-up audit verifies the implementation and effectiveness of actions taken in response to previous findings. A combined audit evaluates two or more management systems together, while a joint audit involves two or more auditing organizations cooperating on one audit.

The choice of audit type should reflect the decision to be supported. A supplier-selection decision may require a second-party process audit. A certification decision requires a structured third-party conformity assessment. A strategic review may benefit more from a risk-focused internal audit than from a clause-by-clause checklist.

Audit Evidence, Findings, and Conclusions

Audit evidence may be obtained through interviews, observation of activities, review of documented information, examination of records, sampling, measurement, data analysis, and confirmation from independent sources. No single method is automatically superior. Interviews reveal understanding and actual practice; observation reveals what happens in context; records demonstrate that activities were performed or results were obtained; data analysis may expose patterns that are invisible during a short site visit.

Evidence should be relevant, sufficient, and reliable. A statement by an employee may be useful, but it is stronger when supported by a record or direct observation. A single successful transaction does not necessarily demonstrate a controlled process. Conversely, one isolated error does not automatically prove systemic failure. Auditors must evaluate the significance, frequency, recurrence, and potential impact of evidence.

An audit finding is the result of evaluating collected evidence against audit criteria. Findings may indicate conformity, nonconformity, or opportunities for improvement, depending on the audit program and reporting rules. A nonconformity is the non-fulfillment of a requirement. It may be major or minor under the rules of a particular audit scheme, although the exact classification must be justified by the applicable requirements and procedures.

A correction addresses an identified nonconformity, such as reworking a defective unit, correcting a record, or replacing an incorrect label. Corrective action addresses the cause of the nonconformity to prevent recurrence. For example, correcting a mislabeled batch resolves the immediate problem; reviewing label-control design, training, approval, and verification may prevent repetition. Corrective action should be proportionate to the consequences and risk of the problem.

Audit conclusions summarize whether the objectives have been achieved and whether the management system or process conforms and is effective within the audit scope. Conformity alone does not necessarily mean excellence. A process may conform to documented requirements yet remain inefficient, fragile, or poorly aligned with future risks. This is why mature audits consider effectiveness, adequacy, and opportunities for improvement in addition to formal conformity.

Conformity, Certification, and Accreditation

Conformity is the fulfillment of a requirement. It is a relationship between evidence and a defined criterion. Without a clear criterion, an auditor may express an opinion, but cannot make a defensible conformity determination.

Certification is third-party attestation related to products, processes, services, systems, or persons, depending on the relevant scheme. In management-system certification, a certification body evaluates whether an organization’s system conforms to the applicable standard and whether it is implemented within the certified scope. Certification is normally maintained through surveillance and periodic recertification rather than established permanently by one audit.

Accreditation is a formal recognition by an authoritative body that a conformity-assessment body is competent to perform specified activities. Accreditation therefore concerns the organization that performs certification, inspection, testing, or related assessment. Certification and accreditation are not interchangeable. An organization may be certified to a management-system standard, while the certification body may be accredited to a standard governing the competence and impartiality of certification bodies.

This distinction is important in procurement and governance. A claim that a supplier is “ISO certified” should prompt questions: Which standard? What scope? Which certification body? Is the certificate current? Is the body accredited for the relevant scheme? Does the certified scope include the activity being purchased? A certificate without appropriate scope or credible oversight may provide little practical assurance.

Certification also has limits. It is based on defined criteria, sampling, and a specified scope. It cannot guarantee continuous conformity between audits, eliminate operational risk, or transfer management responsibility to the certification body. Management remains responsible for performance, legal compliance, product safety, and truthful communication.

ISO and the International Standards Ecosystem

The International Organization for Standardization, known as ISO, is an independent, nongovernmental international organization comprising national standards bodies. ISO develops voluntary international standards through technical committees and consensus-oriented processes involving national delegations and relevant stakeholders. ISO itself does not generally certify organizations. Certification is performed by independent conformity-assessment bodies.

ISO standards cover management systems, products, services, methods, terminology, testing, safety, and many other subjects. The ISO 9000 family is particularly significant in quality management. ISO 9000 provides concepts and vocabulary, ISO 9001 specifies requirements for a quality management system, and ISO 9004 offers guidance for achieving sustained organizational success. ISO 19011 provides guidance for auditing management systems. These standards serve different purposes and should not be treated as identical certification documents.

The international standards ecosystem also includes national standards bodies, regional standards organizations, regulators, accreditation bodies, certification bodies, testing and inspection laboratories, industry associations, customers, and professional institutions. The International Electrotechnical Commission develops standards in electrotechnical and related fields, while other international bodies develop standards for specialized sectors. The World Trade Organization’s Agreement on Technical Barriers to Trade encourages the use of relevant international standards in certain contexts, although standards do not replace national law.

