Overview
Domain 3 moves from what is audited to how an auditor thinks. Its nine knowledge statements cover ISO 19011 concepts and terminology, the differences between first-, second- and third-party audits, the audit principles of integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach, the PECB Code of Ethics, evidence types, laws applicable to the auditee and its country, big data in audits, and auditing outsourced operations.
ISO 19011:2018 gives guidance for auditing any management system, while ISO/IEC 17021-1 sets requirements for certification bodies and ISO/IEC 27007 adds ISMS-specific audit guidance. The domain expects you to apply these principles in situations where pressure, conflict of interest or weak evidence tempts an auditor toward the wrong decision.
How it's tested
Expect ethical dilemmas and evidence judgments presented as short stories about an auditor. You choose the action consistent with ISO 19011 principles and the PECB Code of Ethics, or the type of audit or evidence described. Several options sound helpful to the auditee; the correct one protects objectivity and relies on verifiable information.
-
Principle at risk
A scenario describes an auditor who previously worked for the auditee or receives a generous gift, and you name the principle threatened or the right response.
-
Audit party type
You classify an audit as first, second or third party based on who performs it and for whom, such as a customer auditing its cloud supplier.
-
Evidence type and quality
Several items of information are listed and you identify the evidence type, such as confirmatory or analytical, or the most reliable item.
An auditor finds that the auditee's IT director is a former colleague who once recommended them for promotion. A question asks what the auditor should do. Reason: the relationship may threaten independence or the appearance of it, so the auditor should disclose it to the audit programme manager or team leader, who decides whether reassignment is needed. Ignoring it or quietly being stricter are both wrong.
Knowledge statements 9
Official knowledge statements from the PECB outline, in outline order.
3.1 Main audit concepts and terminology described in ISO 19011Defined audit terms such as audit criteria, evidence, findings and conclusions.
- What it means
- ISO 19011 defines an audit as a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. Other key terms include audit programme, audit plan, audit scope, audit criteria, objective evidence, audit evidence, audit findings and audit conclusion.
- What to understand
- Audit criteria are the reference against which evidence is compared. Audit evidence is verifiable records or statements relevant to the criteria. Findings result from comparing evidence with criteria and can show conformity, nonconformity or improvement opportunities. Conclusions are the outcome of the audit after considering objectives and all findings.
- How it shows up
- Definition items ask which term describes the result of comparing evidence with criteria, which is an audit finding.
- Common confusion
- Using finding to mean only a nonconformity; ISO 19011 findings can also show conformity.
3.2 Differences between first-, second- and third-party auditsWho audits whom and for what purpose.
- What it means
- First-party audits are internal audits conducted by or for the organization itself. Second-party audits are conducted by parties with an interest, such as customers auditing suppliers. Third-party audits are conducted by independent organizations, such as certification bodies or regulators.
- What to understand
- Only third-party audits by an accredited certification body lead to ISO/IEC 27001 certification. Internal audits satisfy clause 9.2. Second-party audits are governed by contracts and the customer's criteria. Independence expectations rise from first to third party.
- How it shows up
- A scenario has a bank auditing its payment processor's ISMS and asks for the audit type; it is second party.
- Common confusion
- Calling an internal audit by hired consultants a third-party audit; it remains first party because it is done for the organization itself.
3.3 Audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approachThe seven ISO 19011:2018 principles.
- What it means
- Integrity is the foundation of professionalism. Fair presentation means reporting truthfully and accurately. Due professional care means diligence and judgment. Confidentiality means protecting information. Independence is the basis for impartiality. The evidence-based approach yields reliable, reproducible conclusions, and the risk-based approach focuses the audit on matters significant to the client and objectives.
- What to understand
- ISO 19011:2018 introduced the risk-based approach as a new seventh principle. Principles guide behavior when rules do not cover a case. Fair presentation includes reporting obstacles and unresolved divergent opinions, not only findings.
- How it shows up
- Questions name a behavior, such as reporting an unresolved disagreement in the report, and ask which principle it reflects.
- Common confusion
- Mixing integrity with independence; integrity is about honesty and diligence, independence is freedom from bias and conflict.
