Team Composition, a Requested Site Exclusion and a Written Facilitation Payment Guideline
A certification body has scheduled a five-day initial certification audit of a 3,200-employee construction group that bids for publicly funded road projects. The scope statement supplied by the client reads head office and all project sites. The audit budget covers head office plus two of the eleven active sites. The team is a lead auditor with twelve years of construction commercial experience who has never led an ISO 37001 audit; an auditor who left the group's joint-venture partner 14 months ago, where she was a commercial manager; and a technical expert in public procurement. Two days before the opening meeting the client asks that Site 7, a USD 90 million road project using a foreign subcontractor, be removed from the sample because the project director is on leave until after the audit. The client also sends its internal facilitation payment guideline, which authorises site managers to make cash payments of up to USD 60 when a public official makes continued works impossible.
1. Evaluate the competence and impartiality of the audit team. What must be done before the audit can proceed?
Read the worked answer
Two problems must be resolved before the opening meeting, and neither is solved by a signed declaration.
Competence. Team competence must cover both the standard and the sector. A lead auditor with deep construction experience but no ISO 37001 leadership cannot lead an ISO 37001 audit; leading requires command of the standard's requirements, of audit method and of the certification process. Either replace her as lead with an ABMS-qualified lead auditor and keep her as the sector specialist, or pair the two and make the roles explicit in the plan. The technical expert is not an auditor: their advice informs the team but they do not audit alone, do not decide findings, and their competence (public procurement) must be evidenced like anyone else's.
Impartiality. The auditor who left the JV partner 14 months ago was a commercial manager: she may have taken, priced or approved precisely the decisions the team will now audit, and she retains professional and social ties to individuals in the audit population. Fourteen months is recent. The self-review and familiarity threats are high and cannot be managed by disclosure alone. Remove her from the audit, or at the very least from the JV-related sites, and record the analysis and decision in the audit programme file.
Before proceeding: document the competence and impartiality evaluation, notify the client that team changes may affect the schedule, and brief whoever ends up leading on the criteria, the scope and the sampling rationale. If the changes cannot be made before day one, the right decision is to postpone, not to improvise.
2. How do you handle the client's request to exclude Site 7, and how do you justify the sampling approach?
Read the worked answer
Scope and sample are two different decisions. The organization defines the scope (Clause 4.3 requires it to be documented and available); the certification body decides the sample. A client cannot choose which of its own sites is audited within a scope it has declared.
On Site 7 specifically: a project director on leave is not a reason to exclude a site; a site can be audited with the deputy in post. Worse, this is a USD 90 million project using a foreign subcontractor, which is close to the highest-risk profile in the sample: high value, public client, third-party interface, likely agent or subcontractor payments. Excluding it removes the sample's main purpose.
Two legitimate outcomes: audit Site 7 as planned, or the client formally narrows the scope statement so that it no longer claims all project sites. In the second case the certification body must consider whether the resulting certificate would mislead a reader, and the scope wording is changed accordingly.
Sampling rationale: select on risk, not convenience. Criteria to state in the plan: contract value, project stage (award, procurement, mobilisation, close-out), geography, use of agents or intermediaries, proportion of public-sector clients, subcontractor arrangements, internal audit findings and prior problems. Always include the highest-risk site; use the remaining days for a spread that tests the system rather than repeats it. Record the rationale in the plan so the client sees the choice is principled, and remind them that the sample is not exhaustive, which is why their own monitoring (9.1) and internal audit (9.2) matter.
3. How does the organization's facilitation payment guideline affect your audit criteria and planning?
Read the worked answer
The audit criteria are ISO 37001 and the organization's own requirements; the guideline is not a criterion against which the certificate is issued, but it is powerful evidence about whether the system meets the standard.
ISO 37001 defines bribery around giving, offering, promising, accepting or soliciting an undue advantage to induce a person to act or refrain from acting in relation to their duties. A cash payment to a public official to make continued works possible is an undue advantage; the fact that the guideline applies a USD 60 ceiling does not change its character. The standard expects the anti-bribery policy under 5.2 to prohibit bribery without exception, and expects operational controls (8.1, 8.3, 8.4, 8.7) to prevent or detect it. A written guideline pre-authorising payments is evidence of a designed control that permits bribery.
There is a recognised narrow exception for genuine duress, where there is an imminent threat to health, safety or liberty. The standard's logic is that such payments are handled as exceptions: reported immediately, recorded, reviewed at senior level, remediated, and used to change the risk assessment. A guideline that pre-authorises them at site level does the opposite: it normalises and hides them.
Plan: obtain the guideline and its approval history; sample payments actually made under it and check recording, reporting and review; interview site managers about when they have used it; check whether the risk assessment considers the practice and whether internal audit or monitoring has looked at it. Expect a major nonconformity, and check whether the policy itself and top management commitment (5.1, 5.2) are also implicated.