Accreditation cooperation is supported internationally through organizations such as the International Accreditation Forum and the International Laboratory Accreditation Cooperation. Their arrangements seek to increase confidence that accredited conformity-assessment results can be recognized across borders. The precise legal and institutional arrangements vary by country, so professionals must understand the national accreditation infrastructure relevant to their operations.

Standards are generally voluntary unless incorporated into legislation, contracts, licensing conditions, procurement rules, or organizational policy. A standard’s authority therefore comes from its adoption and application, not merely from its publication. Organizations should avoid treating standards as paperwork systems detached from operational outcomes.

Applying Audit Thinking in Organizations

An effective audit program begins with purpose and risk. Management should define the processes and results that matter most, consider previous performance and changes, and allocate competent auditors accordingly. The program should cover relevant requirements over a suitable period without reducing every audit to equal treatment of unequal risks.

Planning should establish scope, criteria, objectives, methods, timing, responsibilities, and reporting arrangements. Auditors should study relevant documented information before fieldwork and identify questions that test process effectiveness. During the audit, they should follow evidence rather than simply follow the sequence of a checklist. A useful process-based question is: What is the intended output, what inputs and controls are required, how is performance measured, and how does the process respond when results are unsatisfactory?

Reporting should be clear enough for management to act. A strong finding identifies the requirement, objective evidence, and the nature and significance of the gap. Vague statements such as “the department needs improvement” are difficult to verify and easy to dispute. Follow-up should evaluate not only whether an action was completed, but whether it addressed the cause and produced effective results.

Auditing can also support integrated management. Quality, environmental, occupational health and safety, information security, business continuity, and energy systems often share common processes such as leadership, competence, documented information, internal audit, corrective action, and management review. Combined audits may reduce duplication, but they require auditors who understand the distinct risks and requirements of each discipline.

Illustrative Case: Supplier Traceability in a Medical-Device Manufacturer

Background. MedSure Components, a fictional manufacturer of precision housings for medical devices, had maintained certification to a quality management standard for several years. Its internal audit program focused mainly on document control and final inspection. Customer complaints were low, but one important customer requested evidence of stronger supplier traceability after a change in raw-material sources.

Situation and problem. An internal auditor sampled purchase records, material certificates, and production travelers. The documents appeared complete. However, interviews and observation showed that operators sometimes transferred material from opened containers into smaller bins without transferring the lot identification. The final product could be linked to a production order, but not always to the precise raw-material lot. The organization had conformity on many records, but a weakness in process control and traceability.

Analysis. The audit team avoided blaming individual operators. It mapped the process from purchasing through receipt, storage, issue, production, and shipment. The analysis identified three contributing conditions: the procedure described receipt labeling but not container splitting; the information system permitted printing a production traveler without a material-lot confirmation; and supervisors checked completed records but did not routinely observe material movement. The potential impact was significant because an affected lot might be difficult to isolate during a recall.

Approach and solution. Management contained the immediate risk by reviewing recent production and reconciling available material records. It then revised the material-handling process, required labels on secondary containers, introduced a system validation step before production release, and trained personnel using realistic transfer scenarios. The internal audit program was revised to include risk-based process audits and effectiveness checks rather than concentrating on documents alone.

Outcome. A follow-up audit found that the revised controls were implemented and that sampled material movements retained lot identity. The organization also identified a broader opportunity: traceability data could be used to analyze supplier performance and shorten the time required for containment. The case demonstrates that certification status did not itself reveal the weakness. Competent auditing connected documented requirements, actual work, information-system controls, and business risk.

Learning points. First, records can appear complete while the underlying process is not fully controlled. Second, audit evidence should come from multiple sources. Third, correction and corrective action are different. Fourth, a risk-based audit may produce more value than a repetitive clause checklist. Finally, digital controls are useful only when they reflect and reinforce the real process.

Challenges, Risks, and Common Mistakes

A frequent mistake is confusing certification with quality. Organizations may pursue a certificate primarily for marketing or tender eligibility and create a documentation system that is disconnected from work. This encourages superficial compliance and weakens the learning function of auditing.

Another risk is auditor bias. Auditors may avoid difficult findings because of hierarchical pressure, commercial relationships, familiarity with the process, or fear of damaging performance ratings. Independence, rotation, technical competence, clear escalation routes, and leadership support are important safeguards.

Checklist dependence is also problematic. Checklists improve consistency, but rigid use can prevent auditors from following unexpected evidence. Auditors should use checklists as memory aids and sampling guides, not as substitutes for process understanding.

