You thought that the audit you completed months earlier went well, and you feel good about it. Then the phone suddenly rings — it’s the auditee screaming that he just got inspected by OSHA, and they cited his company for several things that you didn’t find when you audited the facility months earlier. He demands that you meet him at his office tomorrow with an explanation. That warm fuzzy feeling that you had is gone. Your mouth is dry, and beads of sweat appear on your forehead.

Placing the word “disclaimer” in an audit report sounds like an auditor might not be completely confident that the findings in the report are accurate or reliable. The auditee, upon seeing this word, may believe that they didn’t get their money’s worth if the auditor can’t stand behind his or her work.

Nevertheless there are some limitations and conditions that auditors should be clear about when proposing to conduct an audit. Perhaps referring to these limitations as “representations” would be better than the word “disclaimer.” Whichever word is used, these issues should be spelled out both verbally and in writing in audit proposals and audit reports so the auditee understands fully the audit process and its inherent limitations.

There are four major “representations” that an auditee should acknowledge before an audit is started.

1. Representative Samples

By definition, an environmental audit is an independent, objective review of a representative sample of data, information, records, documents, and files. It also includes interviews with a representative sample of knowledgeable facility staff and an inspection of a representative sample of equipment, operations, activities, rooms, and locations at the audited facility.

It’s always possible that some issue outside of the representative sample used by the auditor will hold a non-compliance issue that could be identified by a regulatory agency inspector after the audit is completed. If the auditor did not pick those particular records in the representative sample used during the audit, is the auditor at fault? No. As long as the auditor has exercised due professional care in picking a valid, representative sample, the auditor should not be held accountable for missing the non-compliance issue. This is an acceptable limitation of the auditing process and should be communicated to the auditee. Representative sampling is a time-honored principle of auditing, and it should be part of the audit methodology.

2. Accuracy and Completeness

Auditors draw conclusions on the compliance status of the audited facility based in part on available information sources. Many issues in the scope of a typical audit involve reviewing reports, analytical testing results, performance test data, disposal verification records, and other similar information prepared by external parties such as consultants, laboratories, contractors, and other outside vendors.

An auditor cannot reasonably be held accountable for the accuracy or completeness of available audit information prepared by other external parties, for example, laboratory reports indicating that a solid waste is or is not a hazardous waste. The auditor has no choice but to accept the documented results shown on the available records as accurate and complete assuming the sampling and testing were conducted by a qualified laboratory. If subsequently the validity of the information or data prepared by the external party is called into question and deemed to be inaccurate, the auditors who relied on that information should not be held accountable for any consequences.

This of course does not include compliance information prepared by the auditee staff that is reviewed by auditors. An auditor is responsible for verifying that the associated regulatory compliance information and documentation prepared by the auditee staff is accurate and complete.

In a like manner, the veracity or accuracy of information obtained by auditors through interviews with facility staff must be assumed to be truthful. If it turns out that an individual was intentionally untruthful or deceptive during an interview and an auditor based his or her audit findings on that interview, the auditor should not be held accountable for the consequences.

An auditor is entitled to assume interviewees are trustworthy and are being honest to the best of their ability in their responses to the auditor’s questions.

3. Snapshot in Time

An audit is a snapshot in time. Auditors will draw conclusions on the compliance status of the facility based on conditions observed and information provided by facility staff during the period of time the auditors are on site. Auditors are not responsible nor can they be held accountable for activities, conditions, operations, actions or failure of actions by facility staff that may occur or not occur after the auditors leave the facility.

Auditors should make clear to the auditee that audit findings are based only on observations made and information obtained during the period of the on-site audit.

4. Regulatory Sanctions & Audit Findings

Auditors should not be held liable for any fines, penalties, or other sanctions that may be assessed against the audited facility by any state, county, city or other local regulatory authority for any findings reported by the auditors in the audit report.

This is particularly important if the auditee has not established a proper audit protection process such as Attorney Client Privilege or other method to prevent disclosure of the audit findings to third parties.

Auditors should communicate this exposure to the auditee early in the audit process and ensure the auditee understands that the auditor will not be accountable for consequences resulting from inadvertent disclosure of audit findings to third parties (unless through fault of the auditor).

Similarly, auditors should communicate to the auditee that the auditors are not accountable for regulatory sanctions that may be assessed due to failure of the auditee to correct the audit findings documented in the audit report in a timely manner.

Conclusion

The representations listed above are not intended to be legal opinions about these audit issues but rather advice to auditors on typical misunderstandings that often arise between auditors and auditees. It is suggested that auditors prepare an abbreviated summary of these four issues as “Auditor Representations” or a “Disclaimer” statement (if not troubled by that word).

Placing this concise statement in audit proposals and in audit reports will foster clear communication between auditors and auditees regarding the generally accepted limitations and constraints inherent in the audit process.

Many auditees are simply not aware of these limitations and constraints. Responsible auditors have an ethical obligation to inform auditees of the potential limitations of the audit.

About the Author

Raymond W. Kane P.E. CPEA, now retired and living in Naples, Florida, had a 35-year career as a consultant in the auditing and environmental management field. He currently serves as a special consultant to the The Auditing Roundtable, a professional organization devoted to the practice of environmental, health and safety auditing, where he assists with the organization’s auditor training programs.

Photograph: Japanese Water Garden 5 by Paulo Oliveira Santos, Rotterdam, Netherlands.

Return to the EHS Journal Home Page