Audit Fundamentals

What you'll be able to do

• ›Distinguish first, second, and third-party audits and manage threats to auditor objectivity
• ›Build a criteria and evidence plan with a defined population and sampling rationale
• ›Judge evidence sufficiency, relevance, reliability, and limits before drawing conclusions
• ›Write supported findings and explain ethical reporting using ISO 19011 principles

An assurance question at Cedar Vale Dispatch

Audit fundamentals (AF) labels exercise records. Imagine leaving a job and finding that your old work account still opens. You would want someone to check when access ended. Cedar Vale Dispatch is a fictional parcel scheduler. Its customers want assurance that departing workers lose production access within 24 hours. You are the analyst preparing an audit of April departures. Your job is to compare verifiable evidence with agreed requirements, not promise that every account is safe.

Agree the objective, scope, criteria, reporting audience, access arrangements, and limitations before testing. Here the objective is to assess compliance with the departure control. Scope is production accounts for workers departing during April. Payroll accuracy and all other months are outside this engagement. Record dependencies rather than silently treating them as tested.

Classify the relationship, not the invoice

You can check your own shopping receipt, or a customer can check your delivery. Who asks for the check matters more than who pays the checker. An internal audit is conducted by or on behalf of an organization for its own purposes. This is a first-party audit even if an outside contractor supplies the auditors. External describes a relationship outside that internal audit arrangement, not simply whether an auditor receives a supplier invoice.

A customer auditing Cedar Vale against its supplier contract is a second-party audit, including when the customer appoints an agent. An independent certification body assessing a management system is a third-party audit. Certification is not a guarantee of perfect security, and a customer review does not become certification because the customer hires a respected consultant.

Write the commissioning party, intended users, applicable requirements, and assurance purpose in the engagement record. Different audit types can test the same access records while serving different decisions. Do not equate first, second, and third party with the three lines model, which describes organizational risk and assurance roles.

Protect independence and objectivity

Imagine marking your own test. Even if you try to be fair, someone else should check your work. Independence concerns freedom from influences that compromise the audit role, including reporting arrangements and conflicts. Objectivity is the impartial mindset used to evaluate evidence. A structurally independent auditor can still show confirmation bias. A sincere auditor can still face an unacceptable self-review threat.

An auditor who configured the departure workflow should disclose that involvement before assignment. Reassign testing or introduce a suitable independent reviewer and document why the safeguard is adequate. Management owns control decisions and work to fix the problem. Auditors may explain a requirement or recommend improvement without approving transactions or taking responsibility for control operation.

Agree a route to the audit sponsor for denied access, pressure to omit a finding, or a personal relationship with the control owner. Report restrictions and safeguards transparently. A new email address or a promise to be fair does not remove a conflict.

Set criteria before selecting evidence

Before checking a receipt, agree which price list applies. You need an agreed rule before deciding whether something is wrong. Audit criteria are the requirements used as the comparison benchmark: applicable laws, contract terms, approved policy, or agreed management-system requirements. Record the exact source, version, effective date, and applicable population. International Organization for Standardization (ISO) 27001 clause 9.2 concerns internal audit, but citing its number alone does not define the detailed access deadline being tested.

For this exercise, approved access control (AC) policy AC-4 version 3 sets a production access removal deadline. Removal is required within 24 elapsed hours of the human resources (HR) effective departure timestamp. The audit examines April departures. Compare HR timestamps with production identity-provider disable events in Coordinated Universal Time (UTC). A policy approved in May is not automatically the criterion for April, and an auditor preference for immediate disablement is not a requirement.

Separate design from operation. A policy and configured workflow may support a design assessment, but operating effectiveness needs dated records showing the workflow actually ran. Agree how disputed requirements will be interpreted before seeing results, and preserve any unresolved disagreement in the report.

Build a traceable evidence chain

A receipt with a date and shop name is easier to check than a cropped photo. You need records that others can trace and trust. Evidence can include documentary records, interviews, direct observation, analytical comparisons, and auditor reperformance. Inquiry helps explain a process. A confident statement alone rarely establishes that every departure met a deadline. Observation shows what happened at the observed time, not necessarily during April. Reperformance can test a calculation independently if the source inputs are trustworthy.