3.4 Auditor's professional responsibility and the PECB Code of EthicsEthical obligations of certified auditors.
- What it means
- PECB certification holders sign the PECB Code of Ethics, committing to act professionally, honestly and impartially, protect confidential information, avoid conflicts of interest, maintain competence, and not misrepresent qualifications or certification status.
- What to understand
- Auditors owe duties to the audit client, the auditee, the certification body and the public. When duties conflict, such as discovering illegal activity, the auditor follows law and contractual confidentiality provisions and escalates through the audit programme or certification body rather than acting alone.
- How it shows up
- Scenarios involve an auditee offering future consulting work or a costly gift during the audit; the correct answer declines and reports.
- Common confusion
- Thinking confidentiality never yields; legal obligations to disclose can override it.
3.5 The evidence-based approach in an auditConclusions must rest on verifiable evidence obtained by sampling.
- What it means
- The evidence-based approach is the rational method for reaching reliable, reproducible conclusions. Because audits are limited in time and resources, evidence is based on samples of available information, and auditors must understand that this introduces uncertainty.
- What to understand
- Evidence must be verifiable. Unverified statements can inform the audit but should be corroborated before supporting a finding. Sufficiency and appropriateness both matter: enough evidence and evidence relevant to the criteria.
- How it shows up
- A question asks what the auditor should do after a manager states that backups are tested monthly; the answer is to verify through records or observation.
- Common confusion
- Treating an interview statement as sufficient objective evidence on its own.
3.6 Types of audit evidence: physical, mathematical, confirmatory, technical, analytical, documentary and verbalPECB's seven-way classification of evidence.
- What it means
- Physical evidence comes from observation or inspection of things. Mathematical evidence comes from recalculation. Confirmatory evidence comes from third-party confirmation. Technical evidence comes from testing systems or configurations. Analytical evidence comes from comparing data and trends. Documentary evidence comes from documents and records, and verbal evidence from interviews.
- What to understand
- Reliability generally increases when evidence comes from independent sources, is obtained directly by the auditor and is documented. Verbal evidence is the weakest alone but useful for understanding processes and for corroboration. Mixing evidence types strengthens a finding.
- How it shows up
- Expect a described activity, such as the auditor reviewing firewall rules on screen, and three evidence types to choose from.
- Common confusion
- Confusing analytical evidence with technical evidence; analytical compares data patterns, technical tests system behavior or settings.
3.7 Laws and regulations applicable to the auditee and the country where it operatesThe legal context shaping criteria and audit conduct.
- What it means
- Auditors need awareness of laws and regulations that apply to the auditee, such as privacy, sector and employment law, and to the conduct of the audit itself, such as rules on accessing personal data or recording interviews.
- What to understand
- An ISMS auditor is not a legal compliance auditor, but checks that the auditee identifies legal requirements (Annex A 5.31) and has processes to meet them. Local law can limit what the auditor may view, such as employee monitoring data.
- How it shows up
- A scenario asks whether the auditor should declare the auditee in breach of a data protection law; the correct answer focuses on the ISMS process for identifying and meeting legal requirements.
- Common confusion
- Believing a certification auditor gives a legal compliance opinion.
3.8 Use of big data in auditsData analytics and large data sets as audit techniques.
- What it means
- Audit teams increasingly use data analytics to examine whole populations of logs, tickets or access records rather than small samples, finding anomalies, trends and exceptions.
- What to understand
- Analytics can raise assurance but depends on data completeness and integrity, which the auditor must verify. Accessing large data sets raises confidentiality obligations and must be agreed with the auditee. Results still need interpretation and corroboration before becoming findings.
- How it shows up
- Questions ask what the auditor must confirm before relying on an analytics result, which is usually the completeness and integrity of the source data.
- Common confusion
- Assuming full-population analytics removes all audit risk.
3.9 Auditing outsourced operationsEvaluating processes run by external providers.
- What it means
- When an auditee outsources ISMS-relevant processes, the auditor checks how the organization determines, controls and monitors them under clause 8.1 and Annex A 5.19 to 5.23, including contracts, service reviews and supplier assurance reports.
- What to understand
- The certification auditor usually does not audit the supplier directly; the focus is on the auditee's control over the supplier. Supplier certificates and reports are evidence, but their scope and date must match the services used.
- How it shows up
- A scenario shows a hosting provider certificate covering a different data center than the one used; the auditor should question the evidence's relevance.
