An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. This definition, associated particularly with ISO 19011 and ISO 9000 terminology, distinguishes auditing from inspection, supervision, routine checking and consultancy. An audit does not merely search for errors. It evaluates whether planned arrangements exist, whether they are implemented, and whether they are effective in relation to stated criteria.

In total quality management (TQM), auditing provides a disciplined method for learning about organizational processes. It supports assurance, improvement, risk management, regulatory compliance and informed management decision-making. However, an audit is only as reliable as its criteria, evidence, sampling, auditor competence, independence and reporting discipline.

This chapter establishes the conceptual vocabulary required for planning, conducting and interpreting audits. It also distinguishes audit types according to the relationship between parties, the object of examination, the purpose and the method of execution.

Learning Objectives

1. The Audit Concept

An audit is an organized inquiry based on evidence rather than impression. Four characteristics are central.

Systematic. Audit activities are planned and performed according to an agreed method. The auditor defines the objectives, scope and criteria, prepares an audit plan, gathers evidence and reports results.

Independent. Auditors should be free from bias and conflicts of interest. Independence is relative to the audit context: an internal auditor may belong to the organization but should not audit work for which they are directly responsible.

Documented. Audit plans, working papers, evidence records, findings and reports provide traceability. Documentation also permits review, follow-up and organizational learning.

Evidence-based. Conclusions must be supported by verifiable information. Evidence may include records, observations, interviews, measurements, system data and samples of work.

An audit is not necessarily a search for nonconformity. A well-designed audit also identifies conformity, effective practices, risks, opportunities for improvement and weaknesses in the management system.

Audit, inspection, review and assessment

These activities overlap but are not identical. Inspection generally determines whether a product, service or activity meets specified requirements, often through direct examination or measurement. A review is a broader evaluation of suitability, adequacy or progress, and may not follow the formal evidence and independence requirements of an audit. Assessment commonly involves judging capability or maturity against a model. An audit may include inspection or review techniques, but it has a defined audit purpose, criteria and evidence-based conclusion.

Consultancy differs more sharply from auditing. A consultant recommends or helps implement solutions; an auditor evaluates against criteria. Combining these roles can compromise independence, especially where the same person designs a process and later audits it.

2. Essential Audit Terminology

Audit client and auditee

The audit client is the person or organization requesting the audit. The client may be senior management, a regulator, a customer, a certification body or another interested party. The client determines, or authorizes determination of, the audit objectives and may receive the report.

The auditee is the organization, process, department or person being audited. An auditee is not necessarily an organization as a whole; it may be a supplier, a production line, a project or a service team.

The audit team consists of one or more auditors and, where needed, technical experts. A lead auditor coordinates the audit. A technical expert provides specialized knowledge but normally does not independently make audit judgments unless qualified as an auditor.

Audit objectives, scope and criteria

Audit objectives state what the audit is intended to accomplish. Examples include determining conformity with a quality management standard, evaluating supplier capability, verifying corrective action or assessing process performance.

Audit scope describes the boundaries and extent of the audit. It may specify organizational units, locations, activities, products, processes, time periods and interfaces. Scope must be realistic. A report cannot credibly claim conclusions about activities that were excluded from the scope.

Audit criteria are the requirements or reference points against which evidence is compared. Criteria may include standards, laws, regulations, contracts, customer specifications, organizational procedures, policies, process targets and approved design requirements. Criteria should be identifiable, current, applicable and sufficiently clear to support consistent judgment.

Audit evidence

Audit evidence consists of records, statements of fact or other information relevant to the audit criteria and verifiable. Evidence can be documentary, physical, electronic, observational or testimonial.

Evidence is not automatically proof of conformity. A procedure demonstrates intended arrangements, not necessarily implementation. An interview indicates knowledge or practice, but may require corroboration. A single satisfactory record cannot establish consistent performance across a large population.

Findings and conclusions

An audit finding is the result of evaluating collected evidence against criteria. Findings may indicate conformity, nonconformity or an opportunity for improvement, depending on the audit purpose and reporting rules.

A nonconformity exists when a requirement is not fulfilled. A finding should identify the requirement, provide objective evidence and state the gap clearly. It should not exaggerate the evidence or speculate about causes.

An audit conclusion is the overall result of the audit after considering objectives and all findings. It may state that the audited system conforms within the sampled scope, that specified requirements are not fully met, or that further action is necessary. A conclusion is broader than an individual finding but must remain within the evidence and scope of the audit.

Audit programme and audit plan

An audit programme is a set of one or more audits planned for a specific time frame and directed toward a particular purpose. Programme management includes determining priorities, resources, risks, auditor competence, methods and follow-up.

