Designing a Surveillance Programme: Twelve Subsidiaries, One Certificate, Twenty-Five Days
You manage the certification programme for a body that has one ISO 37001 certificate covering a group with 12 subsidiaries in four countries. The next surveillance is due in three months. Subsidiary D, in a country rated high risk on corruption indices, received two major nonconformities at the last audit and has grown from 40 to 260 staff. Subsidiary H hosts the group's shared finance function. The programme allows 25 auditor-days for this surveillance. Only one auditor on the roster speaks D's language; she is also the group's account manager and has already been booked for 18 days in that quarter. A visa for country D takes three weeks to obtain. The group requests that four subsidiaries, including D, be audited remotely to save cost and travel. Two of the group's internal auditors have asked to shadow the audit team so they can learn the standard.
1. Design the surveillance programme: which entities you sample, how you allocate the 25 days, and how you justify it.
Read the worked answer
Design from risk, then fit the days to the risk, not the reverse. Start from what has changed and what is weak: D has grown more than sixfold and carries two major nonconformities; H hosts shared finance, so every agent payment and disbursement in the group passes through it; several entities operate in high-risk jurisdictions; there will be prior findings, complaints and internal audit results to weigh.
Sample. Audit H and D in every case. H because central financial controls under 8.3 affect every entity; D because it is the worst performer and the fastest-changing. Then choose two or three more on stated criteria: entities using agents or intermediaries, entities with public-sector revenue, a newly acquired entity, and one lower-risk entity to test whether the system works where it is not under pressure.
Indicative allocation of 25 days: two auditors for four days at H (8 days); two auditors for four days at D including travel (8 days); one auditor for three days at each of two further sites (6 days); three days for programme management, reporting, review and closing. That totals 25. If the budget is short, cut lower-risk sites, never the high-risk ones, or request additional days under the programme's rules. Never dilute coverage across many sites to make the plan look comprehensive.
Justify and record: the sampling rationale, the risk inputs used, the schedule, competence needs, the criteria and the reporting lines. The programme must also be updated by results: a further major at D changes next cycle's allocation.
2. How do you resolve the conflict between the only language-qualified auditor and the impartiality requirement?
Read the worked answer
There are two obvious options and both have to be assessed honestly rather than papered over.
Option A: keep her and firewall the account role. Removing her from account management looks like a fix, but the underlying threat is self-interest, not just role conflict: her commercial success depends on this client's satisfaction, and D is the site most likely to produce uncomfortable findings. A firewall does not remove that, and a written declaration does not manage it. For a high-risk site with a poor history this is not acceptable.
Option B: find competence elsewhere. Search the wider roster and partner certification bodies for a language-qualified ABMS auditor; consider a contract auditor, qualified through a witnessed audit and documented before independent use. An interpreter is workable if briefed, bound by confidentiality and technically literate in the sector, but it partly displaces the problem rather than solving it: understanding testimony in a bribery interview is a competence issue under 7.2, not just a translation issue. If no solution exists in time, reschedule the D audit to allow the three-week visa and a properly qualified team, and record why.
Regardless of the route: rotate the account-management role so that no individual holds both roles for the same client, document the impartiality analysis and the decision in the programme file, and put it in front of the technical reviewer. If the only workable arrangement compromises impartiality, the programme decision is to restructure or decline, not to proceed and disclose afterwards.
3. Should the group's request for remote auditing of subsidiary D be granted, and on what conditions? How do you handle the internal auditors' shadowing request?
Read the worked answer
Remote auditing of D. Remote is not automatically wrong, but it must be justified by risk. Against it: D is the highest-risk entity, has two prior major nonconformities, and the areas most needing verification, agent payments, site-level hospitality, physical controls, interviews without a manager present, and the authenticity of documents, are the hardest to test at a distance. For it: cost, and the risk that the alternative is no audit at all.
Decision: H can be audited largely remotely (systems, samples, records). D should be on site, or at minimum visited physically by a locally based auditor with the remote team supporting. If remote is unavoidable, conditions: secure video with a live camera walk-through; documents viewed live on screen rather than pre-uploaded only; interviews arranged by the audit team in private, not through management; pre-agreed uploads retained for the file; a connection test beforehand; physical verification deferred to the next on-site visit; and the limitation stated in the report. Record the reasoning.
Shadowing. Allowed in principle, but conditions apply: written consent from the client, a signed confidentiality undertaking from each observer, observers do not participate, do not answer questions on behalf of interviewees, and do not take the team's evidence. Critically, they should not observe areas for which they are themselves responsible, since that creates a self-review problem and may make staff less candid. Restrict them to the opening and closing meetings or to an unrelated process, and record the arrangement in the programme file.