# What is an audit?

ISO 19011 clause 3.1 defines an audit as a systematic, independent, and documented process for obtaining objective evidence and evaluating it, again objectively, to determine the extent to which the audit criteria are fulfilled.

It's an assessment by an auditor on the evidence and the facts that a company is trying to present to that auditor.

There are financial audits, administrative audits, IT systems audits, and information security audits, which is the subject of ISO 27001.

Relevant standards for auditing are:
- ISO 19011, which provides guidance on managing audit programs
- ISO 17021-1, which contains requirements for bodies providing audits and certification of management systems, so that they can prove competence, consistency, impartiality, and ensure credible certification
- ISO 27006-1, requirements for ISMS auditing and certification services
- ISO 27007, guidance on managing an ISMS audit program (against the requirements of ISO 27001)

The importance of vocabulary is critical when it comes to auditing, not only from the standpoint of what the auditors say or do or write, but also from the standpoint that when the auditors are interacting with the auditee, that we're all using the same language and we understand that.
 
## Types of audits

The first party audit is when the organization audits its own processes, either by an internal audit team or by outsourcing it to a trusted external entity.

A second party audit is where the organization is being audited by a customer (in which case the organization is the auditee), or where the organization audits its vendors (also known as vendor due diligence).

A third-party audit is when an organization is audited by a completely independent organization, without any a priori knowledge of the organization or previous audits (certifying bodies perform these kind of audits).

In a combined audit more than one framework or more than one standard are audited at the same time.

In the United States, for example, it's very common to do 27001 and SOC 2 together. For combined audits it's especially important to check for competency of the auditor.

## Involved parties

According to ISO 19011, clauses 3.12 - 3.15, and ISO 17021-1, clauses 3.8, 3.9, and 3.16.

**Audit client**, or auditee: the organization or person requesting an audit.

**Auditee**: the organization as a whole, or parts thereof, being audited.

**Auditor**: the person who conducts an audit.

**Audit team**: one or more persons conducting an audit, if needed supported by technical experts.
(as an auditor, you're not required to know every single thing for every possible concept of every single framework that's out there).

**Observer**: a person who accompanies the audit team but does not audit.

**Guide**: a person appointed by the client to assist the audit team. Often a person that has direct access to people or areas of the auditee environment, that allows for faster access to get things done.

## Vocabulary  

**Shall**: required
**Should**: highly suggested
**May**: facultative, voluntary
**Can**: a possibility or capability.

 Even though an element is required ('shall'), it may not always be applicable, like physical security for a company without physical offices locations.

So again, from the standpoint of shall, should, may, can, it is very important that you understand difference, not only from the standpoint of auditing, but also from the standpoint of when you're going to basically be taking the certification test. In those circumstances, there needs to an explanation of why it's not applicable.

**Applicable**: Relevant; appropriate; possible to apply

**Appropriate**: Suitable (for, to)

**Authority**: power to command or give a decision.

**Competence**: Ability to apply knowledge and skills to achieve the intended results

**Conformity**: fulfillment of a requirement, meeting the requirements and its guidelines

**Continual improvement**: the recurring activity to enhance performance

**Corrective action**: action to remediate or mitigate a possible non-conformity and to prevent recurrence

**Documented information**: Information required to be controlled and maintained by an organization and the medium on which it is contained  

**Determine**: Appraise or analyze quantitatively; find out

**Identify:** Find out; mark or label; show; to reference something without ambiguity

**Interested parties**: Person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity

**Maintain**: Enable to continue

**Nonconformity**: Nonfulfillment of a requirement

**Organization**: Company, corporation, firm, enterprise, authority or institution, person or persons or part or combination thereof, whether incorporated or not, public or private, that has its own functions and administration – in most cases the auditee

**Retain**: Keep

**Top management**: Person or group of people who directs and controls an organization at the highest level
