Auditor Independence and a Scope Limitation in an Internal Audit Programme
You are the lead auditor for the internal audit programme at a 700-person pharmaceutical packaging plant. The current-year schedule lists 22 audits, all set at fixed 12-month intervals regardless of process risk, and the same three auditors cover every one of them. While reviewing preparation for the audit of the weighing and dispensing area, you find that the assigned auditor, M. Osei, was the area supervisor there until she transferred into quality assurance 14 months ago, and that she also audited the same area in the previous cycle. In the area itself, the SOP requires second-person verification of every dispensed material. Only 60 of the 400 batches in the audit period have records available on site; the remainder are archived offsite and retrieval takes five working days. The audit is a two-day audit and one day has already been used. Last year's external audit found no issues in this area, and the plant manager asks that the audit be closed as 'conforming with observation' on that basis.
1. Evaluate the auditor assignment. What is the actual risk, and what are your options for the audit that is already under way?
Read the worked answer
The requirement. ISO 9001:2015 clause 9.2.2 requires the organization to ensure objectivity and impartiality in the audit process, and ISO 19011:2018 makes independence one of its audit principles. Independence means auditors do not audit their own work and are not auditing activity for which they have direct responsibility.
The risk. Osei was the supervisor of this area 14 months ago. A 14-month gap does not remove the self-review threat, because:
- Much of the system being audited (procedures, staffing decisions, record practices) may have been shaped under her responsibility.
- Records from her tenure fall squarely inside a normal audit period.
- She audited the same area last cycle, which compounds the pattern: an area effectively self-audited twice, with prior findings she wrote now being closed by her.
Options, in order of preference.
- Replace her for the remainder of this audit with an independent auditor, and have that auditor re-verify any conclusions already drawn.
- If no replacement is available, keep her as a technical resource but assign findings and conclusions to an independent auditor.
- Retain findings already raised only where they rest on documentary evidence that a second auditor reviews.
Whichever route you take, record the conflict, the decision, and the rationale in the audit file. Then fix the programme: risk-based scheduling, an auditor competence/independence matrix, and rotation of area assignments.
2. How should you treat the unavailability of 340 of 400 batch records with one audit day remaining?
Read the worked answer
Do not close as 'conforming with observation'. An audit conclusion must be based on verifiable evidence (evidence-based approach). For 85% of the period, the second-person verification control cannot be verified at all. Concluding conformance would be an unsupported opinion, and calling it an observation understates a control that the SOP designates as mandatory.
Practical route.
- Characterize the 60 available batches: are they the recent ones, or a biased slice? If the on-site records skew to a single shift, product, or period, the sample cannot support any conclusion about the period.
- Define a risk-based subset to retrieve urgently rather than all 340: batches with deviations, complaints, rework, new materials or new operators, and the most recent production. Request same-day or next-day retrieval for 15 to 25 records.
- Review that subset for the second-person signature, and for whether the second person was actually independent (not the same operator).
- If retrieval cannot be accelerated, record a scope limitation in the report with the specific batches affected, extend the audit or schedule a follow-up within the programme, and state the conclusion as 'conformance demonstrated for the 60 batches examined; verification not completed for the remainder'.
Also note that five-day retrieval for active-period records is itself worth a finding: records must be available where and when the activity is performed, and an archive practice that blocks verification is a control weakness in its own right.
3. The plant manager argues that last year's clean external audit justifies closing the area as conforming. How do you respond, and what belongs in the report?
Read the worked answer
The argument fails on two grounds. First, an external audit is a sample, not a certificate of every batch; absence of a finding is not evidence of conformance for a control the external auditor may not have tested. Second, the criteria for this conclusion are the SOP and ISO 9001, not the prior audit outcome.
What to say. Acknowledge the external result, then ask for evidence rather than opinion: can the plant produce the second-person verification records for the retrieved subset? If they can, the finding changes. If they cannot retrieve them, no prior result substitutes.
What belongs in the report.
- Audit criteria (SOP reference, clause 9.2/8.5.1 as applicable) and objective evidence, including batch identifiers examined.
- The sampling rationale and the explicit scope limitation, stated as a limitation rather than buried in a footnote.
- Nonconformity for any missing or non-independent verification found in the records reviewed.
- A separate observation on the archive retrieval time if it impedes verification.
- Follow-up actions with owners and dates, added to the audit programme.
Also record, in the programme-level file rather than the area report, that a request was made to soften the conclusion, and that the request was declined. That record protects both the auditor and the credibility of the programme.