- Common confusion
- Thinking outsourced processes are outside the ISMS scope by default.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Audit (ISO 19011 definition)
Systematic, independent, documented process for obtaining and objectively evaluating evidence against criteria.
- Remember
- Systematic, independent and documented are the three defining qualities.
- Tested as
- Definition questions and principle questions.
- Trap
- Dropping independence from the definition.
-
Audit criteria
Set of requirements used as a reference for comparing evidence.
- Remember
- Includes the standard, the auditee's policies and applicable legal requirements.
- Tested as
- Every finding needs a criterion.
- Trap
- Using auditor opinion as criteria.
-
Audit finding
Result of evaluating evidence against criteria.
- Remember
- Can show conformity, nonconformity or opportunities for improvement.
- Tested as
- Reused heavily in Domains 5 and 6.
- Trap
- Thinking findings are always negative.
-
Seven audit principles
Integrity, fair presentation, due professional care, confidentiality, independence, evidence-based, risk-based.
- Remember
- Risk-based was added in ISO 19011:2018.
- Tested as
- Principle identification items.
- Trap
- Listing objectivity or impartiality as a separate principle.
-
Third-party audit
Independent external audit, such as certification.
- Remember
- The only route to accredited ISO/IEC 27001 certification.
- Tested as
- Audit type classification.
- Trap
- Labeling a customer audit as third party.
-
Objective evidence
Data supporting the existence or truth of something.
- Remember
- Obtained through observation, measurement, test or other means.
- Tested as
- Evidence sufficiency scenarios.
- Trap
- Accepting unverified opinions.
-
Confirmatory evidence
Confirmation from an independent third party.
- Remember
- Usually highly reliable because the source is outside the auditee.
- Tested as
- Evidence type classification.
- Trap
- Confusing it with corroboration by another auditee employee.
-
PECB Code of Ethics
Signed commitment by certified professionals.
- Remember
- Covers honesty, confidentiality, conflicts of interest and competence.
- Tested as
- Ethics dilemma scenarios.
- Trap
- Accepting small favors that create an appearance of bias.
-
ISO/IEC 27007
ISMS-specific guidance supplementing ISO 19011.
- Remember
- Guidance, not certification body requirements.
- Tested as
- Standard identification.
- Trap
- Confusing it with ISO/IEC 27006-1.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
First-, second- and third-party audits
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| First party | Internal audit by or on behalf of the organization | Organization audits itself; meets clause 9.2 | Thinking outsourced internal audit becomes third party |
| Second party | Audit by a party with an interest, such as a customer | Criteria often come from contract | Expecting it to lead to certification |
| Third party | Independent audit by a certification body or regulator | Highest independence; can lead to certification | Assuming the certification body may also consult |
Evidence types
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Documentary | Policies, procedures, records, logs | Shows what is defined or recorded | Taking a policy as proof of operation |
| Verbal | Statements from interviews | Useful but weakest alone | Basing a finding only on one statement |
| Technical | Testing or viewing configurations and system behavior | Direct proof of technical control state | Auditor changing settings while testing |
| Confirmatory | Independent confirmation from an outside party | Source independent of the auditee | Confusing with internal corroboration |
| Analytical | Comparisons, ratios and trend analysis of data | Detects anomalies across data sets | Not verifying data completeness first |
ISO 19011 vs. ISO/IEC 17021-1 vs. ISO/IEC 27006-1
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| ISO 19011 | Guidelines for auditing management systems | Guidance for any auditor | Treating it as certifiable |
| ISO/IEC 17021-1 | Requirements for bodies auditing and certifying management systems | Binding on accredited certification bodies | Applying it to internal audits |
| ISO/IEC 27006-1 | ISMS-specific additions to ISO/IEC 17021-1 | Covers ISMS auditor competence and audit time | Confusing it with ISO/IEC 27007 guidance |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Helpful auditor
- What candidates pick
- The auditor explains how to fix the issue in detail and offers a template.
- Why it looks right
- It feels constructive and saves the auditee time.
- Why it's wrong
- Certification auditors must not provide consultancy; doing so threatens independence and future impartiality.
Clue to watch for The option includes designing, writing or implementing for the auditee.
