The Power of third party audits

The problem the book addresses

Most organisations commission their first external audit under pressure. A customer has asked for evidence, a regulator has raised a finding, a contract has a clause in it, or a board has decided that independent assurance would be prudent. The decision to buy an audit gets made quickly, and the harder question, what exactly should be audited and to what criteria, gets settled by whichever auditor answers the phone first.

The result is predictable. The scope is copied from the auditor’s standard template, the audit examines what that template examines, and the report confirms what the organisation already believed. Nobody has done anything wrong and nobody has learned anything either. The money is spent, the certificate or report is filed, and the same weaknesses are still there the following year.

This handbook is about the decisions taken before an auditor arrives, because those decisions determine almost everything about the value of the audit. An audit is a purchased service, and like any purchased service it rewards a buyer who knows what good looks like.

First, second and third party, and why the distinction matters commercially

Auditing is conventionally split three ways. A first-party audit is an organisation auditing itself. A second-party audit is a customer auditing a supplier. A third-party audit is conducted by a body independent of both. The general principles, audit programme management, and auditor competence expectations behind all three are set out in ISO 19011, which is guidance rather than a requirement, and the requirements applying specifically to bodies that audit and certify management systems sit in ISO/IEC 17021-1.

The distinction is not academic, because it determines what the output is worth to somebody outside your organisation. An internal audit is evidence that you looked. A third-party audit is evidence that somebody with nothing to gain looked. When a customer, an insurer or an authority asks for assurance, they are usually asking for the second kind, and the book is explicit about when the cheaper option is genuinely sufficient and when it is not.

It also covers the layer above the auditor. Certification bodies are themselves assessed, and the international recognition arrangements maintained by the IAF exist so that a certificate issued in one country carries meaning in another. Understanding that structure is what lets a buyer tell a meaningful certificate from a decorative one.

Choosing an auditor, and the questions that separate them

Auditor selection is where most of the avoidable cost sits. Proposals are difficult to compare because they describe effort rather than outcome, and the cheapest quotation is frequently the one scoped to find the least. The book works through what to ask: how audit days are calculated and what happens if the estimate is wrong, who will actually be in the room as opposed to whose profile appears in the proposal, what sector experience the audit team has, how findings are graded, and what the process is when you disagree with one.

There is a chapter on the awkward questions too. Independence is easy to claim and harder to demonstrate, particularly when the same firm offers consulting alongside auditing. The book sets out how to ask about that without insulting anyone, and why an auditor who has already helped you build the system cannot credibly assess it.

Managing the audit, and managing what comes out of it

The second half of the handbook is operational. It covers what to send in advance and what to hold back, how to brief staff so they answer honestly rather than defensively, why the opening meeting matters more than people expect, and how to run the audit week without half the organisation stopping work.

Findings get the most attention, because that is where value is either captured or lost. A finding is information the organisation paid for, and the common failure is to treat it as an accusation and close it with the smallest change that satisfies the auditor. The book distinguishes correcting an instance from correcting the cause, explains why root cause analysis so often stops one step too early, and gives a practical way to decide which findings deserve a real change of process and which genuinely are one-off slips.

If you want to see how NorthSky approaches this in practice before or after reading, the how we work page sets out the method, and you can outline a specific situation on the contact page.

Editions and format

The book is available as a paperback and as a Kindle print replica. The content is identical. The print replica keeps the paperback page layout, which means text does not reflow to fit a small screen, so it reads best on a tablet or a computer rather than on a phone. If you expect to work through the checklists alongside colleagues, the paperback is the more practical of the two.