The Audit That Was Too Clean
You are the lead auditor on a 3-day internal audit of a calibration laboratory. The audit plan allocated 16 auditor-hours across 9 processes. By end of Day 2, you have completed 7 of 9 processes with 4 hours remaining. Your auditor (1 person, 2 days) reports finding zero nonconformities and describes the lab as 'well run, staff cooperative.' You review the working papers and notice: (1) the last 6 calibration records sampled were all dated within the past 10 days, (2) no interviews with the two night-shift technicians are documented, (3) the auditor's checklist shows 'verified' for equipment traceability but no evidence of what was checked, and (4) the two remaining processes are 'complaint handling' and 'management review' - both flagged in last year's audit as weak. The auditee asks you to close out early so they can release the room.
1. What is your judgement on the 'zero findings' result, and what should you do before accepting it?
Read the worked answer
Zero findings after 12 of 16 hours is a sampling and coverage problem, not proof of conformity. Three red flags point to inadequate evidence: (a) a sample of records all within 10 days is not representative of the audit period - it likely reflects what was easy to retrieve, not what was in scope; (b) no night-shift interviews means a whole shift and its practices are unaudited, so conclusions about the process are unsupported; (c) 'verified' with no recorded what/where/who is an unsupported conclusion - evidence must be traceable to source.
Before accepting the result I would: re-scope the remaining 4 hours to the two high-risk processes (complaint handling, management review) because prior-year weakness raises risk; require the auditor to re-sample records across the full audit period and record the specific record IDs/locations checked; interview at least one night-shift technician or document why not and treat the gap as a limitation; and downgrade any 'verified' entry lacking evidence to 'not verified.' If coverage cannot be achieved in the remaining time, I record it as an audit limitation in the report rather than implying full coverage. I would not close out early.
2. How do you handle the auditee's request to end early without damaging the audit's credibility?
Read the worked answer
Decline, but explain the reason in risk terms rather than process terms. The honest framing: 'We have 4 hours left and two processes that were weak last year. Ending now would leave the report claiming coverage we don't have, which exposes you more than it protects you.' Offer a practical compromise - keep the room but release staff not needed, or return for a half-day - while making clear the scope will not shrink.
Key point: the audit conclusion must match the evidence actually gathered. The failure mode here is a report that says 'no nonconformities' when the truth is 'insufficient evidence in two areas.' The correct output is either completed coverage or an explicit limitation. Never let scheduling pressure convert a coverage gap into a clean bill of health.