Have you ever been audited and felt like the auditor’s findings were almost irrelevant in the context of your organization’s major challenges and goals? Did you sometimes feel like you've been handed a Mickey Mouse nonconformity given the issues your organization is confronting? But what is one to do, when maintaining registration to standards such as ISO 9001 is necessary, and therefore complying with the appointed auditor’s findings is part of the process? Let me provide some insights that might help you turn an audit into a win-win situation.

Why do we need surveillance audits in the first place?

Many standards, such as ISO 9001 and the Sarbanes-Oxley Act, which protects investors by improving the accuracy and reliability of corporate disclosures, require that organizations be audited periodically to ensure that the management or financial system (whichever is being audited) has been effectively implemented, and that it continues to meet the standard’s requirements. In essence the audit ensures that the organization is brought back to the path of compliance if there has been any deviation from the norm.

Think of the path as a winding road and the organization as a bicyclist who sometimes takes the turns a little wide. Sometimes the cyclist might decide to cut through a curve because another curve is coming up and it makes no sense to follow the curvy road. The auditor’s job is to point out those times when the cyclist went too far off the road or took so severe a shortcut that he didn’t follow the path at all.

If that is the auditor’s goal, then we are usually OK with that. The problem is when the auditor ends up pointing out every time the cyclist  (i.e., the organization) strays just a few inches from the road (i.e., the requirement), which might be insignificant compared to the large shortcuts or the really wide turns. But is that good or bad? Let's look at this from both the auditor’s and the organization’s perspective.

Who are the auditors and what are their obligations?

Auditors have vast experience in auditing but are also well-versed in several industries, either from working in them or by auditing them extensively. Auditors have significant training in auditing techniques, and most of them maintain personal certifications by accredited bodies. Their training gets reinforced with every audit they conduct, and of course with the periodic training they are required to take to maintain their certifications.

But aside from that, auditors are just normal people, not fortunetellers—despite their unusual power to find the records nobody wants them to see. They have good days and bad days, are really good at some things and could improve at others. Most auditors are true road warriors who spend a lot of their time in planes and hotels away from their families. By and large, auditors want to do a good job and help organizations improve; at least most of them do.

However, auditors don't always find those situations where your organization took severe shortcuts and deviated tremendously from the standard’s requirements. In those cases they may be more prone to point out those minute, Micky Mouse nonconformities. Most likely the auditor will say that even tiny nonconformities can indicate underlying systemic issues.

Auditors must answer not only to the registrar they work for but also to the bodies that have accredited those registrars. Those bodies have strict rules about reporting. Therefore, for an auditor, a nonconformity is a nonconformity; writing up a nonconformity as an observation can easily be seen by an accreditation body as a failure by the auditor to report a true nonconformity, despite how insignificant it is.

Sometimes auditors are also distracted either by their own schedules or your organization’s changes or availability.When an organization tries to hide weak areas, it disables the auditor. This obviously hampers the success of the audit, but the organization also suffers because it misses the opportunity to find out true areas for improvement.

What are the organization’s rights?

So the auditor writes up what seems to be a silly nonconformity. What is the organization left to do? If it does not agree with the nonconformity, it can always discuss that with the auditor and try to reach a better understanding. If a consensus cannot be reached, then the organization can appeal to the auditor’s company. Most have an established appeal process where your organization can air its grievance and have the issue reviewed and managed appropriately.

But what if you recognize that the minute nonconformity is justified, but you think it's a waste of time given the daily challenges your organization faces? Well, you are still going to have to address it. Once it has been declared a nonconformity, you will be faced with it again during the follow-up audit when the auditor ensures that no other incidents of this type have occurred. If they have, your Mickey Mouse nonconformity could turn into a big, ugly Godzilla-sized rat, and—well, let’s just say at this point your certification could be in jeopardy.

But getting back to the benefits of the minute nonconformity and your rights. The best approach is twofold:

• You should let your organization continue on its path of continual improvement and world-class practices, and that means closing all those loose ends. Even a minute nonconformity could open a can of worms, so finding the true root causes and promptly taking care of them is a worthwhile goal.

• Your organization should determine its key or critical processes or problem areas. These should be the ones you ask the auditor to concentrate on. I’m not suggesting that she forgo the audit agenda and only look at those key processes, but she can keep those in mind when auditing. If you have an honest and open dialogue with the auditor, you can offer to show examples of a problematic process. By doing this you will avoid  getting saddled with Mickey Mouse nonconformities in an area that is doing relatively well, while getting more feedback on areas that need attention. This will also ensure you get the best bang for your buck when you pay for the audit.

Win-win audit

Now that you’ve considered these different perspectives, I hope you can see that Mickey Mouse nonconformities do have some value. But more important, I hope you can also see what you need to do to get more value out of your audits. Remember,being honest and open with the auditor will help him do a better job and provide better findings.