Redacted risk records before a stage 2 audit
Meridian Bank is preparing for a stage 2 ISO 37301 certification audit. The lead auditor receives a document pack in which the minutes of the compliance risk assessment committee are almost entirely redacted as "legally privileged". The audit objective includes evaluating whether the compliance risk assessment process is effective. The draft audit plan allocates two auditors and three days to cover 14 branches, corporate banking and the compliance function; the branch sample of six was selected by the bank. The audit criteria list ISO 37301 and the bank's internal code of conduct, but not the regulator's compliance guidance that the bank is legally required to follow. The client also asks that "litigation management" be excluded from the opening meeting because external counsel is handling a matter.
1. Can you accept the redaction and the draft audit plan as they stand? Justify your answer.
Read the worked answer
No. Privileged legal advice can be protected, but the process being audited is the risk assessment, not the legal advice itself. The auditor needs the committee's methodology, risk register, attendance, decisions and action tracking. A blanket redaction prevents the auditor from evaluating effectiveness and is an audit limitation. The plan also has two weaknesses: the branch sample was selected by the auditee, which undermines auditor judgement, and the criteria omit applicable regulatory requirements. The sample size of six may be defensible if selected on risk, but it must be the auditor's selection with a documented rationale covering high-risk branches, corporate banking and the compliance function. Three days for two auditors may be tight, so coverage must be prioritised by risk rather than by equal branch coverage.
2. What changes would you make before the opening meeting?
Read the worked answer
I would revise the plan and agree access in writing:
- Request non-privileged extracts of the committee minutes, or on-site review under a confidentiality agreement, with legal counsel present if needed.
- Add the regulator's compliance guidance and other applicable legal requirements to the audit criteria, because clause 4.5 requires the organisation to identify them.
- Replace the client-selected branch sample with a risk-based sample chosen by the audit team, and document why each branch is included.
- Clarify with top management why litigation management is said to be outside scope; if it is an in-scope compliance risk, it cannot simply be removed from discussion.
- Reallocate audit time to the risk assessment process, high-risk business lines and follow-up of prior findings.
The opening meeting should confirm scope, criteria, access and confidentiality, not negotiate away audit coverage.
3. If the bank maintains the redaction and denies access to the committee records, what should you do?
Read the worked answer
I would record the denial as an audit limitation, escalate it to the audit client and the bank's top management, and explain that the effectiveness of the risk assessment process cannot be concluded. The audit may continue on other areas, but the report must state the limitation, its cause and the affected objective. I would not accept verbal assurances or a summary prepared solely by the auditee without corroboration. The certification body should decide whether the audit can be completed or whether the stage 2 audit cannot proceed. This is not a nonconformity against the bank's CMS unless the underlying records are required and unavailable; it is primarily a limitation on the audit evidence, and the report should distinguish the two.