The Auditor Who Used to Run the System
Karim has been a contract auditor with a certification body (CB) for five months. Before that he spent eight years at NordPack, a corrugated packaging manufacturer, where he was QHSE manager until he left fourteen months ago. The CB's scheduling tool flagged him as technically ideal for NordPack's combined ISO 9001 and ISO 14001 surveillance audit and assigned him as sole auditor for the two-day audit next month. The audit will cover, among other things, management review and incident investigation - processes Karim designed, implemented and signed off. His former deputy, now QHSE manager, will be the auditee contact. Karim completed the CB's annual impartiality declaration, which asks only about current financial interests, directorships and consultancy contracts; he answered 'none'. He needs the two fee days. The client has already been told who is coming.
1. Identify the impartiality threats in this assignment and explain why Karim's signed declaration does not resolve them.
Read the worked answer
Threats present:
- Self-interest: Karim needs the fee days, so a convenient assignment is a comfortable one.
- Self-review: the audit covers management review and incident investigation - processes he built and ran. He would be evaluating his own work.
- Familiarity: eight years with the team; his former deputy is the auditee contact; social pressure to be generous.
- Intimidation in reverse: he knows where the weaknesses are, and the auditee knows he knows.
The declaration does not resolve these because it only asked about current interests. Impartiality is judged against actual circumstances, not against how completely someone filled in a form. A 'none' answer on a narrowly scoped form is not a safeguard, and the CB cannot treat it as one. ISO/IEC 17021-1 applies a two-year interval before personnel who were employed by the client can be used in its audit; at fourteen months Karim is inside that window. Even outside it, the self-review threat here would need a documented analysis, not a checkbox.
2. What should Karim do before the audit, and what should the CB do once he raises it?
Read the worked answer
Karim should disclose in writing to the CB's impartiality or technical manager before the audit: his former role, the dates of employment, the processes he owned, and the relationship with the auditee contact. Then he should decline the assignment. Disclosure after the audit is worthless - the purpose is to prevent the threat, not to document it after the certificate is issued.
The CB should:
- Remove him from the team and appoint an auditor with packaging-sector competence and no such history.
- Record the impartiality review and the reasoning behind the decision.
- Check whether he has already been used on NordPack audits since joining.
- Correct the declaration form so it captures past employment and prior consultancy, not only current interests.
If no replacement exists, the correct answer is to postpone, not to proceed with a disclaimer. A disclaimer does not restore independence. Deferring to the client because 'they asked for him' would be the classic failure: the client cannot waive the CB's impartiality obligations.
3. On hearing of the proposed change, the client says it is happy to keep Karim because 'he knows our system better than we do'. How should the CB respond?
Read the worked answer
Decline, explain, and record. Client preference is not a safeguard - here it is a symptom of the familiarity threat. The client wants an auditor who already accepts the system as adequate, which is precisely the condition impartiality requirements exist to prevent. The CB should say plainly that using Karim would compromise the credibility of the certificate and the CB's accreditation, then reassign and note both the client's request and the refusal in the audit file.
Karim's own position matters too. Accepting because he needs the days would be a self-interest decision dressed up as client service. The test of integrity is not whether the conflict is visible to others but whether the auditor acts on it when it is only visible to him.
If the client insists on Karim as a condition of the contract, the CB should treat that as information about the relationship, not as a scheduling problem.