Auditee management approaches and their impact on audit outcomes

The primary purpose of conducting audits is to ensure that the organisation’s management system conforms to established standards, legal and other requirements, and the organisation’s own requirements. It also aims to verify that the system is implemented and maintained effectively. All these steps are designed to determine the extent to which the audit criteria are fulfilled. The process flow for managing an audit programme is clearly illustrated in ISO 19011:2018 Guidelines for auditing management systems, which outlines all the required steps in accordance with the Plan, Do, Check, Act (PDCA) cycle.

Generally, audits serve as a management oversight tool, providing valuable information to guide the company in the right direction and support strategic decision-making. To assist with this, it is necessary to collect and verify sources of information to ensure that the audit evidence is valid and can be considered a reliable point of reference. The correct process of comparing the audit evidence against the criteria guides auditors in achieving the audit objectives.

As part of the process, it is crucial to emphasise the terms and definitions relevant to the audit, while refreshing the auditee’s understanding of the audit process. Equally important is ensuring alignment and mutual understanding among all audit participants.

At this point, the auditor’s knowledge of terminology plays a vital role. The participants’ familiarity with audits should always be taken into account; we cannot engage the same level of detail with a team that has never experienced an audit as we would with a team that has gone through several recertification cycles.

"The desirable auditee’s management attitude is to focus on leveraging opportunities for improvement identified during the audit, to drive optimisation within the company, rather than attempting to block or minimise audit findings, regardless of their context or significance."

Kamran Zulfugarov CQP MCQI, integrated management systems Lead Auditor, SGS Azerbaijan

Defining the scope, criteria and objectives are fundamental parameters in planning the audit. It is essential to have a detailed understanding of the scope well in advance. Initially, it may be challenging to determine the importance of specific processes, which can result in inadequate attention being paid to critical areas of the auditee’s organisation. A subsequent step in this process is to identify and analyse the links within the system where risks are present.

Although the ultimate goal is to verify compliance with the audit criteria, it is the responsibility of the auditor to prove nonconformity, if any. Therefore, during the application of audit methods – such as interviews with process owners, visual observations and document reviews – the auditor should ensure the accurate description of nonconformities.

A well-structured nonconformity description should encompass the following elements: the finding; the applicable requirement; the evidence; and a clear justification for classifying the nonconformity as either minor or major. Noting the exact time (for example, ‘at 10.15am’) during visual observations at the site can be helpful for recalling and clearly describing the findings.

As outlined in ISO 19011, audit findings and conclusions should be presented in a manner that ensures they are understood and acknowledged by the auditee’s management. However, auditors may occasionally encounter a wide range of unusual management reactions. These reactions can be categorised into two types: result-oriented management and finding-oriented management.

While addressing the relevant work steps, it is essential to focus on the concept and primary objective of the audit. Sometimes, we encounter auditee management teams that debate audit findings extensively and interpret standard requirements in a way that serves their interests, aiming to avoid the identification and raising of nonconformities. Nonetheless, the approach to the audit should remain consistent, regardless of whether the auditee management is result-oriented or focused on findings.

The key to presenting findings effectively lies in ensuring they are verifiable, repeatable and reproducible. The announcement of the audit conclusion is implemented comprehensively during the 'conducting closing meeting' stage, as required in the process flow for managing an audit programme.

To ensure an effective closing meeting, it is crucial for potential audit findings to be acknowledged by the auditee during the audit process. This strategy helps prevent unexpected reactions or disputes during the closing meeting. Without such engagement, there is a higher likelihood that findings may be challenged in the closing meeting, often driven by a defensive mindset. While an objective and impartial auditor who adheres to all necessary steps and guidance will, ultimately, uncover the truth, such a scenario is not ideal from an effectiveness and efficiency perspective.

Adopting and applying effectively a risk-based approach can sometimes be challenging, and failure to do so may lead to strategic deficiencies. Auditors must continually enhance their ability to assess processes and functions at various levels. This includes delving deeply into specific activity steps or process components when necessary, while also maintaining a broader perspective of the entire system. For example, it is comparable with assembling the pieces of a puzzle while keeping the complete picture in view to understand and envision the final outcome.

The desirable auditee’s management attitude is to focus on leveraging opportunities for improvement identified during the audit, to drive optimisation within the company, rather than attempting to block or minimise audit findings, regardless of their context or significance.