Diverging Opinions on Audit Findings

Diverging Opinions on Audit Findings: A Complete Guide for ISO/IEC 27001 Lead Auditors

Introduction
Closing an ISO/IEC 27001 audit is more than presenting a list of nonconformities. Auditors and auditees often disagree about what was found, how it was classified, or whether it is a nonconformity at all. These disagreements are called diverging opinions on audit findings. ISO 19011:2018 (Guidelines for auditing management systems) and ISO/IEC 17021-1 (Requirements for bodies providing audit and certification of management systems) both expect disagreements to be resolved in a structured way. ISO/IEC 27006 applies ISO/IEC 17021-1 to ISMS certification bodies. Lead Auditor exams regularly test this topic because it combines evidence-based judgement, professional conduct and procedural knowledge.

Why It Is Important
1. It protects the integrity of the audit. Findings must rest on objective evidence. If a disagreement is ignored, the audit conclusion may be wrong or unfair.
2. It preserves the auditor-auditee relationship. A respectful, transparent process keeps trust in the audit programme and the certification body.
3. It ensures fairness and impartiality. The auditee must have a genuine chance to present additional evidence or clarify misunderstandings before conclusions are final.
4. It reduces appeals and complaints. Disagreements settled at the closing meeting are less likely to become formal appeals.
5. It is a requirement. ISO 19011 (clause 6.4.10) says diverging opinions should be discussed and, if possible, resolved. Unresolved ones should be recorded. ISO/IEC 17021-1 (clause 9.4.7) requires the audit team to try to resolve them and to record any that remain.

What It Is
A diverging opinion is any disagreement between the audit team and the auditee about:
- The existence of a finding, for example the auditee claims a documented procedure exists that the auditor did not see.
- The classification of a finding, for example major versus minor nonconformity, or nonconformity versus opportunity for improvement.
- The interpretation of a requirement, for example how a clause of ISO/IEC 27001 or an Annex A control applies.
- The accuracy of the evidence, for example the auditee says a record was misread or taken out of context.
- The audit conclusions, for example whether a recommendation for certification is justified.

Diverging opinions can arise at any point in the audit. They may appear during interviews, during the audit team's review of findings, or most visibly at the closing meeting.

How It Works: The Process
Step 1: Prevent surprises. Good auditors share potential findings as they go, for example at daily briefings, so the auditee can respond early. ISO 19011 encourages communication throughout the audit. The closing meeting should not be the first time an auditee hears about a major nonconformity.

Step 2: Present findings clearly at the closing meeting. Each finding should state three things:
- the requirement
- the objective evidence
- the nature of the nonconformity
Clear, factual statements reduce misunderstanding.

Step 3: Listen and consider new evidence. If the auditee disagrees, the audit team should listen objectively. If the auditee presents new, verifiable evidence, the team should evaluate it. If the evidence is valid, the finding may be changed, reclassified or withdrawn. Auditors must be open to being wrong while staying firm when the evidence supports the finding.

Step 4: Discuss and attempt resolution. The audit team leader leads the discussion. Possible approaches include:
- re-examining the evidence
- clarifying how the requirement is interpreted
- checking the audit criteria
The goal is agreement based on facts, not negotiation or compromise for its own sake.

Step 5: Record unresolved diverging opinions. If agreement cannot be reached, both positions should be recorded. This record normally goes in the closing meeting minutes and the audit report. The audit team does not drop a finding simply because the auditee objects. The team's professional judgement, based on evidence, stands.

Step 6: Escalate if necessary. Unresolved matters may be referred to the audit client or the audit programme manager. In third-party certification, they may go to the certification body. The certification body's independent technical review or certification decision-maker considers them. The auditee may also use the certification body's formal appeals process.

Key Roles
- Audit team leader: facilitates the discussion, makes final audit team decisions, and ensures diverging opinions are recorded.
- Audit team members: provide evidence and support for their findings.
- Auditee: presents counter-evidence or explanations.
- Audit client / audit programme manager / certification body: handle unresolved issues and appeals.

