Closing meeting dispute over pre-deployment human rights vetting
You are lead auditor closing a Stage 2 audit of a company providing security and support services at an immigration detention centre. The contract requires all guards to be screened against the International Code of Conduct for Private Security Service Providers before deployment. You sampled nine personnel files. Three have no documented human rights vetting; two of those guards were deployed at the centre for seven weeks before a vetting record appeared. One vetting form is signed by the subcontractor's HR officer, not by the company. In the daily debrief you raised missing vetting for two files; the HR manager said she would 'look into it'. At the closing meeting, the country director says: (a) the client supervises guards, so screening is the client's responsibility; (b) the auditor cannot issue a major nonconformity because it was not raised formally; (c) a major will delay a UN tender. The HR manager now produces a spreadsheet showing 'all guards vetted' but no dates. The audit team has a flight in three hours.
1. How should the lead auditor conduct the closing meeting and respond to the three objections?
Read the worked answer
Purpose of the closing meeting The closing meeting presents findings, not a negotiation. The lead auditor should thank the team, state the audit scope and criteria, summarise the evidence, present nonconformities and opportunities for improvement, explain the certification process, and record disagreements. The meeting should be minuted.
Objection (a): client supervision Client supervision does not transfer the provider's responsibility. The contract places vetting on the provider, and ISO 18788 requires the organisation to ensure competence and suitability of personnel, including subcontractors. The provider deploys the guards and controls the employment relationship. The auditor should point to the contract clause and the sampled files, not to a general principle.
Objection (b): not raised formally There is no requirement that a nonconformity be raised formally before the closing meeting. The daily debrief raised the issue; more importantly, the finding is based on evidence sampled during the audit and will be recorded in the report. The auditor should explain that the closing meeting is where findings are presented, and that the auditee will have the opportunity to respond and provide evidence.
Objection (c): UN tender Commercial pressure is irrelevant to the finding. The auditor should acknowledge the concern but state that the classification follows the evidence and risk. Delaying a tender is not a criterion in ISO 19011 or ISO/IEC 17021-1.
New spreadsheet The spreadsheet is new evidence. It should be examined, but 'all guards vetted' without dates does not demonstrate vetting before deployment. If it can be reconciled to deployment dates and evidence of vetting, the auditor may reconsider; otherwise, the finding stands. The auditor should record that the evidence was produced late and was not sufficient to close the gap.
2. What should be in the audit report and nonconformity record, and what follow-up is required?
Read the worked answer
Nonconformity record The record should state the requirement (contract vetting clause, ISO 18788 personnel competence and subcontractor control), the evidence (file identifiers, guard roles, deployment dates, missing vetting dates, signatory), the risk (deployment of unvetted personnel in a detention setting), the classification (major), and the required correction and corrective action. It should avoid naming individuals unnecessarily and should distinguish the missing record from the underlying failure.
Audit report The report should include the audit objectives, scope, criteria, team, dates, sites, sampling basis, limitations, findings, conclusions, and any disagreement expressed by the auditee. It should note that the late spreadsheet was considered but did not provide dated evidence. It should also record any positive findings, such as effective incident reporting, to keep the report balanced.
Follow-up A major nonconformity normally requires correction and corrective action, with verification before certification. The certification body should decide whether verification is by desk review or a special audit. The auditee should analyse why unvetted guards were deployed, whether subcontractor vetting is controlled, and whether other sites have the same issue. The auditor should not accept a policy revision alone; evidence of implementation is needed.
Certification decision The decision must be made by an independent decision-maker, not by the audit team, and must not be influenced by the tender timetable. The report and NC records are inputs to that decision.
3. If the client disputes the finding after the closing meeting, what are the next steps?
Read the worked answer
Respect the appeals process The client should be informed of the certification body's appeals and complaints procedure. A dispute should be handled through an independent review, not by informal pressure on the auditor. The lead auditor may be asked to provide the evidence file but should not decide the appeal.
Evaluate new evidence If the client submits dated vetting records, deployment rosters, subcontractor contracts and corrective action evidence, the reviewer should assess whether the nonconformity was correctly classified at the time of the audit. Evidence created after the audit may demonstrate correction, but it does not necessarily erase the original finding. The reviewer should distinguish between correction, corrective action and retrospective documentation.
Maintain impartiality The commercial importance of the UN tender, the client's relationship with the certification body, and the auditor's employment history must not affect the outcome. The decision should be documented with reasons.
Possible outcomes The appeal may confirm, downgrade or withdraw the finding. If the finding is confirmed, certification remains pending until verification. If the finding is downgraded, the report should explain why. If new evidence shows the guards were vetted before deployment, the finding may be reduced to a documentation issue, but the reasoning must be recorded.
Record keeping Keep the closing meeting minutes, the client's written objection, the appeal file, the reviewer's decision and all evidence. These records support consistency and are reviewed during accreditation.