Recertification Under Pressure: a Former Client, Hospitality, a Secondment and a Privileged File
You are lead auditor for the recertification audit of Terrafirma Waste Services, a hazardous-waste treatment and transfer operator. Two working days before the opening meeting, the client's EHS director, whom you have audited at two previous organisations, emails you: (i) asking whether the audit can be postponed by three weeks because the regulator will be on site that week; (ii) offering to 'sort out' your team's travel costs and add a two-night stay at the company's coastal lodge; and (iii) asking you to send 'the benchmarking summary from your last client in this sector' so they can see how they compare. You also learn that your spouse began part-time work in Terrafirma's logistics department eleven weeks ago. On day one the EHS director hands you a folder marked 'legally privileged - for regulator only' containing an internal investigation into an unpermitted waste transfer. The audit is a three-day recertification; the certificate expires in five weeks and the client says a delay will cost them a major contract.
1. Identify each impartiality threat in this situation and state what you must do, and must not do, before the audit proceeds.
Read the worked answer
Identify each threat separately; they have different remedies and different owners.
- Familiarity / self-interest. You have audited this EHS director at two previous organisations. Familiarity is a recognised threat to impartiality (ISO 19011:2018 clause 4; ISO/IEC 17021-1 clause 5.2). It does not automatically disqualify you, since the earlier audits were at other organisations, but it must be disclosed to the certification body and considered by its impartiality process.
- Self-interest (hospitality). The offer of travel costs and a lodge stay creates a benefit. It cannot be accepted; decline in writing.
- Intimidation (commercial pressure). 'A delay will cost us a major contract' is pressure toward a fast, favourable conclusion. Record it; it must not affect technical judgement or scheduling.
- Conflict of interest (spouse). A spouse in the client's logistics department is a close personal relationship with a person inside the audited organisation. This must be revealed to the certification body immediately under its management-of-impartiality requirements. It is unlikely the audit can proceed as planned - at minimum your independence regarding logistics is compromised, and the perception issue alone usually means replacement as lead auditor.
Do not decide this yourself and do not start the audit until the certification body has responded. Disclose in writing, let the impartiality process decide, and do not discuss the matter with the client before the certification body does.
2. How would you handle the postponement request, the offer of hospitality and the request for benchmarking information?
Read the worked answer
Postponement. The request is legitimate in principle - a regulator on site may genuinely affect audit effectiveness or produce an unrepresentative picture. But the decision belongs to the certification body, not to the auditor and not to the client. Pass it on with the facts: date requested, reason, effect on certificate expiry, and the commercial consequence the client has mentioned. Note that the client's stated reason for urgency is commercial and therefore irrelevant to the decision. If postponement would take the audit past expiry, the certification body's rules on recertification and expiry apply; the auditor offers no opinion on the certificate.
Hospitality. Decline in writing, without moralising, and record the offer. Explain briefly that acceptance is incompatible with the independence principle. Record it in the audit file even though it was refused, because a pattern of offers is relevant to the certification body's impartiality risk analysis for this client.
Benchmarking request. Refuse. Information about another client is confidential (confidentiality principle in ISO 19011:2018; confidentiality requirements in ISO/IEC 17021-1). Do not confirm that such a client exists, do not offer anonymised data, and do not describe 'typical findings in this sector' in a way that could identify anyone. State that the request cannot be met and why, and report it to the certification body.
Keep a short, dated written record of all three exchanges and send it to the certification body before the opening meeting.
3. What do you do with the privileged file, and how do you record the matter?
Read the worked answer
The file must not be read, used as audit evidence, or retained.
First, refuse it. When it is handed over, say immediately that you cannot accept legally privileged material relating to a regulatory matter and ask for it to be withdrawn. Do not open it if you can avoid doing so. If it has already been opened, stop, take no notes from it, and hand it back. Record only that a privileged file was offered and returned.
Second, do not use it. The evidence-based approach requires findings to rest on verifiable evidence obtained through the audit - records, interviews, sampling, observation. A privileged investigation the client did not intend you to see cannot ground a nonconformity, and quoting it would breach confidentiality and could prejudice a legal process.
Third, treat it as a lead, not as evidence. If the subject matter is significant - an unpermitted waste transfer - test it through normal channels: waste transfer and consignment notes, duty-of-care checks, the waste register, regulator correspondence, and the 10.2 process. If those records support a finding, raise it on that evidence.
Fourth, escalate. Report the incident in writing to the certification body's technical manager or impartiality function on the same day. The certification body may need to consider whether the client attempted to influence the audit. The audit report itself contains only what the audit evidence shows, plus a factual note that privileged material was offered and declined.