Audit programme with an independence conflict and management pressure
An operator runs three data centres in three countries: a 2 MW primary, a 500 kW secondary, and a 300 kW edge site. The internal audit team has three people; one is the operations manager for the 2 MW primary. The annual programme sends the same 400-item checklist to all three sites once a year, with no risk assessment, no sampling plan and no follow-up schedule. The checklist was copied from a consultant's template and includes items outside TIA-942 scope. Last year the two larger sites had repeat findings on generator testing. Top management has asked the team to 'keep the report clean' because a major customer audit is due in eight weeks. The audit committee expects an opinion on the programme. You are the lead internal auditor.
1. Evaluate the current audit programme against internal audit principles, including independence, risk-based planning and evidence.
Read the worked answer
The programme has three structural weaknesses. First, independence is impaired: the operations manager for the 2 MW primary cannot objectively audit the site they manage. This is a self-review threat. The person may also be under pressure to protect their own performance. Independence should be both real and perceived; the auditor must recuse from that site, and the programme should document the conflict and the alternative arrangement.
Second, the programme is not risk-based. Applying the same 400-item checklist annually to a 2 MW primary, a 500 kW secondary and a 300 kW edge site ignores differences in criticality, customer dependency, complexity, change activity, incident history and prior findings. Repeat generator-testing findings at the two larger sites are a risk signal that should increase frequency, sample size and technical depth, not just repeat the same checklist. Copying a consultant's template also risks auditing items outside the TIA-942 criteria, which wastes effort and can produce findings that are not relevant to the standard.
Third, the method is checklist-driven rather than evidence-based. A checklist can be a prompt, but the auditor must plan sampling, trace processes and corroborate evidence. There is no follow-up schedule, so corrective actions cannot be verified and closed. The programme lacks defined objectives, scope, criteria, competence requirements and reporting rules. The audit committee should receive an opinion that the programme does not currently provide sufficient assurance.
2. Redesign the programme: what objectives, risk factors, frequency, sampling and competence arrangements would you propose?
Read the worked answer
The programme objective should be to provide the audit committee with independent assurance that the data centres conform to the applicable TIA-942 edition, internal operating procedures and corrective-action commitments. Criteria must be explicit and version-controlled, and the checklist should be rebuilt around the standard's scope and the site's own claims, not a generic template.
Risk assessment should be site-specific and refreshed at least annually. Factors include IT load and criticality, customer contractual requirements, redundancy rating claimed, recent incidents and near misses, changes and expansions, prior findings and repeat findings, maintenance backlog, staff turnover, and reliance on single points of failure. On that basis, the 2 MW primary might be audited annually with a larger sample; the 500 kW secondary every 12-18 months; the 300 kW edge site every 24 months with remote evidence review plus a site visit when risk changes. Repeat generator findings should trigger a focused follow-up within six months, not wait for the next annual cycle.
Sampling should be documented: number of racks, work orders, maintenance records, generators, UPS modules and change records, selected randomly and risk-targeted. Competence must match the technical scope; if the team lacks electrical or cooling expertise, use a qualified technical expert. Independence must be explicit: the operations manager recuses from the primary site, and another auditor or an external reviewer covers it. Define reporting timelines, finding classification, follow-up intervals and escalation to the audit committee.
3. How would you handle the instruction to 'keep the report clean'? What would you document and report?
Read the worked answer
I would not suppress or soften findings to suit a customer audit. Internal audit principles include integrity, fair presentation and due professional care. The customer audit is precisely when accurate information matters most; a clean internal report followed by a poor external audit damages credibility and may create contractual risk.
I would respond to top management in writing, explaining that the report will be factual, risk-based and consistent with the evidence, and that findings can be presented with context and management responses without removing them. I would offer to accelerate remediation of the highest-risk items before the customer audit and to provide a management action plan with owners and dates. That addresses the business concern without compromising the audit conclusion.
I would document the request, my response and any subsequent pressure in the audit file. If the instruction becomes a direction to alter evidence or conclusions, I would escalate to the audit committee or the governing body, referring to the audit charter. The report should include the repeat generator findings, the independence arrangement, and an opinion on the programme's limitations. If the audit committee expects an opinion on the programme, I would state clearly that the current programme provides limited assurance and describe the redesign required. That is the fair presentation of the situation.