Audit Sampling Under a 40-Day Budget with a Regulator Deadline
You are lead auditor for an internal audit of 12 regional warehouses. You have two auditors and 40 working days. A regulator has announced inspections of the three highest-volume warehouses within 90 days. One warehouse had a repeat finding last year for incomplete temperature logs; another is a new acquisition with no audit history; the remaining seven are routine. Your audit scope covers receiving, storage, dispatch, and recordkeeping. The budget allows 3 auditor-days per routine site, 5 per high-risk site, and 6 per new acquisition. One auditor previously managed the warehouse with the repeat finding. The operations director asks you to skip that warehouse to avoid 'looking personal' and to spend the extra days on the new acquisition. You must propose a sampling and resourcing plan that is defensible to the regulator.
1. Propose an allocation of the 40 auditor-days across the 12 warehouses. Justify what you cover and what you sample.
Read the worked answer
Fully cover the three regulator-facing high-volume warehouses at 5 days each = 15 days. Cover the repeat-finding warehouse at 5 days, because a repeat finding is the highest-risk signal and the regulator is likely to ask about it. Cover the new acquisition at 6 days because there is no audit history. That uses 26 days and leaves 14 days. At 3 days per routine site, fully covering all seven would need 21 days, which is unaffordable. Select four of the seven routine sites for full 3-day audits = 12 days, leaving 2 days for planning, report writing, and contingency. Choose the four using documented risk criteria: highest volume among the remaining sites, recent customer complaints, recent process changes, and time since last audit. For the three routine sites not audited, perform a 0.5-day remote desk review of temperature logs, training records, and dispatch exceptions, using the 2 contingency days plus savings from travel if available. State in the audit plan that the sample is risk-based, not random, and that the three regulator-facing sites and the repeat site were mandatory inclusions. This is defensible because the highest-consequence sites are covered and the exclusions are documented.
2. How should you handle the conflicted auditor and the operations director's request to skip the repeat-finding warehouse?
Read the worked answer
Do not let the auditor who previously managed the repeat-finding warehouse audit it. Independence is both real and perceived: that auditor could be reluctant to criticize former decisions or could overcorrect. Assign the other auditor as lead for that site and use the former manager only to provide historical context in a documented briefing, outside the audit team's evidence-gathering. If neither auditor is independent, bring in a peer reviewer or swap one site with another qualified auditor, and record the independence decision. The director's request to skip the site should be declined. Skipping the one site with a repeat finding creates the appearance of concealment and removes assurance exactly where the regulator will look first. Explain that the audit is not personal; it tests the process and the corrective action. Offer the director a courtesy briefing on scope and timing, and minute the request and your rationale. If the director insists, escalate to the audit committee or compliance lead. Use the 5-day allocation for the repeat site and require the audit to test closure evidence for the temperature-log finding, not just re-read the same logs.