ISO 19011 gives the guidance that auditor courses are built on. The stage names below follow the 2018 edition, which most course material still uses; the 2026 edition keeps the same overall flow but expands guidance on remote auditing and risk.
1 Principles first
Every audit rests on seven principles: integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach. Exam questions often describe a situation and ask which principle is at stake.
2 The audit programme
The audit programme is the set of audits planned over a period. The person managing it sets objectives, considers risks and opportunities to the programme, decides the extent, resources and methods, selects audit teams, and monitors, reviews and improves the programme. Internal audit programmes typically give more attention to important processes and areas with past problems.
3 Conducting one audit
| Stage | What happens |
|---|---|
| 6.2 Initiating | Contact the auditee, confirm objectives, scope and criteria, and check the audit is feasible |
| 6.3 Preparing | Review documented information, write the audit plan, assign work to the team, prepare checklists and sampling plans |
| 6.4 Conducting | Opening meeting; collecting and verifying information by interview, observation and review of records; generating findings; reaching conclusions; closing meeting |
| 6.5 Reporting | Prepare and distribute the audit report |
| 6.6 Completing | Close the audit when all planned activities are done |
| 6.7 Follow-up | Verify that corrections and corrective actions were taken and were effective |
4 Evidence → findings → conclusions
- Audit criteria are what you audit against (the standard, procedures, legal requirements).
- Audit evidence is verifiable information — records, statements of fact, observations.
- Audit findings come from evaluating the evidence against the criteria: conformity, nonconformity, or opportunities for improvement.
- Audit conclusions are the team’s overall outcome, considering the objectives and all findings.
5 Sampling and trails
You cannot check everything, so auditors sample — and should be able to explain how the sample was chosen. Follow audit trails: pick an output (an order, an incident, a change) and trace it back through the process and records.
6 Remote and hybrid audits
Remote methods — video interviews, screen-shared records, virtual tours — are now treated as normal audit methods. Plan for connection problems, confidentiality of shared screens and how you will verify that what you see is genuine.