-
Undisclosed relationship
- What candidates pick
- Continue the audit because the auditor feels objective.
- Why it looks right
- The auditor believes they can stay fair.
- Why it's wrong
- Independence includes appearance; conflicts must be disclosed so the programme manager can decide.
Clue to watch for Scenario mentions prior employment, family or financial ties.
-
Statement as proof
- What candidates pick
- Record conformity based on the manager's assurance.
- Why it looks right
- The manager is senior and credible.
- Why it's wrong
- Evidence must be verifiable; statements should be corroborated by records, observation or testing.
Clue to watch for Only verbal information is described.
-
Analytics without validation
- What candidates pick
- Rely on an exported log report to conclude no unauthorized access occurred.
- Why it looks right
- Full-population data seems conclusive.
- Why it's wrong
- The auditor must first verify the data's completeness and integrity, since exports can be filtered or partial.
Clue to watch for The data was prepared by the auditee without checks.
-
Breaking confidentiality to help
- What candidates pick
- Share another client's good practice documents with the auditee.
- Why it looks right
- Sharing examples seems useful.
- Why it's wrong
- Confidentiality protects information from every client; sharing it breaches the principle and the PECB Code of Ethics.
Clue to watch for Information originates from a different organization.
Answer framework
For a principles or ethics question, identify what threatens the audit's reliability and choose the response that restores it.
- Name the audit type from who performs the audit and for whom, since that sets the independence expected.
- Identify which of the seven ISO 19011 principles the scenario puts under pressure, such as independence or fair presentation.
- For evidence questions, ask whether the information is verifiable, relevant to the criteria and sufficient, and whether it needs corroboration.
- For ethics dilemmas, prefer disclosure and escalation to the team leader or audit programme manager over private decisions.
- Reject options where the auditor consults, shares confidential information or concludes without evidence, even if they sound helpful to the auditee or would save time during a busy audit day.
Practice question
Want more like this? The ISO 27001 LA practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Begin with ISO 19011:2018 clauses 3 and 4, which hold the definitions and the seven principles. Copy the principles onto a card with a one-line situation that would breach each one, such as an auditor softening a finding to keep a client happy for fair presentation. Keep this card in your open-book materials.
Next, practice audit-type classification with ten quick cases you invent: internal audits run by consultants, customer audits, regulator inspections and certification audits. Then build a small evidence table listing PECB's seven evidence types, an ISMS example of each, and how reliable it is. Practice turning a weak piece of evidence into a stronger one, for example by moving from an interview to a record to a direct system check.
Ethics questions reward a consistent rule: disclose, escalate and decline. Work through scenarios on gifts, former employers, confidential information from other clients and requests for advice. Finally, read the parts of ISO/IEC 17021-1 on impartiality so you understand why certification bodies separate consulting from auditing, then finish with timed practice questions.
FAQ
What share of the exam is Domain 3, Fundamental Audit Concepts and Principles?
PECB allots 14 of the 80 questions, 17.5% of the exam, to this domain, making it the second largest after conducting an audit.
How many audit principles are there in ISO 19011:2018?
Seven: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach. The risk-based approach was added in the 2018 edition.
Can a certification auditor give advice to the auditee?
The auditor can explain findings and the requirement involved, but cannot design solutions or provide consultancy. ISO/IEC 17021-1 treats consultancy as a threat to impartiality.
Is an internal audit performed by an external consultant a third-party audit?
No. It is still a first-party audit because it is performed on behalf of the organization for its own purposes, such as meeting clause 9.2.
What makes audit evidence reliable?
Evidence is more reliable when it is verifiable, comes from independent sources, is obtained directly by the auditor and is corroborated by other evidence types.
Does the exam test the PECB Code of Ethics?
Yes. The handbook lists the auditor's professional responsibility and the PECB Code of Ethics as a knowledge statement, and scenario questions often involve conflicts of interest or confidentiality.
Why is big data mentioned in an auditing domain?
Analytics lets auditors test whole populations of records. The exam expects you to know its benefits and that data completeness, integrity and confidentiality must be addressed first.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 3 knowledge
See whether you can name the principle at risk, classify an audit type and choose verifiable evidence over a confident statement under exam timing.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the ISO 27001 LA AI tutor Get any concept explained your way