Weak findings create weak corrective actions. If the requirement and evidence are unclear, departments may respond with repeated training even when the real cause is poor design, incompatible software, inadequate resources, or unrealistic targets. Root-cause analysis should be proportionate and should examine systemic conditions.

Sampling creates unavoidable uncertainty. Auditors should define sampling logic, consider the size and risk of the population, and avoid overgeneralizing from a very small sample. Remote audits introduce additional concerns, including restricted visibility, unreliable electronic evidence, cybersecurity, privacy, and the possibility that an interviewee is being coached.

Ethical concerns include confidentiality, conflicts of interest, manipulation of records, retaliation against employees who provide evidence, and misuse of audit reports. Organizations should protect whistleblowers, preserve audit integrity, and ensure that audit information is used for responsible governance rather than personal punishment.

Digital Auditing and Emerging Practice

Digital technologies are changing how audits are planned and performed. Enterprise systems can provide transaction trails, automated exception reports, supplier-performance dashboards, and real-time process data. Remote and hybrid audits can use secure document sharing, video observation, electronic interviews, and virtual tours. Data analytics can help auditors identify unusual patterns, duplicate records, late approvals, abnormal process variation, or repeated corrective-action failures.

Artificial intelligence may assist with document classification, trend detection, sampling suggestions, and natural-language analysis of complaints or audit reports. Such tools should support, not replace, professional judgment. AI-generated conclusions may reproduce biased data, overlook context, or expose confidential information. Organizations must address access controls, data quality, explainability, human review, retention, and cybersecurity.

A further development is the movement from periodic, retrospective auditing toward more continuous assurance. Continuous monitoring can provide earlier warning of process deterioration, but frequent data does not automatically produce better assurance. Indicators must be connected to meaningful risks, and organizations must avoid optimizing a metric while neglecting the underlying objective.

Best Practices for Professional Quality Auditing

The following practices support an effective audit culture:

• align the audit program with organizational risks, objectives, and stakeholder requirements;
• define clear scope, criteria, and evidence expectations before fieldwork;
• select auditors for competence, impartiality, and relevant technical understanding;
• combine interviews, observation, records, and data rather than relying on one source;
• distinguish isolated error, process weakness, and systemic failure;
• write findings that connect requirements, evidence, and significance;
• require corrective actions that address causes and verify their effectiveness;
• protect confidentiality and encourage truthful communication;
• use digital tools with appropriate human oversight and information security; and
• review the audit program itself for usefulness, coverage, and improvement.

Chapter Summary

Quality auditing is a systematic, independent, documented, and evidence-based process for evaluating conformity and effectiveness against defined criteria. It operates within quality management, which includes planning, assurance, control, and improvement. First-party, second-party, and third-party audits serve different organizational and commercial purposes. Professional auditing depends on integrity, fair presentation, due care, confidentiality, independence, evidence, and risk-based thinking.

Conformity means fulfilling a requirement. Correction addresses an immediate problem, whereas corrective action addresses its cause. Certification is third-party attestation against specified criteria; accreditation recognizes the competence of conformity-assessment bodies. ISO develops voluntary international standards but does not generally certify organizations. The wider standards ecosystem includes national standards bodies, regulators, accreditation organizations, certification bodies, laboratories, customers, and industry institutions.

Audits create value when they examine real processes, connect evidence to risk, and lead to effective action. They lose value when certification is treated as a guarantee, checklists replace judgment, or findings are used for blame. Digital analytics, remote auditing, AI assistance, and continuous assurance offer new capabilities but also create risks involving bias, privacy, cybersecurity, and overreliance on automated conclusions.

Key Terms

Accreditation: Formal recognition that a conformity-assessment body is competent to perform specified activities.

Audit criteria: Policies, procedures, standards, legal requirements, contracts, or other requirements used as a reference for comparison.

Audit evidence: Verifiable records, statements, observations, measurements, or other information relevant to audit criteria.

Audit scope: The boundaries and extent of an audit.

Certification: Third-party attestation that specified requirements have been fulfilled.

Conformity: Fulfillment of a requirement.

Corrective action: Action taken to eliminate the cause of a nonconformity and prevent recurrence.

Correction: Action taken to eliminate an identified nonconformity.

First-party audit: An audit conducted by or for the organization itself.

Internal audit: A first-party audit used to evaluate an organization’s own systems or processes.

Nonconformity: Non-fulfillment of a requirement.

Objective evidence: Information that can be verified and supports an audit conclusion.

Quality assurance: Planned and systematic activities that provide confidence that requirements will be fulfilled.

Quality control: Operational techniques and activities used to fulfill quality requirements.

