Lately I have been following and contributing to a debate in the IRCA LinkedIn discussion group. The basic thrust being the question as to why an auditee might elect to accept a questionable finding from a third party management systems auditor (quite a common occurrence, I think you’ll agree). My view is that, provided the finding is not a major NCR and the expected corrective action is not expensive, they just decide its a battle they can’t be bothered to have. They want to get back to work.
Anyway, the debate continued and one dimension to the argument developed that suggested it was at least partly the auditee’s responsibility to reign the auditor in on those occasions. That bothers me. Let’s just think this through. Are we suggesting the CB uses the auditee as its quality control? Isn’t that something we are taught we are just NOT supposed to be doing?
The biggest thing that bothered me was the general defence put up in favour of the CBs not really needing to do anything to monitor the competence of their auditors. It was all “the auditee should do this, the auditee should do that, if they don’t it’s their fault”. I simply can’t agree. It is fairly and squarely the CBs responsibility to execute the process to an acceptable standard, and to satisfy themselves that this is happening. Despite the fact that to accept, excuse, deny and ignore the problem is more convenient (and most significantly CHEAPER) it is not an acceptable position for a CB to take. We should not offer them a “get out of jail free” card that they are only going to seize with both hands. The root of the problem is that more robust controls cost money and they do not want to raise the price of the commodity. Third party certification is a very price sensitive industry and this always, without regulation, leads to a race to the bottom, which is what we have.
Remember, when the boot is on the other foot, and they audit you and your management system against the competence requirements, do they allow you to use your customers as the quality control? You can’t have it both ways.