Is it ok or risky for an auditor to recommend corrective action?

[Jim Wynne]

As an external auditor I am always skeptical if I see that an internal auditor made a suggestion on how to resolve an issue.(nonconformance). The reason for that is that I have known internal audotors who caused a problem, found the problem, and then made a lot of money by suggesting a way to solve the problem. Thankfully we see less and less of this these days.

There are four categories: Second-party auditors, third-party auditors, internal auditors and contract internal auditors. You might have to deal with the first category's suggestions; CB auditors should not make suggestions at all; internal auditors' suggestions might be helpful and shouldn't be discouraged, and if contract internal auditors run through the building planting time bombs, that's a different problem and should be dealt with without assuming that all contract auditors are unethical.

But an auditor suggesting a fix always throws up a red flag for me. I certainly understand that in most organizations the auditors wear more than one hat on a regular basis. But facilitating a resolution with a team is usually a better way to go. After all we want to make sure we eliminate the root cause of a problem.

It's a false dichotomy. There's nothing to say that an internal auditor who thinks she sees a solution can't be a part of the team that works on it. I can't for the life of me see why we wouldn't want everyone in the building to offer suggestions for improvement. Certainly there are political considerations in some companies that have to be considered, but if there are, that's (again) a different problem.

 

[triad]

No, I do not recommend internal auditors suggest or recommend corrective actions.

recommend means suggesting possible solutions, thefore not final yet. it's up to the area responsible to take it or leave it. if auditor can help auditee get the realistic views of where things are and what is needed, identify broad issues, isolate specific issues, then auditor itself is value adding.

 

[curryassassin]

recommend means suggesting possible solutions, thefore not final yet. it's up to the area responsible to take it or leave it. if auditor can help auditee get the realistic views of where things are and what is needed, identify broad issues, isolate specific issues, then auditor itself is value adding.

I agree with Triad. Aren't we all part of a team to satisfy customers? Shouldn't we be helpful and add value if we see the solution first or if the solution is not forthcoming? We do not own the solution but we have a say in whether the solution is appropriate and relevant, don't we?