The Auditor Who Used to Consult: Impartiality and a Scope That Has Outgrown the Certificate

Criteria. Impartiality is an audit principle and a condition of certification. Consultancy and audit must never be combined, and the cooling-off period normally applied is two years.

Facts. Paid consultancy ended 18 months ago; Marco then audited the last two surveillance visits.

Judgement. (1) Cancel and replace the assignment: the cooling-off period has not elapsed, and the residual threat is self-review - he would be testing data-governance controls he designed - plus familiarity and self-interest. (2) The problem is retrospective. Two audits were conducted by ineligible personnel, so the certification function cannot simply assume those conclusions are sound. Open a formal impartiality review, re-examine both reports and the decisions taken on them, decide whether independent re-verification of any area is needed, and record the decision and its rationale. (3) Treat the root cause as resource planning: contractor screening did not check prior relationships with the client.

Recording. Impartiality threat record, reassignment justification, and a file note on the earlier audits. The programme manager must escalate to the impartiality/certification function rather than decide alone; where impartiality cannot be demonstrated, the remedy may include additional audit activity at the CB's cost.

Judgement: no - this is a significant change, not routine surveillance.

Three indicators drive the conclusion: a new AI use case in a domain the CB has never assessed (generative AI applied to employment decisions, with direct effects on individuals), a new site performing development activity, and adverse incident history in the existing scope. Certification rules require the CB to evaluate changes affecting the certificate and to perform additional audit activity before the certificate is extended. Allowing the activity to sit silently inside an existing certificate misrepresents what has been certified.

Planning consequences:

• Redefine the scope statement; it cannot be left to imply coverage of HR screening.
• Reassess audit time - new technology, new site, 60 % headcount growth and four incidents all point upward.
• Secure competence the current team lacks: generative-model behaviour, bias testing in recruitment, employment-law context.
• Run a documentation and readiness review of the new area before on-site activity, audit Lisbon on site, and sample all four incidents plus the related corrective actions.
• Confirm whether the client notified the CB as its contract requires; if not, that is itself a client-side finding.

Response. The certificate states what has been audited. The CB cannot let a client represent uncertified activity as certified, and the audit team cannot endorse it - doing so would breach integrity and fair presentation, and would mislead the tender authority. The director can be given a written statement of the current scope and told what is needed to extend it.

What the programme manager must decide, and record:

1. Whether to bring an extension audit forward to meet the tender timetable, at the client's request and with the client accepting the cost; a compressed schedule must not cut competence or sampling below what the evidence requires.
2. Whether suspension is warranted. Suspension is not the automatic answer to a scope gap, but the four incidents - two involving biased outputs in the certified scope - raise a separate question of whether the certified AIMS remains effective; that question must be evaluated on the incident evidence, not on the tender deadline.
3. How to communicate the decision in writing, including the effective date and the interim wording the client may use.

The deadline itself must play no part in the technical judgement; it may only affect sequencing.