Audit types, party relationships and purpose

An audit can be described along three separate axes: what is examined, the auditor–auditee relationship, and why the assignment is being performed. A process audit can also be second party and triggered by corrective action. Start with the client's question, identify the process, product or system in scope, and then establish who commissioned the work and who will use its conclusion. Finally determine the trigger: a scheduled cycle, surveillance, a complaint, a significant change, or CAPA verification. These decisions prevent a supplier visit from being mislabeled third party simply because an outside specialist participates. They also prevent a video interview from being mislabeled a desk audit.

A product or service audit evaluates a specified output against stated requirements, such as the dimensions of a sampled batch against a contract specification. A process audit traces how inputs become outputs: who receives the order, which instruction version is used, what record shows the step occurred, and how exceptions are handled. A system audit examines interactions and effectiveness across processes, policies and responsibilities. One conforming product sample cannot establish system effectiveness. A department or function audit sets an organizational boundary, while an element audit concentrates on one requirement or mechanism. These labels may overlap, but the report must state its actual boundary; a finding from a single process cannot silently become a conclusion about the whole enterprise.

A desk review describes the use of documents or questionnaires, often before a visit. Remote describes the communication channel used to gather evidence. Hybrid combines physical presence and remote interaction. An emailed procedure cannot, on its own, prove that operators follow it. If direct observation matters and a camera or contract access cannot provide it, record the limitation and adjust either the plan or the conclusion. A joint audit involves more than one auditing organization examining an auditee. An integrated audit may combine requirements from several management systems. Specify the intended meaning in the plan before gathering evidence.

Quality, sustainability, environmental, safety, and financial audits share a stated purpose, effective criterion, sample, evidence-gathering method, and trace from observation to conclusion. Their subject, authority, and specialist requirements differ. Energy use alone does not establish product conformity; one injury record does not prove the entire safety system effective; and an expense figure does not explain financial risk without context. For an integrated assignment, pair each field's criterion with its source record and assign appropriate expertise before judging it. A quality auditor's competence does not automatically authorize legal, environmental, or financial conclusions. Source tracing and criterion comparison transfer across fields, but each conclusion remains bounded by its sample and team competence.

A first-party audit is performed by an organization on its own activity or system. An employee independent of the activity, or a provider acting on the organization's behalf, may conduct it. A second-party audit arises from a direct interest, such as a customer auditing a supplier. A third-party audit is undertaken by an organization independent of the customer–supplier relationship for that assignment, such as a certification body where applicable. The auditor's payroll does not by itself decide the party label. Ask whose decision the report supports and how that party relates to the auditee. Personal objectivity matters in every setting, but it is a separate question from classifying the relationship.

Purpose is another axis. A conformity audit asks whether specified criteria were met. An effectiveness audit asks whether a system achieved its intended result using outcome evidence. A follow-up audit checks the status of a prior action. A for-cause audit begins with a particular signal, such as a complaint or incident. Risk-based planning directs attention and sampling toward higher potential impact and likelihood, but does not remove the requirement to state criteria and sample limitations. CAPA verification needs evidence of implementation and evidence of effectiveness over a suitable interval. Clicking “closed” in an action tracker does not show that a defect stopped recurring. In every case, separate the trigger for the assignment from the thing examined.

When several labels apply, prepare a six-field decision card: commissioning party, auditee, subject, purpose, evidence channel and inference boundary. A fictional board may commission its internal team to examine a customer-complaint system across two sites. The party is first, the subject is a system, the purpose is effectiveness, and the delivery is hybrid if the team visits one site while observing the other remotely. Calling the subject a “system” does not establish coverage of every site: an unexamined site must be stated as a limit. If the client challenges an uncomfortable finding, revisit its criterion, evidence and boundary rather than changing the party label or softening the result to satisfy a preference. Classification governs report interpretation; it is more than term memorization.

Conformity and effectiveness can yield different decisions in the same case. If a procedure requires an alert within one day, a conformity test compares selected timestamps with that one-day requirement. An effectiveness test also asks whether the alert reached the decision maker early enough to act and what happened after a delay. Formal compliance may coexist with an ineffective outcome; a favorable outcome does not erase a contractual breach. Report the questions separately so that corrective action addresses the actual failure. Never turn a delay count from a signal-selected sample into an all-case rate without a consistent denominator and a defensible selection design.

Surveillance following an earlier approval need not repeat every original test; it examines continued conformity in its authorized scope and responds to material changes. Verification of corrective action begins with a named finding, cause, action and effectiveness measure, not merely a desire for another visit. A complaint can trigger a for-cause inquiry followed later by CAPA verification. If the two are blurred, a team may close the complaint because an action was written down although it has not worked. A joint audit can involve more than one auditing organization examining one management system, while an integrated audit can cover more than one system with one team. The presence of several auditors does not itself mean several criteria. In a case plan, attach a fact to each classification and leave an unsupported label open rather than filling every terminology box by guesswork.