A risk-based audit programme with a conflicted auditor and restricted travel

Start from risk, not from budget The programme must be based on the client's risk profile: 14 sites in three countries, 40% turnover, two fatalities, armed operations, and restricted access to Somalia. The current annual cycle of headquarters plus four sites is already a sample; reducing it to headquarters plus two sites without justification would weaken confidence in the certificate.

Proposed cycle Maintain a surveillance audit before expiry, with headquarters plus at least four sites: one high-risk site in Somalia or a remotely audited Somalia site with a local guide, one site in Uganda, one site in Kenya, and one site selected because of the fatal incidents or turnover. Include night shifts and mobile or armed operations where applicable. The sample should be documented with selection criteria, not chosen for convenience.

Remote methods Remote auditing is acceptable where it is effective. It is more defensible for headquarters document review and low-risk support functions than for physical security operations, weapon storage or night patrols. For Somalia, use remote interviews plus local evidence collection if travel is prohibited; record the limitation. If remote evidence is insufficient, consider a local auditor, a special audit when access improves, or a shorter surveillance cycle.

Duration Base the duration on complexity, sites, shifts, travel and team competence. A realistic surveillance audit is 10–14 audit days, with more time if Somalia is included physically. The certification body should not accept a duration that makes the sample meaningless.

Expiry The certification expires in four months. The programme manager should schedule the audit immediately and allow time for nonconformity closure. If the audit cannot be completed before expiry, the certification body must follow its suspension or recertification rules, not issue an unjustified extension.

Impartiality threats

• Former COO, 18 months ago: this is a recent employment relationship and a management role. Even if the auditor is technically competent, the threat to independence is significant. The auditor should not be assigned. Many certification bodies apply a two-year cooling-off period; 18 months falls within that boundary.
• Former trainer still delivering courses: this is a current commercial relationship, even if small. It creates a self-interest and familiarity threat. The auditor should be excluded from this client's audits while the relationship continues.
• Technical reviewer new to the sector: lack of sector competence is not an impartiality threat, but it is a competence gap. The reviewer may not detect inadequate evidence or misclassified findings.

Actions Assign an independent lead auditor with SOMS and private security experience, supported by a human rights or legal specialist and a local auditor for Kenya, Uganda or Somalia. Replace the conflicted auditors. Provide the technical reviewer with mentoring, a competent co-reviewer, and a documented competence assessment before allowing independent review. Declare and record the impartiality analysis.

Broader programme controls Maintain an auditor competence matrix covering security operations, human rights, use of force, maritime or armed operations, and local law. Rotate auditors where familiarity risk is high. Require annual impartiality declarations and check for undisclosed relationships. The programme manager should not be the same person who makes the certification decision.

Performance measures Use indicators such as audit completion on time, nonconformity trends by clause and site, repeat findings, closure verification timeliness, complaints and appeals, certification decision turnaround, auditor competence and report quality. For this client, track incident trends, turnover, use-of-force reports and fatal-incident investigations as context for sampling. These measures should inform the next programme cycle, not just satisfy a dashboard.

Handling the reduction request The client's request to reduce to headquarters plus two sites is a commercial request, not a risk justification. The programme manager should explain the sampling basis, the fatal incidents, the high turnover and the restricted-access country. If the client insists, the certification body can review the contract, but it should not reduce the sample solely to save cost. A reduced sample could be acceptable only with a documented risk rationale and compensating activities, such as additional remote evidence, a larger document sample, or a shorter surveillance interval.

Escalation If the client threatens to leave or complains about cost, record the pressure and escalate to the certification body's management. Impartiality and evidence sufficiency take priority over retention. If the certification body cannot deliver a credible audit before expiry, it should discuss suspension or a new certification cycle rather than issue a certificate on insufficient evidence.

Programme review At the end of the cycle, review whether the remote methods worked, whether the sample detected the risks, and whether the auditor team had the right competence. Update the programme for the next cycle based on those results.