Consultancy conflict on a stage 2 audit
An ISO/IEC 20000-1 certification body assigns Priya as lead auditor for the stage 2 audit of a 600-user IT service provider. During the pre-audit call the client's CIO mentions that Priya 'helped us redesign incident and problem management last year.' Priya confirms she spent 60 days between March and July 2023 advising on process design, writing procedures and coaching the service desk manager. The certification body's impartiality procedure requires a two-year cooling-off period after any consultancy. The audit programme manager says the work was 'mostly training' and proposes that Priya lead the audit but exclude incident and problem management. The stage 2 audit is in 10 days and the client has requested Priya because she knows their environment. Priya is the only auditor on the team with the required technical competence.
1. Evaluate the impartiality threat and decide whether Priya can act as lead auditor.
Read the worked answer
Priya cannot act as lead auditor. ISO 19011's independence principle and ISO/IEC 17021-1's impartiality requirements mean an auditor must not audit their own work and must be free from self-review, familiarity and advocacy threats. The work described, 60 days designing processes, writing procedures and coaching the manager, is consultancy, not merely training; writing procedures directly creates a self-review threat. A two-year cooling-off period applies and has not elapsed. The proposal to exclude incident and problem management does not cure the threat: as lead auditor Priya manages the whole audit, influences team judgements and would still evaluate management system elements she helped design. Client preference and technical competence do not override impartiality. She should be removed from the team for this engagement, the client informed, and a competent replacement or rescheduling arranged. The decision and rationale must be recorded.
2. What should the certification body do about the programme manager's proposal and the client's request?
Read the worked answer
The programme manager's 'mostly training' argument is not supported by the facts and should not be accepted. If the work included advice or procedure writing, it is consultancy under the certification body's own definitions. The CB should escalate the conflict to the impartiality committee or the person responsible for safeguarding impartiality, record the pressure as a threat to the CB's integrity, and ensure the decision is not made by the audit programme manager alone. The client's request for Priya is a commercial and familiarity pressure that must not influence assignment. Options: assign a different lead auditor with the required competence; if none is available, postpone the stage 2 audit and explain the delay. A technical expert cannot be used as a workaround if that expert also advised on the same processes. The CB should also review why the assignment was made and whether its consultant-tracking controls failed.
3. Which fundamental audit principles are engaged, and how should they shape the audit team's behaviour?
Read the worked answer
Engaged principles include independence (not auditing own work), impartiality (no bias or conflict), evidence-based approach (decisions based on verifiable records, not Priya's prior knowledge), fair presentation (reporting truthfully and not letting client preference affect conclusions), due professional care and confidentiality. Priya's prior knowledge is not a legitimate shortcut; it is a threat because it may lead to unchallenged assumptions. The audit should still use the same sampling and criteria. If Priya had merely delivered generic training with no design role and the CB's procedure allowed it, the threat might be mitigated by having a different auditor lead that area; here the facts go beyond training and require full exclusion from the engagement.