Has this happened to you? Internal Auditor challenges Lead Auditor

...When an internal auditor challenges either you (the Lead Auditor) or your decision :mg: to not include in the audit report a questionable "finding" (point of concern) they had included in their audit notes, how do you handle the situation? This recently happened to me and I just wondered if anyone else has experienced a similar situation. If so, what did you do?

Without revealing too much information, I will say that I discussed the situation with my boss and we both agreed that this particular piece of information should NOT be included because of the volatilely political nature of the concern. (The audit report had already been distributed minus the concern when the IA asked why this issue wasn't included in the report.)

I will tell the IA that after discussing the situation with my boss, we both agreed and felt that it was not pertinent to this audit and would not be addressed at this time, but would be included in the next audit where it would be more appropriate.

I'd be interested to hear your "war stories" of similar experiences, if anyone would like to share. We can all learn something from each other's experiences, right?

Re: Has this happened to you?

Just went through that myself..."I'm the Lead, the responsibility is mine, the final decision is mine"

Re: Has this happened to you?

GStough said:

...When an internal auditor challenges either you (the Lead Auditor) or your decision :mg: to not include in the audit report a questionable "finding" (point of concern) they had included in their audit notes, how do you handle the situation? This recently happened to me and I just wondered if anyone else has experienced a similar situation. If so, what did you do?

Without revealing too much information, I will say that I discussed the situation with my boss and we both agreed that this particular piece of information should NOT be included because of the volatilely political nature of the concern. (The audit report had already been distributed minus the concern when the IA asked why this issue wasn't included in the report.)

I will tell the IA that after discussing the situation with my boss, we both agreed and felt that it was not pertinent to this audit and would not be addressed at this time, but would be included in the next audit where it would be more appropriate.

I'd be interested to hear your "war stories" of similar experiences, if anyone would like to share. We can all learn something from each other's experiences, right?

Click to expand...

Why would it be appropriate in the next audit, but not in the present one? The surfacing of "political" concerns indicates that something is wrong somewhere. Either you're dealing with something that should be addressed, or an auditor whose personal agenda is interfering with the process. In either case, the audit did what it was supposed to do, that being revealing a problem with the system.

Re: Has this happened to you?

Gidget,

What I have experienced were findings from auditors that were very superficial or that were "so small" that I did not think that it aggregated any real value to the system to open up a CAR and so on. It was difficult at times to explain to the IA that the corrective action would still be taken with just a "verbal NCR" to the auditee.... especially when the IA just finished the IA course.

Sensitive or strategic corporate info has to be dealt with carefully on an audit report... especially if it is distributed company wide...

But all in all, I agree with Randy... the Lead has the final decision and the responsibility it entirely his, that´s one of the reasons why there is a LA.

Re: Has this happened to you?

While what Randy says is true, and I am in fact placed in a similar position right now, I want to caution you to take this matter with your auditor like it is the delicate matter it is. You'd need to explain how the system would be positively served by not airing the finding.

Now, from the auditor's viewpoint: the volatility part I get. The political aspect I also get. What I haven't seen is recognition of whether or not this finding reflects on the system's robust function. If it is a technical matter that will be short lived or is not of much functional importance, I can see making an over ride. However, that is not the sense I got from the question. If the auditor gets the idea that a valid finding is being quieted, the auditor might not raise such things in the future. My morale could suffer, and I, the auditor, need to believe in my work in order to add value to the system.

I noted that the matter will be taken up in an upcoming audit. And indeed there is no reason why an unscheduled audit can't be done. Waiting a little while cold be okay as doing so is not incurring undue risk AND the internal auditor understands that doing so would enable your group to take on the issue directly and not by going down a so-called rat hole.

Re: Has this happened to you?

If you are positive that there is no merit, no gain for your company, then tell your auditor just that. If there is a grain of truth, a possibilty for an improvement, then sit down with the auditor and find some way to phrase the concern as an observation of an opportunity. This happens, and it happens fairly regularly. Especially with newer, less experienced auditors. But, if you take them seriously, and appreciate what they are trying to do (my experience is that most of these issues come from that "puppy dog enthusiasm" that people sometimes have) and continue to help them develop and grow you will be happy that you did. (in most cases, sometimes you just need to cut your losses and get them off the team)

Re: Has this happened to you?

Jim Wynne said:

Why would it be appropriate in the next audit, but not in the present one? The surfacing of "political" concerns indicates that something is wrong somewhere. Either you're dealing with something that should be addressed, or an auditor whose personal agenda is interfering with the process. In either case, the audit did what it was supposed to do, that being revealing a problem with the system.

Click to expand...

The issue was more relevant to another process (which is the next audit I mentioned) rather than where it was noted in that audit. Yes, something is wrong, but not where this auditor noted it. It will be addressed, but not by that auditor nor in the report this auditor thought it belonged.

Re: Has this happened to you?

The point of relevency to the audit needs to be considered, at that seems to have been done.

Is the "point of concern" relevant to the objectives and criteria? I had to almost spank a recent team member who kept trying to hammer a client over some strictly 100% environmental issues when we were doing an OHS audit...."Not relevant!" . The client was informed of what was observed (due diligence), but it was not part of the audit and we didn't beat them up over the subject.

Re: Has this happened to you?

SteelMaiden said:

If you are positive that there is no merit, no gain for your company, then tell your auditor just that. If there is a grain of truth, a possibilty for an improvement, then sit down with the auditor and find some way to phrase the concern as an observation of an opportunity. This happens, and it happens fairly regularly. Especially with newer, less experienced auditors. But, if you take them seriously, and appreciate what they are trying to do (my experience is that most of these issues come from that "puppy dog enthusiasm" that people sometimes have) and continue to help them develop and grow you will be happy that you did. (in most cases, sometimes you just need to cut your losses and get them off the team)

Click to expand...

This auditor has been with the company for many, many years and has been an IA since the company first became registered. This auditor knows where all the skeletons are, so to speak, and knows that this concern is legit, but is more relevant to the other process I mentioned earlier.

Re: Has this happened to you?

GStough said:

The issue was more relevant to another process (which is the next audit I mentioned) rather than where it was noted in that audit. Yes, something is wrong, but not where this auditor noted it. It will be addressed, but not by that auditor nor in the report this auditor thought it belonged.

Click to expand...

Without knowing more about the situation at hand it's difficult to give advice. I will say though that processes are interrelated, and it's not unusual to audit one process and discover a problem with another. I suspect there's more to it than that, though.

One of the prime benefits of experience is knowing how (and when) to choose your battles. If you're dealing with a young and inexperienced auditor, it might be difficult for him/her to understand that the present situation should be dealt with "offline" or in some other way. Deming's admonition about pride of workmanship comes to mind; if we ask auditors to be alert for problems with the system and they find one, it may be difficult for them to see the big picture. If the situation you're dealing with now is actually addressed in the future, you should make sure that the auditor is aware of it, and is thanked for bringing it to light so as not to make her think you weren't serious about dealing with problems. It's important that auditors, especially less experienced ones, aren't inhibited by things they may not fully understand.