An audit plan describes the arrangements for one audit: objectives, scope, criteria, schedule, locations, roles, methods, reporting arrangements and logistical requirements. The programme is the portfolio-level structure; the plan is the operational design for an individual audit.

3. Principles Supporting Credible Audits

Integrity requires honesty, responsibility, impartiality and compliance with applicable requirements.

Fair presentation requires accurate and complete reporting of audit activities, evidence, findings, obstacles and unresolved disagreements. Significant limitations should not be concealed.

Due professional care means applying judgment appropriate to the importance and complexity of the audit. Auditors should be cautious, analytical and proportionate.

Confidentiality protects information obtained during the audit. Confidential information should be disclosed only with authorization or when legally required.

Independence supports objectivity and reduces self-review risk. Conflicts of interest should be declared and managed.

Evidence-based approach ensures that rational conclusions can be reached through a systematic process of sampling and verification.

Risk-based approach directs attention toward matters that can significantly affect objectives, customers, compliance, safety, quality or organizational performance. Risk-based auditing does not permit the auditor to ignore lower-risk requirements without a justified scope decision.

These principles also provide criteria for evaluating the quality of the audit process itself.

4. Classification by Relationship Between Parties

First-party audit

A first-party audit is conducted by or on behalf of the organization itself. It is commonly called an internal audit. Internal auditors may be employees or external persons engaged by the organization, provided the audit is performed on the organization’s behalf.

Uses include management-system evaluation, process improvement, readiness assessment, risk review and verification of corrective action. Internal auditing can examine issues deeply because auditors have access to organizational information. Its main risks are insufficient independence, organizational politics and normalization of poor practice.

Second-party audit

A second-party audit is conducted by a party with an interest in the organization, usually a customer auditing a supplier or a purchaser auditing a contractor. It may evaluate capability, contract conformity, product assurance, delivery reliability, business continuity or supplier improvement needs.

Second-party audits can be more commercially focused than internal audits. The auditor must distinguish contractual requirements from personal preferences. A customer’s audit authority should be established in the contract or supplier agreement.

Third-party audit

A third-party audit is conducted by an independent organization that is not the customer or auditee. Certification, registration and regulatory audits are common examples, although regulatory arrangements vary by jurisdiction.

Third-party audits require strong impartiality and competence controls. A certification audit is not a guarantee that every product is defect-free or that all future performance will remain satisfactory. It is an independent evaluation against a defined certification scope and applicable requirements.

Classification	Auditor relationship	Typical purpose	Main risk
First-party	Organization audits itself	Improvement and internal assurance	Loss of independence
Second-party	Interested customer or purchaser	Supplier assurance and contract control	Commercial bias or excessive demands
Third-party	Independent external body	Certification or independent assurance	Misunderstanding the limited scope

5. Classification by Audit Object and Purpose

Management-system audit

A system audit evaluates the interrelated processes and arrangements through which an organization achieves objectives. It may examine leadership, planning, resources, operations, evaluation and improvement. The question is not only whether documents exist, but whether the system functions as an integrated mechanism.

Process audit

A process audit evaluates a defined process from inputs through activities and outputs. It examines process controls, resources, responsibilities, risks, measures and results. A process audit may use a turtle-style analysis: inputs, outputs, methods, resources, responsibilities and measures. It is especially useful for finding causes that are hidden when only final products are inspected.

Product or service audit

A product audit evaluates a product against specified characteristics such as dimensions, functionality, labeling, safety or packaging. A service audit evaluates service delivery against requirements such as response time, accuracy, courtesy or completion.

Product auditing can detect output defects but may not reveal why they occurred. It should therefore complement, rather than replace, process and system auditing.

Compliance or conformity audit

A compliance audit determines whether legal, regulatory, contractual or internal requirements are fulfilled. It requires careful identification of the authoritative requirement and its current version. Auditors should distinguish a legal obligation from guidance or a preferred practice.

Performance audit

A performance audit examines whether activities achieve intended results economically, efficiently, effectively and consistently. It may evaluate indicators such as defect rates, delivery reliability, rework, customer satisfaction or process capability. Performance data require context: a favorable average may conceal severe variation, inequity or isolated critical failures.

Financial and information-security-related audits

Financial audits focus on financial statements and controls, normally under specialized professional frameworks. Information security audits examine controls related to confidentiality, integrity, availability, access, continuity and information risk. These audits illustrate that criteria and auditor competence must be matched to the subject matter.

6. Classification by Method and Timing

Remote audit

A remote audit uses information and communication technology to obtain evidence when the auditor and auditee are not physically present together. Methods include secure document review, video interviews, screen sharing, live process observation and electronic sampling.

