Roles, independence and ethics

The client commissions or uses an audit. The auditee is the organization or activity examined. The lead auditor manages the plan, resources, communications and review of findings. Team auditors collect bounded evidence, compare it with criteria and report conclusions they can support. In a first-party audit, client and auditee can belong to the same organization; different role names do not always mean separate legal entities. An observer, technical expert or interpreter may participate without acquiring authority to change criteria or issue findings. The plan should identify who approves scope, provides access, protects evidence and authorizes the report under the applicable procedure. If responsibilities are vague, a small disagreement over a sample or interview can become an authority dispute after an uncomfortable finding.

Independence is more than asking whether an auditor works for the same employer. Did the person design the activity now under review, approve its records, receive a reward tied to the result, or have a financial or family interest that could impair actual or perceived judgment? Hiring an external auditor does not erase a conflict if that person designed the procedure under review as a consultant. Disclose the relationship, assess its significance and reassign the work or add independent review when needed. “I will be objective” is not a sufficient control. Make and document the assignment decision before sensitive evidence is gathered. Competence is another condition: the team must understand the process, criteria and evidence method within its role. An auditor should not accept a specialized safety or technology assignment that the team cannot evaluate without an appropriate expert.

ASQ's Code of Ethics addresses integrity, responsible and respectful conduct, protection of proprietary information and conflicts of interest. Confidentiality begins before fieldwork: establish access rights, purpose and retention limits, then copy only what the audit requires. Do not send a photograph containing employees' personal information through an unauthorized channel merely because it simplifies report writing. Use a record ID or redacted excerpt under the agreement when it adequately supports a finding. Do not exploit one supplier's information for another client's advantage. Likewise, a learner preparing for CQA must not claim to hold ASQ's credential on the strength of platform exercises. These are operational decisions, not marketing language.

An audit may reveal a signal of immediate danger or conduct that could be unlawful. The auditor is neither criminal investigator nor court, but an apparent imminent harm should not wait for a routine closing report. Record direct observations, protect evidence within authority, alert the designated responsible role and use channels with appropriate jurisdiction. Do not speculate about local law or expose confidential data unnecessarily. If people face a present hazard, the operating owner may need immediate containment, with a record of who was informed and when. “A machine guard was absent at this time and place” is an observable statement; “the company has committed a crime” is a legal conclusion requiring qualified authority and wider evidence. The distinction preserves safety and audit credibility.

Due diligence calls for checking the source, current criterion and sample fitness before a conclusion. Professional care requires neutral questions, an opportunity for clarification, a defensible record trail and open acknowledgment of important limits. A misleading report can drive an unsafe purchasing or operating decision and may have financial or legal consequences in its context; no single legal conclusion applies to all countries. State what was and was not established, and identify when expertise beyond the team is needed. The client or competent authority decides the operational response; the auditor does not promise to repair an owner's process.

For each sensitive decision, make a small role matrix: who provides evidence, who verifies it, who issues the audit conclusion and who owns the operating action. If a client asks an auditor to release a batch because the report found no breach, that exceeds the conclusion: no finding in a bounded sample does not replace the owner's release authority. If the auditee asks a technical expert to sign a legal compliance finding, the lead explains that the expert interprets the technical element, while competent authority handles the legal question. Also decide who can see working papers and who approves redacted copies. Role separation protects confidentiality and lets a correction be made without destroying the original evidence trail. Do not change a decision owner's name after an uncomfortable result to relocate accountability.

For an urgent verbal briefing, use four ordered elements: observed fact, its criterion, immediate risk and the action requested from the authorized owner. A teaching example is: “Machine X's guard was observed open during operation at 11:10; the displayed site instruction requires closure; a worker may approach a moving part; the operating and safety owners were alerted to assess containment.” Record who received the notice and when, then check what happened. Sending a message does not prove that risk was removed. If the displayed instruction turns out to be obsolete, correct the criterion reference without erasing what was observed. This separates the duty to communicate an immediate concern from the final audit classification and permits an honest correction trail.