Essential Audit Terms and Definitions in ISO 19011:2002

Every quality professional knows that effective audits depend on clear communication. When auditors and auditees speak the same language, misunderstandings decrease and the entire audit process becomes more efficient. ISO 19011 provides the foundational terminology that makes this shared understanding possible, with Clause 3 specifically dedicated to establishing standardized terms and definitions for management system audits.

What exactly is an audit? 🔗

At its core, an audit is a systematic, independent, and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. This definition contains three critical elements that distinguish audits from casual inspections or reviews.

Systematic means the audit follows a planned, methodical approach rather than random checking. Independent ensures the auditor maintains objectivity and has no vested interest in the outcome. Documented requires that everything-from the audit plan to findings-is recorded in a verifiable manner. These three characteristics work together to make audits reliable tools for assessing organizational performance.

Core audit terminology 🔗

Understanding the relationship between audit criteria, evidence, and findings is essential for anyone involved in quality management. These three concepts form the backbone of every audit activity.

Audit criteria 🔗

Audit criteria represent the set of policies, procedures, or requirements used as a reference against which objective evidence is compared. Think of criteria as the measuring stick for the audit. They might include external standards like ISO 22000 or FSSC 22000, regulatory requirements from bodies like the FDA or FSSAI, internal company policies, or contractual obligations with customers or suppliers. Without clearly defined criteria, an audit lacks direction and purpose.

Audit evidence 🔗

Audit evidence consists of records, statements of fact, or other information that is relevant to the audit criteria and verifiable. This evidence forms the foundation for audit conclusions. Evidence can be obtained through observation, document review, interviews, measurement, or testing. The key requirement is that evidence must be objective-meaning it can be verified independently-rather than based on opinions or assumptions.

Audit findings 🔗

Audit findings are the results of evaluating collected audit evidence against audit criteria. When auditors compare what they observed (evidence) against what should be happening (criteria), they generate findings. These findings typically fall into categories such as conformity (requirements are met), non-conformity (requirements are not met), or observations (potential improvements or risks that warrant attention but don’t constitute violations).

Audit conclusions 🔗

The audit conclusion represents the outcome of an audit after considering all audit findings and the audit objectives. While findings address specific aspects of the management system, conclusions provide an overall assessment of how well the organization meets the established criteria.

Types of audits explained 🔗

ISO 19011 distinguishes between different audit types based on who conducts them and their relationship to the organization being audited. Understanding these distinctions helps organizations plan their audit programs effectively.

First-party audits (internal audits) 🔗

First-party audits are conducted by or on behalf of the organization itself for management review and other internal purposes. An employee from one department might audit another department, or the organization might hire a consultant to perform the audit. The important distinction is that the auditor acts on behalf of the company rather than an external party.

Internal audits serve as powerful tools for continuous improvement. They allow organizations to identify problem areas, discover where processes don’t align, and find opportunities for enhancement before external auditors arrive. All ISO management system standards require organizations to perform internal audits as a fundamental element of their management system.

Second-party audits (external supplier audits) 🔗

Second-party audits occur when parties having an interest in the organization, such as customers, audit their suppliers to ensure contractual requirements are met. A food manufacturer might audit an ingredient supplier to verify they follow agreed-upon food safety practices, or a retailer might audit a contract manufacturer to confirm quality specifications are maintained.

These audits focus on elements specific to the business relationship between customer and supplier. Even if a supplier holds ISO certification, customers may still conduct second-party audits to examine contract-specific requirements that fall outside standard certification scope.

Third-party audits (certification audits) 🔗

Third-party audits are performed by independent auditing organizations such as certification bodies or governmental agencies. These auditors have no business relationship with the organization beyond the audit itself, which provides maximum objectivity.

The most common third-party audit involves certification bodies verifying that an organization’s management system conforms to standards like ISO 9001 or ISO 14001. Successful third-party audits result in certification that demonstrates to stakeholders that the organization meets internationally recognized requirements.

Combined audits 🔗

A combined audit occurs when two or more management systems are audited together at a single organization. For example, an auditor might simultaneously assess an organization’s quality management system (ISO 9001) and environmental management system (ISO 14001). When these multiple systems are fully integrated, the organization maintains what’s called an integrated management system.

Joint audits 🔗

Joint audits happen when two or more auditing organizations cooperate to audit a single organization. This might occur when multiple certification bodies or regulatory agencies need to assess the same facility and agree to conduct their audits together for efficiency.

Key roles in the audit process 🔗

Clear role definitions prevent confusion about responsibilities and authority during audits. ISO 19011 defines several key participants in the audit process.

Auditor 🔗

An auditor is a person with the demonstrated competence to conduct an audit. This competence includes technical knowledge relevant to the audit scope, understanding of audit techniques, and appropriate personal attributes like ethical behaviour, open-mindedness, and professionalism. Auditors must perform their work ethically, with honesty and responsibility, and should only undertake audit activities if competent to do so.

Audit team 🔗

An audit team consists of one or more auditors conducting an audit, supported when needed by technical experts. One auditor is appointed as the audit team leader, who carries responsibility for managing the audit process and ensuring objectives are met. The team composition depends on the audit scope and complexity-a simple process audit might require a single auditor, while a comprehensive system audit might need multiple auditors with various specializations.

Auditee 🔗

The auditee is the organization or parts thereof being audited. This includes the management, staff, and processes subject to examination during the audit. Auditees have responsibilities too-they must provide access to relevant information, facilities, and personnel to enable the audit to proceed effectively.

Audit client 🔗

The audit client is the organization or person requesting an audit. For internal audits, the audit client is typically management or a specific department within the organization. For external audits, the client might be a customer conducting supplier audits or an organization seeking certification. The audit client defines the audit scope and criteria, receives the audit report, and determines how findings will be addressed.

Additional essential terms 🔗

Beyond the core concepts, several other terms appear frequently in audit contexts.

Audit programme refers to the arrangements for a set of one or more audits planned for a specific time frame and directed toward a specific purpose. Organizations typically develop annual audit programmes that schedule internal audits throughout the year, considering factors like previous findings, process changes, and regulatory requirements.

Audit scope describes the extent and boundaries of an audit, including physical locations, organizational units, activities, and processes to be examined, as well as the time period covered.

Audit plan provides the detailed description of activities and arrangements for a specific audit, including objectives, criteria, team assignments, and schedule.

Why standardized terminology matters 🔗

Using consistent audit terminology delivers practical benefits across the organization. When everyone understands what auditors mean by terms like “non-conformity” or “objective evidence,” audit reports become clearer and corrective actions more focused. Standardized language also enables auditors working independently to reach similar conclusions in similar circumstances, making the entire audit process more reliable and reproducible.

For food safety professionals and quality managers, familiarity with these definitions helps in preparing for audits, interpreting findings correctly, and communicating effectively with certification bodies and customers.

What do you think? How has standardized audit terminology improved communication in your organization’s quality management activities? Have you experienced situations where unclear terminology led to misunderstandings during audits?

References

1. https://www.dnv.com/assurance/articles/what-is-an-iso-audit/
2. https://committee.iso.org/files/live/sites/tc176sc2/files/documents/ISO%209001%20Auditing%20Practices%20Group%20docs/Auditing%20General/APG-EvidenceCollection2015.pdf
3. https://emsmastery.com/2020/12/08/what-are-first-party-second-party-third-party-audits/
4. https://www.certaintysoftware.com/whats-a-first-second-and-third-party-audit/
5. https://en.wikipedia.org/wiki/ISO_19011
6. https://asq.org/quality-resources/iso-19011
7. https://antarisconsulting.com/iso-19011-update/