Contradictory evidence, an anonymous source and a closing meeting in 45 minutes
Two auditors are on day three of a stage 2 audit of a 250-person software company. In interview the BC manager says: "We fail over to the secondary data centre every quarter - the runbook is on the shared drive - but I don't keep records, it's a small team and we just know it works." With 45 minutes before the closing meeting, an engineer shows one auditor, on condition of anonymity, a chat message from the CTO dated three weeks earlier: "Skip the DR test this quarter, we need the environment for the 9.2 release." The client's audit guide states that all auditor notes must be shared with the auditee before the closing meeting. The lead auditor has already drafted two minor nonconformities and an observation. The certification body's code of conduct requires confidentiality of information obtained during an audit, and the audit report is due to be issued within five working days.
1. Assess the evidential value of the interview statement and of the chat message. What corroboration do you need before writing a finding?
Read the worked answer
The interview statement is a claim, not evidence of the claim. Reliability runs roughly records, then direct observation, then interview. "I don't keep records" is itself significant: if quarterly failovers happen and leave no trace, there is no evidence they happened, and none that they achieved the intended outcome. Ask what does exist - change tickets, monitoring alerts, post-test emails, data-centre access logs, the runbook's change history, the annual exercise report required by 8.5. Any of these corroborates or contradicts.
The chat message is documentary evidence with unknown provenance: a screenshot supplied anonymously could be edited, a joke, or out of context. Verify independently - check release schedules and change records for the quarter, ask IT operations and the data-centre provider whether a test occurred, and put the substance to the CTO and the BC manager without naming the source. If the records show no test occurred while the BC manager asserted quarterly testing, the contradiction is the finding; the message is corroboration, not the finding.
Never build a nonconformity on a single unverified screenshot, and never on a single interview statement.
2. How do you handle the client's demand to see all notes, and the engineer's request for anonymity?
Read the worked answer
Two obligations are pulling against each other. The client's audit guide is a contractual arrangement; the CB's confidentiality requirements and code of conduct are the binding professional obligations. Findings and the evidence supporting them must be presented at the closing meeting - that is normal and required for a fair process - but raw working papers containing an identifiable source should not be handed over, and the auditor should not promise the engineer absolute secrecy, because the auditor may be required to act on the information.
Practical handling: before accepting the screenshot, tell the engineer what can and cannot be kept confidential. Escalate to the lead auditor and the audit programme manager the same day. Record the evidence and its provenance in the working papers. Present the substance - a scheduled recovery test not performed - to the auditee and let them explain.
If the client insists on the notes, explain that the report and its findings will be shared, and that working notes remain the CB's property unless the contract says otherwise; then let the programme manager resolve the contractual point. An auditor at the door of a closing meeting should not be improvising a confidentiality settlement.
3. With 45 minutes left, how do you classify the exercise finding and how do you handle it at the closing meeting?
Read the worked answer
Grade from what is verified, not from what is suspected. If the exercise programme defines a schedule and records show it was implemented for most of the period with one skipped test, that is a lapse in a functioning process: minor, against 8.5. If records show the programme has not been implemented as defined and the claimed quarterly failover is folklore, the programme element is ineffective: major. The BC manager's statement that no records are kept points toward the second, but you need the schedule and whatever records survive first.
Time pressure does not change the grade and is not a reason to omit the finding. Options: extend the audit by half a day with the client's agreement; hold the closing meeting on the verified findings and state that the 8.5 verification is incomplete pending specific records; or agree a defined follow-up activity before the report is issued.
What the auditor must not do is raise an unsupported major to be safe, or stay silent so that certification can proceed on an untested claim. The closing meeting should present summarised findings against criteria with evidence, and any major should be discussed with the auditee before the report is issued.