Independence, competence and an anonymous allegation
Arden Estates is a public-sector property organisation preparing a tender with a major tenant. The head of estates commissions an internal audit of the property services department and wants a report 'confirming we comply with ISO 41001' before the bid. The audit team comprises three people: the senior FM operations manager, who owns the work-order and PPM processes being audited and who will act as lead auditor; a health and safety officer who has never audited before; and an external consultant who drafted the department's FM procedures six months ago, engaged as technical expert. The audit criteria have been set as the departmental procedure only. Three days before the audit, an anonymous email arrives alleging that a named cleaning subcontractor's staff are working without right-to-work checks and that the site manager knows about it. The consultant says the allegation is outside the audit scope and should be deleted.
1. Assess the team against the principles of auditing and propose what must change before the audit proceeds.
Read the worked answer
Three principles in ISO 19011 are engaged. Independence: auditors must be independent of the activity audited wherever practicable, and must act in a way that is free from bias and conflict of interest. Objectivity: conclusions must be based on evidence, not on the interests of the person producing them. Competence: the team must collectively have the knowledge and skills to achieve the audit objectives.
The senior FM operations manager auditing the processes he owns is the clearest problem. He has a direct interest in the outcome; his findings would not be credible internally or to the tenant. Reassigning him out of the audit is the cleanest solution. If he must be involved, it can only be for areas outside his responsibility and never as the sole decision-maker on findings.
The consultant drafted the procedures that would be audited. That creates a self-review threat: an auditor who wrote the criterion is unlikely to conclude that it is inadequate or not followed. He may be used as a technical expert who provides sector knowledge, but the audit conclusions must be reached by an independent auditor; better still, exclude him from the clauses covering the procedures he wrote and disclose the relationship in the report.
The health and safety officer is not yet competent to audit alone. Competence requires audit training, knowledge of ISO 41001 and its audit criteria, and FM technical and legal understanding. He can be a team member under supervision. Finally, if the objective is compliance with ISO 41001, the criteria must include the standard itself, not only the internal procedure, and the team currently lacks anyone who has audited an FM management system.
2. How should the auditor respond to the anonymous email, and what line of enquiry does it create?
Read the worked answer
Deleting it would breach integrity and confidentiality. The auditor should not investigate the allegation as a disciplinary matter, but neither can it be ignored: it is information that affects audit risk and may indicate a legal compliance failure.
The immediate action is to escalate to the audit client and the audit programme manager, and to the organisation's nominated channel for whistleblowing or fraud concerns if one exists. The decision whether to extend the audit scope or defer to a separate investigation belongs to the audit client, not to the auditor alone, and certainly not to the technical expert on the team.
Within the audit itself, the allegation converts into a legitimate line of enquiry about contractor control. I would sample the cleaning subcontractor's file: is there a contract with defined requirements; are there records of right-to-work checks for the operatives on site; are the checks current; does the site manager review them; is there any audit or spot-check by the organisation? That tests the system, not the individual. The report would describe the result in terms of the process - for example, a finding that the contractor management process does not define who verifies eligibility to work or the frequency of verification - and would not name the site manager or the informant.
If sampling reveals an actual legal breach affecting people currently working on site, that is a matter for immediate escalation under the organisation's policies. The auditor's role is to surface it through the right channel and to record what was found, not to run the investigation.
3. The head of estates asks you to keep the report 'clean' so the tender is not affected. What do you do?
Read the worked answer
The request engages integrity and fair presentation directly. Audit reports must reflect audit activities truthfully and accurately, and significant risks encountered during the audit must be reported. A report shaped by commercial convenience is not an audit report; it is promotion.
My response would be practical rather than moralising. I would explain that a report showing findings, agreed corrective actions and a follow-up date is often more persuasive to a tenant than a blank page, because it demonstrates the organisation knows its position and is managing it. I would also correct any misconception that an internal audit report supports a claim of ISO 41001 certification: only an accredited certification body can issue that, and an internal report cannot be presented as certification.
If the pressure continued, I would escalate to the audit client or the organisation's audit committee and document the request. If a report were still suppressed or materially altered, I would consider withdrawing from the audit and would not sign the report. Signing a sanitised report would attach my professional judgement to a conclusion I do not hold.
The underlying judgement for a candidate is this: the auditor's duty is to the audit criteria and evidence, not to the business outcome the client wants. Being diplomatic about how a finding is worded is legitimate; changing what it says is not.