The Auditor Who Also Consults for the Client
You are an external auditor contracted to perform an ISO 14001 internal audit for a logistics company. Two weeks before fieldwork, the client's EHS manager asks whether you can also help them rewrite their environmental policy and build a new aspect register, offering a separate contract that would start the week after the audit. You have done three prior audits for this client and know their system well. You are the only auditor on the engagement. The internal audit is intended to feed the client's management review and their preparation for a certification audit in four months. The client says the consulting would be 'efficient because you already know our gaps.'
1. What is the ethical issue, and what should you do about the consulting request?
Read the worked answer
Accepting the consulting contract would create a self-review threat: you would be auditing a system and then designing the very policy and aspect register you would later assess, or assessing work you helped create. For internal audit feeding management review, independence is the point - the organization needs an objective view of its gaps, not a confirmation of its own consultant's design. The efficiency argument is exactly the risk: familiarity becomes dependence, and the audit loses its challenge function.
Decline the consulting engagement, at least for the scope you audit. Explain the independence principle plainly to the client. If they need help, refer them to a separate provider, and if you later audit the resulting system, disclose the prior relationship and consider whether you can remain objective. Document the request and your response. The prior three audits are fine; the line is crossed when you start building what you audit.
2. The client pushes back, saying the certification body won't care because this is only an internal audit. How do you respond, and what do you put in writing?
Read the worked answer
The certification body's view is not the standard you are held to; your own professional and contractual independence obligations are. Internal audit is defined by objectivity, and an auditor who designs controls and then evaluates them cannot provide that. Even if no external rule is breached, the management review would be relying on a compromised opinion.
Put it in writing: a short memo to the client stating that you decline the consulting scope, the reason (self-review and independence), and what you will still do (complete the internal audit as scoped). Note that if they engage another consultant, you can audit the results, subject to disclosing the relationship and confirming you can be objective. Keep the tone professional and non-accusatory; the goal is a defensible record, not a fight.