The Minister's Brother-in-Law and a Seven-Month-Old Concerns Log
You are conducting the second surveillance audit of a 600-employee medical equipment supplier. While interviewing the regional sales director about third-party management, he says: we had a consultant in the health ministry file, the minister's brother-in-law actually, but legal told us to end it last month and the file has gone back to legal. Payments to that consultant were USD 18,000 a month for market access support on a product line where 70 percent of sales go to public hospitals. Later, in the compliance office, you see the concerns log: three entries from the hotline, the oldest seven months old, all showing status open, and one names the same sales director. The compliance officer says the log is confidential and that investigations are an HR matter. The auditee's top management has asked to be briefed at the end of the day. Your programme rules require suspected bribery to be reported to the certification body's technical reviewer.
1. What are your immediate actions on the suspected bribery and the withheld file, including what you must not do?
Read the worked answer
Separate the auditor's role from the investigator's. My task is to establish whether controls conform, not to determine whether a bribe was paid. But a manager's statement that a consultant linked to a minister was engaged, at a substantial monthly fee, and that the file was withdrawn, is significant audit evidence and must be handled seriously and quickly.
Do: make a contemporaneous, factual record of what was said, by whom, in whose presence, and what you subsequently saw; near-verbatim wording, no conclusions. Ask neutral follow-up questions about dates, approvals and who signed the contract. Formally request the consultant file through the audit liaison and record the request and the response, including any refusal. Escalate the same day to the lead auditor and, per the programme rules, to the certification body's technical reviewer. Brief the auditee's top management, at the highest level available, that the matter must be preserved and investigated under 8.10, because investigating is the organization's responsibility, not mine. Confirm the escalation in writing.
Do not: search for the file, contact the consultant or the ministry, interview witnesses in a way that could taint the organization's own investigation, warn anyone to stay quiet, or promise confidentiality you cannot deliver. Do not allow yourself to be drawn into advising on the legal position.
Finally, consider and document whether continuing the audit as planned could compromise evidence or the organization's investigation, and tell top management if you believe records are at risk of destruction.
2. How do you evaluate the reliability of this evidence, corroborate it, and deal with the confidential concerns log?
Read the worked answer
Apply the evidence-based approach: an oral statement from a manager with a potential interest is weak on its own, and the documentary evidence I want is currently withheld. Verification is the work.
Corroborate systematically. Ask for the third-party register and see whether the consultant appears. Request the contract, the approval trail and the payment records, and test them against the financial controls in 8.3: who approved USD 18,000 a month, were there two signatories, is the beneficiary identifiable? Check whether any due diligence exists under 8.2 and whether the risk assessment classifies health ministry intermediaries as high risk. Look sideways: if this were a practice rather than an incident, other consultants and other markets should show the same shape. That pattern test is what turns an anecdote into a finding.
On confidentiality: I do not need identities; I need dates, status, triage decisions, who was assigned and what was concluded. Request a redacted extract. If the request is refused, note the refusal: 8.9 requires that concerns can be raised and are dealt with, and an auditor who cannot see whether they were dealt with has found the answer to the question.
Three concerns open for seven months, one naming the sales director, with investigations described as an HR matter, is a test of 8.9 and 8.10: was the concern assessed, was the assessor independent of the person named, was a decision recorded? An allegation about a consultant and a public official is not an HR matter, and treating it as one is itself the control failure.
3. What do you report to top management and the technical reviewer, and how do you classify what you have found?
Read the worked answer
Report facts, not conclusions. Write what was said, by whom, when, and what was and was not made available. Never write that the company bribed a public official; the evidence does not support it and it is not the auditor's conclusion to make. A defensible phrasing is: a consultant engaged at USD 18,000 per month for market access support, on a product line where 70 percent of sales are to public hospitals, was terminated last month; the file was said to have been returned to legal and was not made available; the sales director described the consultant as related to a serving minister.
Classify the control failures, which are what the certificate rests on: likely major nonconformity against 8.2 (no evidence of risk-based due diligence on a high-risk business associate) and against 8.9 and 8.10 (concerns unresolved for seven months, one naming a manager under whose area the matter sits, no evidence of investigation). Consider 8.3 if payments were approved without evidence of control, and 10.1 if the organization has no mechanism to act on what it learns.
Briefing top management: state what was found, what was requested and not provided, what the organization must now do under its own procedures (preserve records, conduct an investigation under 8.10, report as required by its procedures and applicable law), and what will appear in the audit report. Do not give legal advice.
Escalation: confirm the report to the technical reviewer in writing and record that it was made. Whether certification can proceed is the impartial decision-maker's call, not mine, and I should say so plainly rather than appearing to prejudge it.