While it did not prevent our certification, our certification reviewers did raise this Low severity Non-Conformity for our company of 12:
The organisation has not adequately addressed the risk of bias and partiality associated with xx’s (internal personnel) involvement in the internal audit process. Given xx’s involvement in the activities subject to internal audit, there is a potential risk that his participation could compromise the objectivity and impartiality of the audit. No controls or safeguards have been implemented to identify, mitigate, or manage this potential risk of bias.
Reference: Clause: 9.2.2
When establishing the internal audit programme(s), the organization shall consider the importance of the processes concerned and the results of previous audits.
The organization shall:
b) select auditors and conduct audits that ensure objectivity and the impartiality of the audit process
Response:
Our Immediate Action:
Company will document and assess xx’s operational responsibilities against the areas included in the internal audit.
xx will not perform audit testing, determine findings or approve conclusions for activities, controls or processes for which he has operational, implementation or management responsibility. He may provide factual information, documentation or subject-matter explanations to the independent auditor, provided this participation is clearly identified as auditee or subject-matter support rather than audit work.
For next year’s audit, Company will appoint a suitably competent and independent person to perform audit work. The independent reviewer will assess:
the audit scope and criteria;
evidence selected and testing performed;
the sufficiency and reliability of audit evidence;
Corrective Action:
To prevent recurrence, Company will:
- 1.
update the internal audit procedure to require a documented independence and conflict-of-interest assessment before auditors are appointed;
- 2.
require each internal auditor to disclose operational responsibility, prior work, reporting relationships and other circumstances that could affect, or reasonably appear to affect, objectivity;
- 3.
prepare an auditor-independence matrix mapping each auditor against the processes and controls within the audit scope;
- 4.
prohibit auditors from auditing, testing or determining conclusions concerning their own work or areas for which they have operational or management responsibility;
- 5.
permit internal personnel to provide evidence or subject-matter assistance only where their role is clearly separated from audit evaluation and decision-making;
- 6.
require the audit sponsor or other authorised independent person to review and approve auditor assignments and safeguards before fieldwork begins;
- 7.
engage an appropriately competent external or otherwise independent auditor where Company does not have sufficient internal separation; and
- 8.
retain independence assessments, declarations, assignments and approvals as part of the internal audit records.
Effectiveness will be verified by:
- 1.
confirming that the affected areas of the current audit have been independently reviewed or reperformed;
- 2.
confirming that any changes to findings or conclusions have been documented;
- 3.
inspecting the independence assessment and auditor-assignment matrix for the next internal audit;
- 4.
confirming that auditors were not assigned to audit their own work or areas of operational responsibility; and
- 5.
verifying that any identified threats to objectivity were removed or reduced through documented safeguards.
Proposed Evidence for Closure
- 1.
completed assessment of xx’s operational responsibilities and audit involvement;
- 2.
documented independence or conflict-of-interest declaration;
- 3.
revised audit allocation showing independent responsibility for the affected areas;
- 4.
evidence of independent review or reperformance;
- 5.
updated Internal Audit Procedure;
- 6.
internal-auditor independence assessment template or matrix; and
- 7.
approval of the revised procedure and audit arrangements.
Maybe our experience will help you prepare or respond if this is raised as a Non-Conformity!
