A team of three, a conflict of interest and two days left

The threat. Auditor A's prior authorship of the ANF and 11 ASCs creates a self-review threat: the subject matter of the audit is A's own professional judgement, still in force. Twenty months does not dissipate it, because the artefacts have not been replaced and A is likely to defend them, consciously or not. Familiarity and, potentially, advocacy threats compound it.

Resolution, in order of preference.

• Remove A from all work on the fleet-tracking application, including interviews and evidence review, and redeploy A to another application for the remaining time. This is achievable in two days if the fleet-tracking work is at evidence-gathering rather than reporting stage.
• If coverage would otherwise fail, bring in another auditor or extend the engagement. Independence is not traded against the engagement letter's timetable.
• A may be interviewed as a factual source about the artefacts, with all conclusions drawn and documented by another auditor. This is a fallback, not a solution, and must be disclosed in the report.
• Apply an independent review to any work A has already performed on that application, and check whether A's work on other applications touched fleet-tracking dependencies.

The IT director's remark. Two issues, both serious. 'Convenient' suggests the client may be trying to exploit a relationship, or may know of a continuing relationship between A and the fleet-tracking team that you have not disclosed. Verify A's employment and any ongoing association. Treat the private approach as an attempt to influence the audit: do not discuss findings outside formal channels, document the remark verbatim with date and context, inform the engagement partner, and remind the team not to hold unaccompanied discussions with client management. The reference to a regulatory inspection raises the stakes, because pressure to present a clean report to a regulator is an integrity matter, not merely a commercial one.

Competence matrix against the audit programme. Required: ONF and management-process assessment (B strong); ASC verification and validation evidence assessment including code and configuration review (C strong, B absent); interviewing and evidence handling (lead strong, C developing); segmentation and network architecture (lead strong, C developing); report writing (B strong). The gaps are covered by pairing and review rather than by pretending they do not exist.

Allocation.

• Auditor B: management-process and ONF work, document review, and drafting the process-related findings. Remove B from technical ASC evidence assessment, because a conclusion B cannot technically support is a risk to the report.
• Auditor C: ASC evidence testing, configuration excerpts, and the segmentation evidence. C does not lead interviews unaccompanied; either you or B sits in, and C's notes are reviewed the same day.
• Lead: the segmentation assessment itself, jointly with C, because it is both the most technical and the most contested item; also all closing discussions and the sign-off.

Supervision in two days. A 30-minute review each morning on progress and open judgements; workpaper review before anything enters the findings log; a single consolidation session before drafting; and a final review of the report against the evidence register. Record the competence matrix, the pairing arrangement and the review steps in the engagement file. If any required competence is genuinely unavailable - for example tenant or network architecture depth - record it as a limitation rather than let an unqualified conclusion stand.

Resolve on evidence, not seniority. The question is whether the compensating control achieves the control objective. C's evidence is that segmentation covers one of three production paths. That means two paths are unprotected, so the control does not meet its objective regardless of how effective it looks on the covered path. B's phrase 'adequate in practice' must be converted into a testable claim: which paths, what evidence, over what period, and against what threat? If B cannot produce coverage evidence for the other two paths, B's position fails on the auditor's own standard.

I would have C demonstrate the evidence and B state the specific basis for the contrary view, in a short joint session, with both positions recorded. The likely outcome is that the finding stands, with the severity determined by whether an ASC or the ONF requires segmentation of all production paths - a nonconformity if it does, an observation if the requirement is absent but the risk is real.

If B maintains the objection. Record the dissent in the file with the reasons, and escalate to the engagement quality reviewer before the report is issued. The client is not the arbiter of a technical disagreement between auditors, and neither is the more senior auditor. If firm procedure allows, note the dissent in the internal file only; the report states the lead auditor's conclusion with its basis. What must not happen is the finding disappearing because of the disagreement.

Time discipline. With two days left, do not open new scope. Prioritise the segmentation test, complete the supervision reviews, and if the evidence cannot be completed, issue with a documented limitation rather than an unresolved assertion. Finally, record the IT director's approach in the same file note, so that the pressure and the technical disagreement are visibly separate matters and neither is mistaken for the other.