Closing a major finding after the agent is terminated
At the closing meeting of a certification audit, the lead auditor presents a major nonconformity: the company paid a sales agent in a high-risk jurisdiction US$4.2 million over 18 months without due diligence or contract clauses on anti-bribery. The compliance officer says the agent was terminated two days ago, the payments have stopped, and the CEO has signed a memo requiring due diligence for all new agents. She asks the auditor to downgrade the finding to minor and to close it in the report, arguing that correction is complete. She also asks that the agent's name be omitted from the report because of an ongoing investigation. The audit team has not verified the termination or the memo.
1. Should the auditor downgrade the finding to minor and close it? Explain.
Read the worked answer
No. Termination of the agent and a memo for new agents are corrections and partial preventive actions, not evidence that the nonconformity is minor. The finding concerns a control failure over 18 months involving a high-value, high-risk agent, and the organisation has not yet shown root-cause analysis, retrospective review of other agents, or monitoring of existing relationships. The auditor has not verified the termination or the memo. The major classification remains appropriate because the failure is material and systemic in a high-risk area. Closing requires the organisation to implement corrective action, the auditor to verify implementation and effectiveness, and the certification body to decide on certification. The closing meeting is not the place to negotiate severity without new objective evidence.
2. What should the audit report contain, and how should the confidentiality request be handled?
Read the worked answer
The report should state the criteria, the objective evidence, the finding and its severity, and the required corrective action. It should include the payment amount, the period, the absence of due diligence and anti-bribery clauses, and the fact that verification is pending. The agent's name can be handled through controlled distribution or a confidential annex, but omitting the finding or the evidence would make the report misleading. The auditor can agree with the client on who receives the report and how it is stored, but cannot suppress a material nonconformity because of an investigation. Confidentiality protects access; it does not change the audit conclusion. The report should also note that the termination and CEO memo were reported by the auditee but not yet verified.
3. What follow-up would you require before the certification decision?
Read the worked answer
I would require a corrective action plan with root-cause analysis and a timeframe. The plan should cover retrospective due diligence on all agents in high-risk jurisdictions, a review of contracts for anti-bribery clauses, a payment review for other unusual commissions, and monitoring of the terminated agent's activities. The auditor should verify the termination, the CEO memo, the revised procedure and a sample of retrospective reviews. A follow-up audit or desk review should be completed before the certification body makes its decision. Verification of documents alone may be insufficient for a major finding; the auditor should test whether the new due diligence control actually operates. The certification decision remains with the certification body, not the audit team.