Independence and evidence at a third-party logistics audit
During a certification audit of a third-party logistics provider, the lead auditor is assigned because she 'knows the client well.' Six months earlier she informally reviewed the client's security plan at a conference and suggested changes to the perimeter patrol schedule. At the opening meeting she learns that the client's security manager is a former colleague and close friend. The audit proceeds. The auditor spends most of the first day touring a new automated warehouse with the security manager and accepts his oral statement that 'all contractors are vetted' as evidence for contractor control. She interviews only the day-shift guard supervisor and reviews 5 of 240 access records, all from one week. At the closing meeting she reports no nonconformities, saying the system is 'mature.' The audit report is due in two days; the certification body's impartiality committee has not been informed.
1. Identify the threats to audit principles in this scenario and explain how each could affect the audit conclusion.
Read the worked answer
The main threats are self-review and familiarity. The auditor previously advised on the perimeter patrol schedule, so she is auditing a control she helped design; she also has a close friendship with the security manager. That impairs impartiality and can lead to over-reliance on oral assurances. The second threat is evidence: accepting 'all contractors are vetted' without records, sampling 5 of 240 access records from one week, and interviewing only the day-shift supervisor is not a representative or verifiable sample. The conclusion 'mature, no nonconformities' is therefore unreliable.
The audit principles engaged are independence, evidence-based approach and due professional care. The effect is not just a bad finding; the certification body may have issued a certificate on unsupported evidence. The auditor should have disclosed the prior advice and friendship before accepting the assignment.
2. What should the lead auditor have done at the opening meeting or before accepting the assignment?
Read the worked answer
Before accepting the assignment, she should have declared the prior informal review and the friendship to the certification body. The body should have assessed the threat and either replaced her or added an independent auditor with no relationship, and reviewed her work. At the opening meeting, once the friendship became known, she should have paused and disclosed it; continuing without disclosure was wrong.
She should not have treated the tour and oral statement as sufficient evidence. She should have selected a defensible or risk-based sample across shifts, sites and record types, and corroborated interviews with documents. If she could not be reassigned, she should have documented the limitation and had the conclusion reviewed by an independent competent person. The certification body's impartiality committee should have been informed.
3. What corrective actions should the certification body take regarding the audit team and the report?
Read the worked answer
The certification body should suspend the audit conclusion, review the audit file and evidence, and assess whether the report can be relied on. It should remove or reassign the lead auditor from this client and consider a witness audit or independent review of her work. A re-audit of the affected areas-contractor control, access records and night shift-is likely necessary before any certificate decision.
The body should also review its acceptance process: why was the prior advice not declared, and why was the friendship not picked up? Corrective action should include conflict-of-interest declarations, auditor competence and evidence training, and oversight of reports with no findings after a short audit. The client should be informed of the review in a factual way, and the certification decision must be made by an independent competent person, not the auditor.