Do audits really add value? Part 2 of 3

Last week I asked whether we can ever trust the third-party audit process, and suggested two (or maybe three) reasons we might not: registrars go easy on us because they don't want to lose clients, experts disagree, and (although this last point is a very individual matter) there are a few external auditors who are kind of goofy. (We've all met one somewhere.)

On the other hand, I've also had experiences that run smack in the other direction. Let me describe two.

One time I worked with an external auditor who I thought was going to end up in the "goofy" category. She was a chatty little old lady, who always started off her interviews by talking about her vacations or her grandkids, and who invariably wound up her interviews ahead of schedule. Then as soon as the auditee had left the room she'd ask me to step outside with her so she could have a cigarette. All through the audit, I had people comment to me quietly that they were amazed how smoothly it was going. And then at the end she wrote us three nonconformities which exactly nailed the three places we were having the most trouble. Her style was so relaxed that it put everyone off-guard, but her questions probed deeply — and got there fast.

There's also a phenomenon that I have experienced when I do internal audits, and that I have seen play out in external audits as well. I have sometimes jokingly called it a Special Providence for ISO Auditors. It works like this: 

• The client has a drawer full of 100 files. 
• Ninety-eight of those files are perfect. Two are wrong. 
• You, the auditor, close your eyes and randomly pull three files out to check.
• One of the ones you pull out will be wrong.

It's uncanny how often this works. I've had it happen to me when I do internal audits, and I've watched external auditors do the exact same thing. Those auditors wrote us up, too.

So where does this leave us? Last week I talked about reasons not to trust audit results. But this week I've discussed two reasons we can trust them: trained auditors can be amazingly perceptive, and problems or errors seem to jump out in front of them. Which is it?

My answer is that yes, we can trust our audit results, provided that we understand clearly what the job of an external audit really is and don't expect it to do something else instead. I'll talk about the real job of an audit in next week's installment.