The rule
The selection of auditors and the conduct of audits must ensure the objectivity and impartiality of the process. The most concrete consequence is single: nobody audits their own work.
What a small organisation does
- Cross-audit: production audits maintenance, maintenance audits the store.
- External auditor: a service bought from an independent person or body.
- Within a group: an auditor from another site of the same group.
Where none is possible, at minimum the auditor should not be a decision maker in that process, and that limitation is written into the report.
Quiet ways independence is lost
- the auditor reporting to the manager of the unit they audit,
- reporting of findings requiring that unit's approval,
- the auditor's performance review being tied to “not raising findings”.
The third is the most destructive and is usually created without anyone intending it.
Competence is half of independence
An independent auditor who does not know the subject finds only the easy formal gaps: a signature, a date, a form number. The system's real weakness goes unseen. Independence and competence are therefore required together.