Principles Behind the Process
The process applies the ISO 19011 principles of auditing:
- Integrity: do not change findings under pressure.
- Fair presentation: report truthfully and accurately, including unresolved disagreements.
- Due professional care.
- Independence: do not let the auditee's influence bias conclusions.
- Evidence-based approach: decisions rest on verifiable evidence.

Practical Example
An auditor raises a major nonconformity because no evidence of an internal audit of the ISMS could be found for the past year (clause 9.2). At the closing meeting, the ISMS manager states the internal audit was done by an external consultant and the report is on a shared drive.
Correct action: the team leader asks to see the report.
- If the report is available, verifiable and meets clause 9.2, the nonconformity is withdrawn or reclassified. For example, it might become a minor nonconformity if the report shows only part of the scope was covered.
- If the report cannot be produced, the finding stands. The auditee's disagreement is recorded in the audit report, and the auditee is told about the appeal process.

Common Mistakes Auditors Make
- Withdrawing a valid finding to avoid conflict.
- Refusing to look at new evidence out of pride.
- Arguing aggressively or becoming emotional.
- Failing to record unresolved disagreements.
- Accepting verbal assurances without verifiable evidence.
- Negotiating the grade of a nonconformity as a trade-off.

Exam Tips: Answering Questions on Diverging Opinions on Audit Findings
Tip 1: Evidence is king. The correct answer almost always relies on objective, verifiable evidence. If the auditee provides new evidence, the auditor should evaluate it. If no evidence is provided, the finding stands.

Tip 2: Attempt resolution first, then record. Remember the sequence: discuss, attempt to resolve, record if unresolved. Answers that skip discussion or fail to record unresolved opinions are usually wrong.

Tip 3: Never withdraw findings under pressure. Options such as "remove the finding to maintain good relations" or "downgrade it because the top manager objected" violate integrity and independence. Eliminate them.

Tip 4: Do not be inflexible either. Options such as "refuse to discuss the finding" or "ignore the auditee's explanation" are also wrong. Auditors must exercise due professional care and stay open to valid evidence.

Tip 5: Know who decides. The audit team leader makes the final decision on audit findings within the audit team. In certification audits, the certification body makes the certification decision, not the auditor alone. Unresolved issues go to the audit client or certification body. Auditees can appeal through the certification body's formal process.

Tip 6: Know where it is documented. Unresolved diverging opinions should appear in the closing meeting records and the audit report. Expect questions asking what must be included in the audit report.

Tip 7: Recognise scenario keywords. Look for phrases such as "the auditee disagrees", "the top manager rejects the nonconformity", "the auditee claims the auditor misunderstood", or "new evidence presented at the closing meeting". These signal a diverging opinions question.

Tip 8: Professional behaviour matters. In essay or scenario answers, describe a calm, respectful, fact-based approach. Mention the principles of integrity, fair presentation, independence and the evidence-based approach.

Tip 9: Structure written answers. For open-ended questions, use this structure:
(1) Acknowledge the disagreement.
(2) Re-present the requirement and evidence.
(3) Review any new evidence.
(4) Decide based on evidence: maintain, modify or withdraw the finding.
(5) Record any unresolved diverging opinion in the audit report.
(6) Inform the auditee of escalation or appeal options.

Tip 10: Reference the standards. Citing ISO 19011 clause 6.4.10 (closing meeting) and ISO/IEC 17021-1 clause 9.4.7 earns credibility in written exams. They establish that diverging opinions should be discussed, resolved where possible, and recorded if unresolved.

Tip 11: Watch for verbal assurances. If the auditee only says "we do that" without proof, the correct answer is to maintain the finding. Alternatively, the auditor can request evidence within the audit time frame. Verbal claims alone never justify withdrawing a finding.

Tip 12: Time constraints. If evidence cannot be verified before the audit ends, the finding generally remains. The auditee can provide the evidence later through the corrective action process or follow-up. Do not extend conclusions on unverified promises.

Summary
Diverging opinions on audit findings are a normal part of auditing. The Lead Auditor's role is to handle them professionally:
- communicate early
- present findings clearly
- listen to and evaluate new evidence objectively
- attempt resolution through fact-based discussion
- record unresolved disagreements
- direct the auditee to proper escalation or appeal channels
In exams, choose answers that balance openness with integrity, always anchored in objective evidence and proper documentation.