My opinion is that the problem is not you forgetting to do 1 occurrence in 10000, but the auditor calling this a deviation. This is bad auditing (and I know we have a lot of bad auditors out there). Unfortunately, most auditors and organizations are too focused on finding this one occurrence to put in their reports and says that they work is being done, instead of focusing in the right and important stuff.

I wholeheartedly agree. That is exactly the reason why I sometimes push back, so that I can actually focus on the right and important instead of random lucky findings. Thank you, Marcelo.
