Planning a stage 2 multi-site audit with a late document pack
You are lead auditor for the stage 2 certification audit of Kestrel FM, which provides integrated FM to 85 client sites across three regions (1,400 staff, roughly 60% mobile). The scope is 'provision of hard and soft FM services to client sites'. The stage 1 report noted that internal audits covered 12 sites; nine sites acquired 11 months ago still use legacy procedures and a different CMMS; two regions have no competent internal auditors; and the central FM system documents were revised four weeks ago. You have two auditors, six on-site days and three remote days. The draft audit plan assumed 15 site visits. The client relations manager sends the document pack three days before the audit instead of the contractual two weeks and asks you to 'keep it to head office - the sites are all the same'. Travel between sites costs half a day each way.
1. Design and justify the site sampling approach for this stage 2 audit.
Read the worked answer
Certification attaches to the FM system, which is managed centrally; site visits are how implementation is verified. Sampling therefore has to be defensible, not convenient, and 'the sites are all the same' is exactly the assertion the sample must test.
The selection should be risk-based with a random component. Mandatory inclusions from the stage 1 findings: at least three of the nine acquired sites, because change and legacy procedures are where the system is most likely to have broken down; at least one site in each of the three regions; a site in each region that lacks a competent internal auditor, to see how the gap is covered; and sites using the new central documents to check that the revision reached the front line. Add risk criteria: largest sites by headcount and asset value, sites with the highest volume of reactive work, a site with recent complaints, and one where a mobile workforce predominates, since 60% mobile changes how supervision and competence are evidenced.
The arithmetic constrains the answer. Twelve auditor-days minus half-days for travel gives roughly six to eight site visits plus head office. I would allocate two to three days at head office for clauses 4 to 6, 9 and 10, then run site visits in pairs with an auditor at each site, and document the rationale for every site chosen. If the certification body's multi-site procedure requires a larger sample than the time allows, the answer is to extend the audit, not to overreach the evidence.
2. The document pack arrives three days before the audit. How do you adapt the audit plan without weakening it?
Read the worked answer
Three days is enough for a focused review but not a full one, so I would prioritise rather than pretend. Priority documents are those the audit cannot be planned without: scope and FM policy, the risk register and objectives, the internal audit programme and recent reports, management review minutes, the KPI and performance reports, the CMMS asset and work-order extracts, and the revised central procedures with their version history.
I would re-issue the audit plan with the revised sequence and circulate it for agreement, noting what has and has not been reviewed. I would tell the client that the late pack increases audit risk and that some verification will move from document review to interview and observation, which costs time on site. If key documents are still absent at the opening meeting, the response is not to cancel automatically but to record it: required documented information that cannot be produced is evidence relevant to clause 7.5 and to the effectiveness of document control, and a nonconformity may follow. What I would not do is let the missing pack become a reason to reduce site coverage, because the site-level evidence was already the weakest area at stage 1.
I would also document the exchange in the audit file, since a pattern of late document submission is relevant to the next surveillance audit's risk assessment and to the certification body's planning.
3. The client relations manager asks you to drop the site visits, and separately asks to add a site 200 km away because a client has complained. How do you handle both requests?
Read the worked answer
Both requests are plan changes, and both must be handled through the audit client and the certification body's procedures, with the reasons recorded.
Dropping the site visits is not a decision the auditor can take on commercial grounds. If the certification scope covers services delivered at client sites, a head-office-only audit cannot support a conclusion about implementation, and the audit conclusion would be unreliable. I would explain this, discuss with the audit client, and if the organisation still refuses access, record the limitation clearly - a scope limitation of that kind can affect the certification decision. What I would not do is quietly accept a narrower audit and issue an unqualified conclusion.
Adding the complained-about site is different: it is a risk-driven request that may improve the audit. The question is feasibility. At 200 km, that is a full day of travel plus audit time, so something else must give. I would check whether the complaint relates to FM performance; if so, it is a strong candidate and I would rather swap it for a lower-risk site than simply add it. I would put the change in writing, adjust the plan, tell the auditee which sites are affected, and keep the total coverage at least as strong as planned. If resources do not allow it now, I would record it as a priority for the next audit and note the complaint as a lead rather than pretend it has been covered.