Remote auditing can reduce travel, increase access to dispersed sites and support frequent reviews. Its limitations include unreliable connectivity, restricted visibility of physical conditions, difficulty verifying identity or records, cybersecurity risks and the possibility that demonstrations are selectively presented. The audit plan should specify technology, privacy controls, contingency arrangements and how physical evidence will be verified.

Remote is a method, not a level of assurance. A remote audit may be rigorous or weak depending on planning, evidence quality and execution.

Integrated audit

An integrated audit combines audits against two or more sets of criteria in a coordinated engagement. For example, one audit team may evaluate quality, environmental and occupational health and safety arrangements. Integration reduces duplication and allows examination of interactions among systems.

The auditor must maintain traceability to each criterion. One interview or record should not be assumed to satisfy unrelated requirements merely because it is convenient. The team needs competence across the relevant subject areas.

Follow-up audit

A follow-up audit evaluates actions taken in response to previous findings. It determines whether correction was completed, whether root causes were addressed, and whether corrective action is effective. Closure of an action record is not necessarily evidence of effective prevention.

Follow-up may be a focused review or part of a subsequent full audit. The extent should reflect the significance and risk of the original finding.

7. From Criteria to Conclusions: The Audit Reasoning Chain

For example, suppose a procedure requires calibration of measuring equipment before its due date. The auditor identifies the requirement as the criterion. The calibration register, equipment label and calibration certificate are evidence. If an instrument used for final acceptance was overdue, the evaluation identifies a gap. The finding states the requirement and objective evidence. The conclusion considers whether this is isolated or systemic. Management then determines correction and corrective action.

The quality of the conclusion depends on the quality of the chain. Weak criteria produce arbitrary findings; weak evidence produces unsupported claims; poor evaluation produces inconsistent judgments; and overgeneralized conclusions exceed the audit scope.

Sampling and professional judgment

Audits usually examine a sample rather than every transaction. Sampling is necessary because time and resources are limited, but it introduces uncertainty. The auditor should define the population, sampling logic, selection method and rationale. Samples may be risk-based, random, systematic or judgmental. Judgmental sampling can target high-risk items but may not represent routine performance.

A sample finding should be described accurately. If one record is defective, the auditor may report that record as evidence of nonconformity, but should not claim that all records are defective unless additional evidence supports that conclusion. The auditor should seek corroboration and consider the significance, recurrence and potential impact.

8. Audit Findings: Clear and Defensible Formulation

A finding should avoid vague language such as “control is poor” or “staff lack commitment.” Better wording identifies observable conditions. For example: “The maintenance procedure requires monthly verification of emergency stop devices. In three of the five sampled production cells, the February verification record was absent, and operators could not provide evidence that the checks had been completed.”

Root cause analysis belongs primarily to the auditee’s corrective-action process, although auditors may identify patterns and risk implications. Auditors should not impose an unverified root cause merely to make a finding appear complete.

9. Case Study: Supplier Audit at Meridian Medical Devices

Background

Meridian Medical Devices purchases molded polymer housings from Apex Plastics. Customer complaints indicate intermittent difficulty assembling the housing with an internal electronic module. Meridian requests a second-party process and product audit.

Problem and audit design

The audit objectives are to determine whether Apex’s molding and inspection processes conform to the contract, whether product dimensions are controlled, and whether previous corrective actions are effective. The scope includes material receipt, molding, dimensional inspection, nonconforming-product control and shipment. Criteria include the supply agreement, approved drawing, inspection plan and relevant internal procedures.

The audit team selects records from three production lots, observes one molding changeover, interviews operators and examines measurement equipment. It also performs traceability checks from finished housings back to resin batch and machine settings.

Analysis

The drawing specifies a critical internal diameter of 50.00 ± 0.10 mm. The auditor finds that the inspection plan lists the characteristic but does not specify the sampling frequency required by the contract. Two lots have measurements recorded, but a third lot has no dimensional results. A gauge used for the measurements has a calibration certificate that expired before production of the third lot.

The evidence supports a nonconformity against the contractually required inspection and equipment-control provisions. It does not, by itself, prove that every housing in the third lot is dimensionally defective. The auditor therefore separates the control failure from the unproven product disposition question.

Approach and solution

Apex contains the affected lot, performs a documented risk assessment, verifies the gauge against a traceable standard and reinspects product using an appropriate instrument. It revises the inspection plan to define sampling and escalation rules, introduces an automated calibration-alert system and trains responsible personnel. Meridian conducts a focused follow-up audit after two production cycles.

