While you are doing your audit you found a significant violation, what should you do?

I think it's the first choice I continue my plan and to submit a report on the matter at the end of the audit plan in the audit report?

In similar situations, I always recommend issuing a " Flash Report" to bring the findings to the attention of the proper parties ( Audit committee and company management ) through the Internal Audit Managemnt (i.e CAE).The continuation of the audit shoud be decided based on the circumstances and the discussions between the above mentioned parties.

Hello,

First, auditing process is there to pionpoint what is wrong, is the system working, what needs to be done. Having said there is "Significant" violation, it means that there is immediate danger or High Risk situation which will warrant and immediate response. Report it in writing immediately to the line manager in charge of this section and recommend to stop the task untill the Risk is controlled and brought down to "ALARP".

Second, having done that, I continue the audit process and again report my findings in my final report highlightimng the urgency of the violation. Bring this to the attention of high manages.

Third, finding such violation, it doesn't mean my employer is careless or negligant. The system may have gone through Significant error due to many  technical or admin misconduct which might be not so obvious to the routine daily work. This is the duty of safety staff on site.

Third, please do be a "whistle blower". Internal audit is part of the internal affairs of the organization and should be dealt internally and corrected to move on and not ment to be a fault finding to punish someone or degrade the business. DO your duty in honest way and strive to implement best practices and I am sure that organization will do much better if you use this audit in a positive way.

 

Fourth, this finding will require a Fresh Risk Assessment and I prfer to be party of it along with HSE manage, line manager, workers representative involved in the task and a board member.

Fifth, and most important is to communicate the Risk with the involved workers and the new measures to rectify the situation or the processs. It may need training or alteration to the process!

Communicate the lesson lernt.

 

Failure is merely unsuccesful trial, ther is always a better way. We can do better.

 

Wish you all the best in your safety job.

In our audit process we found any  violation/non compliance of rules and regulation, following procedures may be followed;-

 

1) Communication with higher level management or Those charged with governance.(Like flash report)

2) if the management is agree and complied, then errors should be rectified and Fraud should be disclose.

3) if management not agree and not taken any action, then report to statutory authorities or seek legal opinion. and also qualify in his report.

I prefer to continue with audit schedule as planned, generate complete reprot. Share and discuss the audit findings with Auditee agenecy and report back to Management with further action plan. with approval from management, start implementing the action plan with Auditee agency to understand the case of significant Violation. If required conduct specific audit.

If the vialoation was intentional by Auditee the review the control measures planned by him and its extent of implementation.

If it is not Intentional then, must find out root cause and provide the CAPA for implementation plus follow up audit.

Note: One must stop the Process immediate till further notice if vialation is very severe and can cause human injury, death or financial loss. 

On finding such a violation report it to the audit senior/partner accordingly, try finding the reason behind this violation to verify either it was intentional or due to the lack of knowledge. At the end of work at client's prepare an audit findings report and share it with client's management and then ask for their possible reasons. Convince them to correct the wrongs found. If they agree and update their records then it's ok, otherwise report on the basis of materiality level set by you in the beginning.

I will analyse and inform  the major observation to all the concerned .Then I will continue with the audit.

Immediate report to the appropriate party folowing with subsequent reports

continue with the plan and discuss the violation with your line manager and user/client.
Try to find out if the violation is fraud or error.
Keep skeptical approach but don't jump into conclusions.

Carry out the audit as planned till all the areas are covered and highlight the control weaknesses in the draft report, where the management will give a response to these issues and if they cannot successfully clarify those control risks, it will appear in the final report of the company.
Further, the continuation of the audit depends on the nature of the violation as well.

Findout why the violation took place, after ascertaining the reasons (if doing forensics) carve out the people by whom such activity was done, then while continuing the audit plan, report the matter to the management and also give brief about the findings.