Supplier screening sample and the inaccessible shared service
During a surveillance audit of a 900-employee engineering firm, the lead auditor samples 25 supplier contracts from a population of 410 active suppliers. Three contracts lack the required compliance screening before award. Two of those suppliers were onboarded by a shared-service centre in another country, which says the records are held on a system the auditor cannot access because of data-protection rules. One supplier appears on a sanctions list, and the contract remains active. The procurement manager says screening is a "shared-service responsibility" and provides a screenshot of a dashboard showing "98% compliant". The audit criteria include the firm's supplier code and ISO 37301; screening is a key control in the compliance risk assessment. The auditor has one day left and has not yet interviewed the shared-service centre.
1. Is the evidence sufficient to conclude on the effectiveness of supplier screening? Explain your reasoning.
Read the worked answer
No. A dashboard screenshot is a summary produced by the auditee; it does not show the underlying screening record, the screening date, the result or the reviewer. The sample shows a 12% deviation rate, but the auditor must first confirm the population and whether the sample was random or risk-based. The sanctions-list hit is a significant indicator because an active contract with a listed supplier suggests the control failed at a high-risk point. The shared-service centre must be interviewed, and the auditor needs read-only access or a reliable attestation supported by source records. If access remains blocked, that is an audit limitation that must be reported. Verbal allocation of responsibility between procurement and shared services does not prove the control operates.
2. What finding would you raise, and at what severity?
Read the worked answer
The evidence supports a nonconformity against 8.1 because the supplier screening control is not consistently implemented. Severity depends on whether the failure is isolated or systemic. The active sanctions-list supplier, combined with three screening failures in 25 contracts and no verifiable shared-service records, points to a systemic failure in a high-risk control. I would classify it as major unless the auditor can verify that the sanctions case was a false match or an isolated onboarding error with effective detection and correction. The finding should state the sample, the three missing records, the active sanctions contract and the access limitation. A dashboard percentage does not override transaction-level evidence.
3. With one day left, what audit actions would you prioritise?
Read the worked answer
I would prioritise the highest-risk evidence gaps:
- Obtain the supplier master list and identify all suppliers in sanctioned or high-risk jurisdictions; test those first.
- Trace the active sanctions-list supplier from contract award to payment and screening; obtain the screening result or confirm none exists.
- Interview the shared-service centre remotely and request read-only access to the screening system for the sampled records.
- Expand the sample only in the high-risk population if time permits; do not spend the remaining day on low-risk suppliers.
- Document any access denial and escalate it before the closing meeting.
The goal is to establish whether the control failure is systemic and whether the sanctions exposure is real, not to maximize sample size.