A witnessed scope extension, an old training job and a phone call from sales
You are a lead auditor qualified in IAF scope 18 (machinery). Your certification body assigns you to a plastics injection moulder whose scope is being extended from 'moulding of components' to 'design and moulding of medical device components'. The accreditation body will witness this audit as part of its surveillance of your CB. Eighteen months ago you delivered two days of internal auditor training at this client. The client's quality manager is a former colleague and asks whether the witness assessor 'could be kept away from the CAPA files'. On the morning of the audit the CB's sales manager telephones: the client is 'shopping around', and asks you to 'downgrade anything you can to observations'.
1. Identify the impartiality and confidentiality issues, and state what you must do, when, and to whom.
Read the worked answer
Impartiality threats - all must be declared before the audit starts, not managed quietly:
- Prior training delivered to the client. Delivering internal auditor training to a client's staff is consultancy in substance: it builds the client's ability to operate its own management system. ISO/IEC 17021-1 bars certification body personnel from having provided consultancy to a client within two years of the audit. Eighteen months is inside that window. The correct action is to decline the assignment and have the CB reassign; you cannot 'audit around it'.
- Personal relationship with the quality manager (former colleague). Even if the training issue were absent, this is a familiarity/self-interest threat that must be declared to the CB's impartiality process for it to evaluate and mitigate.
- The request to keep the witness assessor away from CAPA files. The accreditation assessor has a right of access to the audit team's records and the auditee's relevant records for the witnessed activity. Acceding would compromise the integrity of the witness assessment and breach the client's own obligation to give access. Refuse, explain why, and record the request.
What, when, to whom: notify the CB's technical/quality manager and the person responsible for impartiality immediately, in writing, before the opening meeting; withdraw from the audit team; record the declaration and the CB's decision in the audit file. If you only declare it on the day, the audit's validity is already compromised and the witnessed audit makes that visible to the accreditation body. Declaring is the professional act; concealing and 'being careful' is the failure.
2. Are you competent for this audit? What would you need before accepting, and how does the witnessed audit change things?
Read the worked answer
Competence must be assessed against the specific scope, not the auditor's historical qualification. This scope needs, at minimum:
- technical knowledge of plastics injection moulding (materials, tooling, process parameters, process validation);
- design and development competence (8.3: inputs, reviews, verification, validation, change control);
- knowledge of the medical device regulatory environment the client's customers impose - ISO 13485, risk management to ISO 14971, and applicable regulatory requirements - because design outputs here are safety-related;
- the CB's own competence criteria for the extended scope.
Scope 18 (machinery) does not automatically cover plastics, and nothing in the file suggests medical device experience. As lead auditor you would at minimum need a technical expert or co-auditor with the missing competence, and the CB must be able to demonstrate that the team as a whole meets the criteria. You should raise this with the CB before accepting the assignment; a team assembled by improvisation on the day is not acceptable.
The witnessed audit changes nothing about how you audit but everything about the consequences: the assessor will examine your competence judgements, sampling rationale, findings and reporting, and the CB's accreditation for this scope can be affected. Prepare the audit trail - plan, checklists, sampling rationale - so that decisions are explainable, not just defensible in hindsight. Also brief the team on the witness's role and access rights before the opening meeting.
3. How do you handle the sales manager's call, and what is the lead auditor's responsibility for the certification decision?
Read the worked answer
The instruction is improper and must be refused, clearly, on the call. Findings are graded against objective evidence and the CB's grading criteria; commercial retention pressure is not an audit criterion and is a threat to impartiality that the CB is required to manage.
Practical steps:
- State on the call that you will not alter gradings and that the request has been noted.
- Record it immediately - time, date, caller, exact words - in the audit file, and report it to the CB's impartiality function or quality manager. A CB that allows sales influence over findings puts its accreditation at risk; the record protects the auditor and tests the CB's system.
- If pressure continues, or comes through the audit team, escalate to the CB's top management. An auditor may refuse to sign an audit report where findings have been altered.
- Do not discuss the call with the client.
The lead auditor's role: gather and evaluate objective evidence, agree findings with the auditee, grade them against the CB's criteria, and report. The certification decision - grant, maintain, extend, suspend, withdraw - is taken by a competent decision-maker who was not part of the audit team and who reviews the report and the team's recommendations. Your recommendation informs but does not determine it, and conversely you cannot shield the decision-maker from a finding by burying it. On a witnessed audit, the separation of audit and decision, and the independence of findings from commercial considerations, are exactly what the accreditation assessor is looking for.