Lead auditor assignment, impartiality and an unbuildable audit plan
A certification body assigns auditor L as lead auditor for the stage 2 audit of a water utility with 900 staff and 1.2 million customers. The plan is two auditor-days with one auditor. The stage 1 report records that BCMS documentation is largely complete, that management review has not yet been performed, and that no exercise has been run against the plans; it concludes that readiness for stage 2 is "marginal". The scope covers four sites (a treatment works, two pumping stations and a control centre) and two critical suppliers: single-source chlorine and SCADA maintenance. Travel between sites totals five hours. Sixteen months ago L's consultancy firm ran the client's BIA workshops and drafted its business continuity policy. The impartiality reviewer cleared L on the basis that "sufficient time has elapsed" and no further work was done. The CB's programme permits hybrid audits where justified, and the client has not been told who the audit team is.
1. Evaluate the impartiality decision. What should L do and what should the certification body do?
Read the worked answer
Sixteen months is short in a three-year certification cycle, and the nature of the work matters more than the elapsed time. L drafted the BC policy and ran the BIA workshops - the exact documented information and outputs that stage 2 will test. That engages a self-review threat (auditing one's own work) and a familiarity threat, and it creates a perception problem even if L believes they can be objective. "No further work was done" shows the relationship ended; it does not show the threat ended.
The sequence should be: L declares the relationship in writing to the audit programme manager and the impartiality function; the reassignment decision is theirs, not L's alone. The cleanest outcome is a different lead auditor for the whole audit. Partial recusal - L audits everything except 8.2 and the policy - is a second-best compromise the CB must be able to justify and record, and it is weak here because the policy and BIA outputs feed every other clause.
Also check whether the client has been informed of the relationship and given the opportunity to object, since the client has that right. If the CB insists L leads, L should decline: the duty of integrity is not delegable, and what is at risk is the credibility of the certificate, not L's schedule.
2. Rebuild the audit plan. What do you change about duration, sampling, suppliers and sequencing, and why?
Read the worked answer
The plan as briefed is not auditable. Two auditor-days covering 900 staff, four sites and two critical suppliers, with five hours of internal travel, leaves roughly one day of actual audit time - and stage 1 already found management review not performed and no exercises against plans. Those are not documentation gaps; they are probable stage 2 nonconformities that need deep sampling, not a confirmation pass.
Rebuild it:
- Duration: increase to at least four auditor-days or add a second auditor. No duration table is prescribed for ISO 22301; the CB must justify duration from scope, complexity, sites and prior findings, so record the rationale.
- Sampling: audit the control centre and treatment works on site, where recovery would actually be executed; sample one pumping station rather than both and state the sampling rationale in the report.
- Suppliers: treat chlorine and SCADA maintenance as interfaces to be verified at the client unless the suppliers agree to be interviewed; a supplier is not audited by ambush.
- Sequencing: verify 9.3 management review and 8.5 first - if leadership has not reviewed the BCMS, that finding reshapes the rest of the audit and the closing discussion.
- Stage 1 findings: resolve each one explicitly - closed, or carried into stage 2 as a finding. Do not let "marginal readiness" sit in the file as an unstated assumption.
3. What must the audit plan contain, and who agrees and approves it?
Read the worked answer
The plan needs: audit objectives; audit criteria (ISO 22301:2019, the BCMS procedures and any contractual continuity requirements); scope and boundaries, including what is excluded and why; dates, duration and site or remote designation for each activity; auditees and their roles; the audit team, technical experts and guides; a schedule mapped to clauses and to sites; reporting and closing arrangements; confidentiality and information-handling rules; and the escalation route if a major nonconformity emerges.
It must reach the client far enough in advance to resource the right people, and be agreed with the client - including who attends which session and whether any activity is remote. Where duration or scope has changed from the programme, approval sits with the audit programme manager, not with the auditor alone.
If the client refuses the additional duration, record it. A scope reduced by the client produces a certificate that covers less than the client believes it covers, and the audit file must show that the reduction was a client decision made with the implications known.