Audit and Assurance

Auditing is a process of verification, to ensure compliance to requirements.

An audit may cover an entire organizational process, system and activities or might be specific to a function, process, or production step.

Some audits have special purpose or focus, such as adequacy checks, compliance checks, strategic risk identification, system effectiveness & efficiency checks, performance, or following up on completed corrective actions.

Management Audit Types

• A first-party audit is performed within an organisation by their own personnel against a predefined scope and criteria.

A first-party audit is generally an internal audit conducted by auditors who are employed by the organization being audited but independent of the areas being audited.

• A second-party audit is an external audit performed on a supplier by a customer or their representative.

Generally, a second party audit is being carried out based on a contract and they tend to be more formal than first-party audits. The audit results generally influence the customer’s purchasing decisions.

• A third-party audit is performed by an independent audit organization and is free of any conflict of interest.

Independence of the audit organisation is a key component of a third-party audit. Third-party audits are generally used for certification, assurance, registration, recognition, etc.

Standard for Management Audit or Management System Audit

ISO 19011:2018 is an international standard (guideline) for auditing management systems.

This document has defined principles of auditing, how to manage an audit programme and conducting management system audits.

Guidance on the evaluation of the competence of individuals involved in the audit process has also been defined here. These activities include the individual(s) managing the audit programme, auditors and audit teams.

It is applicable to all organizations that need to plan and conduct internal or external audits of management systems or manage an audit programme.

The application of this document to other types of audits is possible, provided that special consideration is given to the specific competence needed.

Management Audits can be broadly classified under the following categories:

Process audit: 

This type of audit verifies the limits and controls of a process with a focus on the possible risks and their associated control measures. Process audit includes checking conformance, and availability of required resources.

They also check the adequacy and effectiveness of the process controls established by procedures, work instructions, flowcharts, and training and process specifications.

Process Safety Audit is an example of a process audit.

Product audit:

This type of audit is the verification of a particular product or service, to evaluate whether it conforms to requirements (i.e., specifications, performance standards, and customer requirements). It is an extension of inspection or conformity assessment.

System audit: 

An audit conducted on a management system is called a system audit. It verifies the adequacy of the system, compliance, effectiveness and efficiency.

A quality management system audit or an environmental system audit is an example of Systems Audit.