The Hose, the Manifests and the Whiteboard
On day two of an ISO 14001 surveillance audit at a metal-finishing plant, while tracing waste flows, you find a flexible hose running from a solvent drum to a surface-water drain, with the drum valve open about a quarter turn. A five-litre puddle is present. You photograph the setup with the site manager standing beside you. Later, in the waste office, you find that purchase records show 1,200 litres of degreasing solvent received in the last quarter, while hazardous-waste consignment notes account for only 180 litres. A handwritten note on the whiteboard reads 'audit - keep drums 3 and 4 off the manifest'. The site manager says the hose is 'rainwater from the roof' and asks you not to write anything until he has spoken to his managing director. He also mentions that your CB audits his largest customer. The audit report is due to the CB in three working days.
1. What do you record, and how do you separate observation from interpretation?
Read the worked answer
Record precisely, and keep what you saw separate from what it might mean.
- Observed: hose connected from the drum valve to the surface-water drain; valve open approximately a quarter turn; visible liquid; drum identification; date, time, location; photograph taken in the site manager's presence.
- Records: 1,200 litres purchased in the quarter against 180 litres on consignment notes; the whiteboard note, photographed and transcribed.
- Statements: the site manager's explanation that the hose is roof rainwater, recorded as the auditee's statement, not as a finding of fact.
Then frame the nonconformity against requirements you can actually cite: control of operational activities, management of hazardous substances, emergency preparedness and response, and the organisation's compliance obligations. Do not write 'the organisation is illegally discharging solvent'. That is a legal conclusion you are not competent to make and it goes beyond the audit criteria. The evidence should be strong enough that a reader draws the obvious inference without you asserting it - that distinction is what makes the report survive a dispute.
2. What are your confidentiality obligations here, and what must you refuse to do?
Read the worked answer
Confidentiality covers everything you saw and were told. You do not disclose it to the environmental regulator, the customer, the press, or anyone outside the audit process. Your reporting channel is the audit client - the organisation being audited - through the audit report and closing meeting, plus your CB internally. ISO 19011 does not make auditors enforcement officers, and a unilateral report to an authority would breach confidentiality and exceed your role.
What you must refuse is the request to write nothing until the managing director is briefed. Deferring the closing meeting by a day is a scheduling matter; omitting the evidence is suppression. Say plainly that the evidence will be recorded, that the organisation will have a full opportunity to respond, and that any legal question is for them and their advisers.
If you believe there is an imminent risk of significant harm - the drum is still open and it rains tonight - the right move is to tell the site manager and the audit client immediately so they can stop it, and to inform your CB. That is different from going public. If your CB's procedures or local law impose a reporting duty, follow them; otherwise escalate internally and let the CB's quality or legal function decide, not you on site.
3. How should you handle the remark that your CB audits the company's largest customer?
Read the worked answer
Treat it as an attempt to link the finding to a business relationship, not as a reason to change the finding. It does not alter the evidence - the hose, the valve and the numbers are what they are - but it is a fact about the audit that must be declared.
Record the statement in the audit file and tell the CB's quality or impartiality function, so they can check whether any relationship exists that affects the audit or the certification decision. Do not let it make you softer to protect the CB's commercial relationship, and do not let it make you harsher to prove you cannot be bought. Either reaction makes the audit about the auditor rather than the client's environmental controls.
The test is whether the report would read the same if the remark had never been made. If it would, the finding is sound.