Quality improvement: Planned activity intended to enhance performance or capability.

Risk-based approach: Directing attention and resources according to the likelihood and consequences of unwanted outcomes.

Second-party audit: An audit conducted by one organization on a supplier or other related organization.

Third-party audit: An audit conducted by an independent organization.

Traceability: Ability to follow the history, application, location, or related information of an item or activity.

Review Questions

Short Answer Questions

1. How does quality assurance differ from quality control?

2. What is meant by objective evidence in an audit?

3. Distinguish correction from corrective action.

4. Why is independence important in auditing?

5. What is the relationship between certification and accreditation?

Long Answer Questions

1. Explain the purpose, principles, and organizational value of quality auditing.

2. Compare first-party, second-party, and third-party audits, including appropriate uses for each.

3. Discuss how ISO contributes to international standardization and explain its relationship with certification bodies.

4. Describe how audit findings should be developed, reported, and followed up.

5. Critically evaluate the benefits and limitations of management-system certification.

Analytical / Application Questions

1. A supplier has an apparently valid ISO certificate, but repeated delivery failures occur. Design an audit approach that would determine whether the certificate provides meaningful assurance.

2. An auditor finds one mislabeled material container but all sampled final products meet specification. Explain what additional evidence is needed before classifying the issue and deciding on corrective action.

3. An organization plans to use AI to analyze audit records and recommend findings. Identify the potential benefits, risks, governance controls, and human responsibilities involved.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes quality assurance from quality control?

A. Quality assurance is preventive and system-oriented, while quality control focuses on operational fulfillment and results.

B. Quality assurance applies only to suppliers, while quality control applies only to customers.

C. Quality assurance identifies defective products, while quality control develops organizational strategy.

D. There is no meaningful distinction between the two concepts.

Correct Answer: A. Quality assurance is preventive and system-oriented, while quality control focuses on operational fulfillment and results.

Question 2

An auditor compares observed material-handling practices with a documented procedure and identifies a gap. What is being used as the reference point?

A. Audit scope

B. Audit criteria

C. Audit conclusion

D. Accreditation

Correct Answer: B. Audit criteria

Question 3

A customer audits a prospective supplier’s process capability before awarding a contract. This is primarily what type of audit?

A. First-party audit

B. Third-party audit

C. Second-party audit

D. Certification audit

Correct Answer: C. Second-party audit

Question 4

Which action most directly represents corrective action rather than correction?

A. Replacing a product with an incorrect label

B. Separating defective units from acceptable units

C. Reprinting a missing inspection record

D. Redesigning the labeling-control process to prevent recurrence

Correct Answer: D. Redesigning the labeling-control process to prevent recurrence

Question 5

What does accreditation primarily recognize?

A. The competence of a conformity-assessment body for specified activities

B. The profitability of a certified organization

C. The conformity of every product made by an organization

D. The legal validity of all international standards

Correct Answer: A. The competence of a conformity-assessment body for specified activities

Question 6

Why should an auditor use interviews, observation, records, and data together?

A. To make the audit longer regardless of risk

B. To obtain more reliable and contextual evidence than one source may provide

C. To avoid defining audit criteria

D. To replace sampling with complete examination

Correct Answer: B. To obtain more reliable and contextual evidence than one source may provide

Question 7

A management-system certificate is current, but its scope excludes the production site being evaluated. What is the most appropriate conclusion?

A. The certificate automatically covers every site owned by the organization.

B. The certificate proves that the excluded site conforms.

C. The certificate should not be treated as assurance for the excluded activity.

D. Accreditation makes scope irrelevant.

Correct Answer: C. The certificate should not be treated as assurance for the excluded activity.

Question 8

Which audit principle requires conclusions to be based on verifiable information rather than personal preference?

A. Confidentiality

B. Evidence-based approach

C. Fair presentation

D. Due professional care

Correct Answer: B. Evidence-based approach

Question 9

An organization repeatedly closes corrective actions by retraining employees, although failures are caused by incompatible software. What weakness does this most clearly indicate?

A. Failure to address root causes

B. Excessive audit independence

C. Correct use of risk-based auditing

D. Appropriate distinction between correction and corrective action

Correct Answer: A. Failure to address root causes

Question 10

What is a major governance concern when AI is used to recommend audit findings?

A. AI eliminates the need for audit criteria.

B. Automated analysis may contain bias or lack contextual judgment, requiring human oversight.

C. AI guarantees complete evidence from every transaction.

D. AI makes confidentiality and cybersecurity irrelevant.

Correct Answer: B. Automated analysis may contain bias or lack contextual judgment, requiring human oversight.