A Former EHS Manager Proposed for the Audit Team
You lead a two-person team auditing a chemical plant's ISO 45001 management system. The client proposes adding Jack, a contract auditor, to cover permit-to-work and contractor safety. Jack was the plant's EHS manager until 13 months ago and still receives a $1,200 monthly retainer for 'occasional toolbox talks.' Those two programs were his direct responsibility, and he signed many of the permits now in the audit sample. The audit is five days and starts in 10 days. Your firm's impartiality procedure sets a two-year cooling-off period for anyone with operational responsibility and prohibits auditing areas of prior responsibility unless no alternative exists. The client argues that Jack 'knows where everything is' and that the lead auditor alone cannot cover four process units plus the site walk. The scope explicitly includes permit-to-work, contractor management, and incident investigation.
1. Can Jack be used in any role? Decide and justify.
Read the worked answer
No audit role. Three threats are present: self-review, because he would evaluate permit-to-work and contractor safety programs he managed and signed; self-interest, because he still receives a monthly retainer from the client; and familiarity, because he knows the staff and the history and may anchor on old issues. The 13-month gap is inside the firm's two-year cooling-off, and the prohibition on auditing areas of prior responsibility is even stricter. The fact that he signed permits in the sample makes the self-review threat concrete, not theoretical. A 'technical expert' or 'guide' role does not cure it if he influences sampling, interviews, or findings. I would decline his inclusion, document the impartiality analysis, and inform the client in writing. Alternatives: extend the audit by one day so the lead auditor can cover the permit sample and contractor interviews; bring a qualified auditor from another office; or reduce the scope in writing, which I would not recommend. If the client insists, I would escalate to the audit programme manager and, if unresolved, decline the audit. The 10-day start date is a scheduling issue, not a reason to compromise.
2. The client says one auditor cannot cover four process units. How do you re-plan, and what goes in the audit plan?
Read the worked answer
I would re-plan around risk and evidence rather than headcount. Permit-to-work can be audited through a stratified record sample, interviews with permit issuers, entrants, and attendants, and observation of one or two active permits; it does not require walking all four units. Contractor management can be sampled through the contractor list, prequalification files, and site induction records. I would prioritize the units with the highest-risk permits (confined space, hot work, energy isolation) and document the sampling rationale. If coverage is still inadequate, I would add a day or a qualified auditor. The audit plan should list each auditor's role, the areas excluded with respect to Jack, and the impartiality safeguards, and it should be agreed with the client. If the client will not accept the change, the report should record a scope limitation rather than use Jack. A guide can walk the team around, but must not select samples, interpret criteria, or participate in findings.