Outcome

The follow-up confirms that the revised plan is implemented, calibration alerts operate, and records exist for the sampled lots. However, one operator cannot explain the escalation rule for an out-of-tolerance result. The corrective action is therefore not fully effective: documentation and system controls improved, but competence remains incomplete.

Learning points

The case demonstrates that a product problem may originate in process controls. It also illustrates the distinction between evidence of a control failure and evidence of defective output, the importance of explicit criteria, the role of sampling, and the need for follow-up to test effectiveness rather than merely completion.

10. Governance, Ethics and Contemporary Practice

Auditors handle commercially sensitive, personal and sometimes safety-critical information. They should apply access controls, minimize unnecessary collection, protect personal data and follow contractual and legal requirements. Audit records should have retention and disposition rules. Digital evidence must preserve authenticity, access history and, where relevant, audit trails.

Artificial intelligence can assist with document classification, anomaly detection, trend analysis and sample selection. It should not replace auditor judgment. AI outputs may reproduce biased data, overlook context, expose confidential information or generate apparently plausible but unsupported conclusions. Human auditors remain responsible for verifying evidence, explaining judgments and protecting confidentiality.

Contemporary auditing increasingly emphasizes risk, resilience, supply-chain dependencies, climate-related disruption, cybersecurity and organizational culture. These subjects expand the relevance of auditing but also create measurement and criteria challenges. Auditors should avoid treating fashionable indicators as evidence of effectiveness unless definitions, data quality and decision relevance are established.

11. Challenges and Limitations

Audits have inherent limitations. Sampling cannot provide absolute certainty. Interviews may be influenced by memory, fear or social desirability. Documents may be incomplete or retrospectively prepared. Auditees may temporarily improve behavior during an announced audit. Metrics may be manipulated or may measure activity rather than outcomes. Auditors can also suffer from confirmation bias, anchoring on initial impressions or excessive reliance on checklists.

These limitations are managed—not eliminated—through competent auditors, triangulation of evidence, risk-based sampling, clear criteria, suitable audit duration, independent review and transparent reporting. A checklist is a memory aid, not a substitute for process understanding or professional judgment.

Best-Practice Guidance

Chapter Summary

Auditing is a systematic, independent and documented process for obtaining and evaluating objective evidence against defined criteria. Its credibility depends on integrity, independence, confidentiality, fair presentation, professional care, evidence-based reasoning and risk-based attention. Core terms include audit client, auditee, objectives, scope, criteria, evidence, findings, conclusions, audit programme and audit plan.

First-party audits support internal assurance and improvement; second-party audits address customer or supplier interests; and third-party audits provide independent external evaluation. Audits may also be classified as system, process, product or service, compliance, performance, remote, integrated or follow-up audits. These classifications describe different objects, purposes or methods and may be combined in one engagement.

The central reasoning chain is criteria → evidence → evaluation → finding → conclusion → action. Sampling, competence, clear reporting and follow-up are essential because audits provide reasonable, bounded assurance rather than absolute certainty. Ethical governance requires impartiality, confidentiality, secure information handling and responsible use of technology. Properly designed audits are not merely control mechanisms; they are instruments for learning, risk reduction and continual improvement.

Key Terms

Audit: Systematic, independent and documented process for evaluating evidence against criteria.

Audit conclusion: Overall result reached after considering audit objectives and findings.

First-party audit: Audit conducted by or on behalf of the organization itself.

Remote audit: Audit using information and communication technology when parties are geographically separate.

Follow-up audit: Audit evaluating actions and effectiveness after previous findings.

Review Questions

Short Answer Questions

Long Answer Questions

Analytical / Application Questions

Multiple Choice Questions with Answers

Question 1

Which characteristic most directly requires an audit conclusion to be supported by verifiable information?

Question 2

A customer audits a supplier against contractual requirements. What type of audit is this?

Question 3

Which term describes the requirements against which audit evidence is evaluated?

Question 4

An audit examines inputs, activities, controls, measures and outputs of a manufacturing operation. It is primarily a:

Question 5

Correct Answer: B. To determine whether actions were implemented and effective

Question 6

Correct Answer: B. It is a method that uses information and communication technology

Question 7

Correct Answer: C. The requirement, objective evidence and the identified gap

Question 8

An audit evaluating quality and environmental management arrangements in one coordinated engagement is a(n):

Question 9

Correct Answer: B. A procedure shows intended arrangements but not necessarily implementation

Question 10

Correct Answer: C. State the sample and limit conclusions to supported evidence

Chapter 2 Audit Concepts, Terminology and Classification

Audit Concepts, Terminology and Classification

Introduction