Sufficiency concerns enough evidence for the scope and risk. Appropriateness concerns relevance and reliability. Reliability depends on source and history, integrity, completeness, timing, and how the record was generated. Direct read-only exports with query parameters and reconciled totals are usually more persuasive than a cropped screenshot. But Even a system log can omit deleted accounts or exclude a tenant.

Keep source identifiers, extraction time, filters, time zone, transformations, and links from each tested item to the conclusion. Reconcile HR departures to the export and investigate missing matches. Protect personal data with restricted storage and approved retention. More copies of one weak screenshot do not create independent support from other evidence.

Sample for the decision you need

If a box holds 12 eggs, you can inspect every egg. A larger delivery needs a clear plan for which eggs to inspect. Define the population and sampling unit before choosing items. In the lab there are 12 April production departures, so inspect all 12 rather than present a convenience subset as representative. Full-population testing removes selection sampling risk for this population, but does not remove errors in the source data, extraction, interpretation, or execution.

For a larger population, specify the objective, risk, tolerable deviation, expected exceptions, selection method, and rationale for sample size. Random or systematic selection can support a statistical design when its assumptions hold. Judgmental high-risk selection can target privileged leavers but cannot by itself justify a statistical estimate of the whole population.

Investigate exceptions, assess whether they share a cause, and extend work when warranted. Do not replace failed sample items with passing ones. Document population coverage and limitations, and do not extrapolate two exceptions from a deliberately selected high-risk sample as a precise organization-wide failure rate.

Write findings that another analyst can verify

If a delivery arrives late, record the promised time and actual arrival time. Keep the facts separate from guesses about the delay. A useful finding links condition, criteria, cause, and effect. Condition is the observed fact: two of the 12 departures remained enabled for 40 and 51 hours. Criteria is AC-4 version 3 and its 24-hour deadline. The cause might be an unmonitored integration failure, but that remains a hypothesis until supported by job logs, configuration history, and inquiry.

Effect explains the consequence or risk: former workers could retain production access beyond the authorized window. Do not claim data theft unless evidence establishes it. Preserve the tested item references and timestamps without exposing unnecessary personal information in the report. Separate confirmed facts from inference and label an unconfirmed cause as requiring investigation.

Validate facts with the process owner without giving that owner a veto over adverse reporting. Apply the engagement severity method, obtain a management action owner and target date, and follow up on effectiveness. An uploaded repair ticket is not enough to show a recurring integration fault has stopped.

Conclusions and opinions must fit the engagement

Checking one receipt does not tell you whether every purchase was correct. Your conclusion must stay within what you checked. Aggregate evidence into a conclusion answering the agreed objective. State criteria, scope, period, work performed, significant findings, and limitations. An access-control audit may conclude that the tested population did not consistently meet AC-4. It should not issue an organization-wide financial audit opinion or declare the entire management system certified.

Financial statement audits often distinguish unmodified, qualified, adverse, and disclaimer opinions under their applicable reporting framework. A qualified opinion concerns a material but not pervasive matter. An adverse opinion concerns material and pervasive misstatement. A disclaimer reflects inability to obtain sufficient appropriate evidence with potentially material and pervasive effects, or other framework-specific grounds. Internal audit rating labels depend on the approved methodology.

If production logs are unavailable, do not convert absence of evidence into a clean conclusion. Seek alternative procedures, explain the scope restriction, and assess its effect under the reporting framework. Distinguish a confirmed failure from inability to determine compliance. Sampling and a clean result never justify a claim of absolute assurance.

Ethics and ISO 19011 in daily decisions

If someone offers you a gift to ignore a mistake, refuse it. Honest checking also means admitting what you could not check. ISO 19011 provides guidance for auditing management systems, not a certification requirement imposed on every organization. Its principles cover integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach, and a risk-based approach. Use these as practical behaviors rather than copying standard wording into a checklist.

Integrity means refusing a gift offered to suppress a finding. Fair presentation means reporting limitations and unresolved disagreement as well as successes. Due professional care means using suitable competence and checking timestamps before alleging a breach. Confidentiality means restricting HR data and not reusing it for unrelated personal purposes.

An evidence-based approach ties conclusions to verifiable records and acknowledges sampling uncertainty. A risk-based approach directs effort toward matters that could undermine the audit objective, such as privileged departures and missing source logs. Independence supports impartial judgement even when the sponsor dislikes the result. In both labs, accept bounded supported claims and reject unsupported broad claims without inventing new requirements.