Quality and Complaint Management in an Audit Program

Quality and Complaint Management in an Audit Program (ISO/IEC 27001 Lead Auditor)

Introduction
Quality and complaint management is a core part of managing an ISO/IEC 27001 audit program. It makes sure that audits are planned, carried out, reported and followed up in a consistent, competent and impartial way. It also makes sure that any dissatisfaction from auditees, clients or other interested parties is captured, investigated and resolved fairly.

This topic draws mainly on four sources:
• ISO 19011: guidelines for auditing management systems, especially clause 5 on managing an audit program.
• ISO/IEC 17021-1: requirements for certification bodies, including clause 9.8 on complaints and clause 9.7 on appeals.
• ISO/IEC 27006: additional requirements for bodies that audit and certify information security management systems.
• ISO/IEC 27001 itself: in particular clause 9.2 on internal audit and clause 10 on improvement.

Why It Is Important
1. Credibility of audit results: Organizations, regulators and customers rely on audit conclusions and certificates. Poor-quality audits weaken trust in certification and in the ISMS.
2. Consistency: A quality-managed program makes sure that different auditors and audit teams apply the same methods, criteria and standards of evidence.
3. Impartiality and integrity: Quality controls and complaint handling help detect and prevent conflicts of interest, bias and unethical behaviour. These are central principles in ISO 19011 clause 4.
4. Continual improvement: Complaints, feedback and quality reviews feed the review and improvement of the audit program, in line with ISO 19011 clause 5.7.
5. Risk management: ISO 19011 requires a risk-based approach to the audit program. Low audit quality and unresolved complaints are risks to the program objectives and to the reputation of the auditing organization.
6. Accreditation and compliance: Certification bodies must show accreditation bodies that they have effective processes for handling complaints and appeals, under ISO/IEC 17021-1.

What It Is
Quality management in an audit program is the set of activities that make sure the program meets its objectives and that each audit is performed to the required standard. It includes:
• Defining audit program objectives, scope, extent and resources.
• Selecting and evaluating competent auditors and audit team leaders.
• Establishing documented procedures, templates and checklists.
• Reviewing audit plans, reports and conclusions, for example through technical review or an independent decision-making function.
• Monitoring auditor performance, for example through witness audits, report reviews and feedback from auditees.
• Keeping records that demonstrate implementation of the program.
• Monitoring, reviewing and improving the program.

Complaint management is the process for receiving, recording, acknowledging, investigating, deciding on and communicating the outcome of expressions of dissatisfaction. These may concern the auditing activities, the auditors or the certified clients.

It is important to know the difference between three similar terms:
• Complaint: an expression of dissatisfaction, other than an appeal, by any person or organization, where a response is expected. Example: an auditee complains that an auditor was rude or that the audit overran.
• Appeal: a request by the auditee or client to reconsider a decision made by the certification body. Example: a request to reconsider a refusal to grant certification.
• Feedback: opinions or comments that do not necessarily require a formal response, but are used for improvement.

How It Works
A. Quality management across the audit program lifecycle (ISO 19011 clause 5, PDCA)
1. Plan:
• Establish audit program objectives aligned with the organization's strategic direction and information security policy.
• Determine and evaluate program risks and opportunities. Examples include insufficient resources, lack of auditor competence, ineffective communication and poor-quality reports.
• Define roles and responsibilities, including those of the audit program manager.
• Set evaluation criteria for auditors and for the program's performance.

2. Do:
• Assign competent audit teams, considering independence and objectivity.
• Communicate the program to relevant parties.
• Use standardized methods for audit planning, sampling, evidence collection, grading of nonconformities and reporting.
• Make sure records are controlled. This covers audit plans, reports, nonconformity reports, corrective action evidence, and auditor competence records.

3. Check:
• Monitor whether schedules and objectives are achieved.
• Evaluate the performance of audit team members, for example through observation, report review and auditee feedback.
• Review the conformity of each audit with procedures.
• Analyse complaints, appeals and feedback for trends.
• Carry out internal audits of the audit function itself and run management reviews.

4. Act:
• Take corrective actions on identified weaknesses.
• Update procedures, training and auditor competence requirements.
• Improve the program and report results to top management.

B. Typical quality control mechanisms
• Technical or independent review: audit reports are reviewed before a certification decision by a person who did not take part in the audit.
• Witness audits: the program manager or a senior auditor observes auditors in the field.
• Calibration sessions: these align auditors on how to grade nonconformities consistently.
• Auditee satisfaction surveys: these are issued after the audit.
• Key performance indicators: examples include timeliness of reports, number of report errors, complaint rate and the rate of corrective actions closed on time.
• Continuing professional development: auditors maintain and improve their competence.

C. Complaint handling process (based on ISO/IEC 17021-1 clause 9.8)
1. Receipt: The complaint is received by any channel. The process for handling complaints should be publicly available.
2. Acknowledgement: The complainant is told that the complaint has been received.
3. Validation: The organization checks whether the complaint relates to its audit or certification activities. If it does, the organization deals with it. If the complaint concerns a certified client, its effectiveness is also considered.
4. Recording and tracking: The complaint is logged with details, dates and responsibilities.
5. Investigation: All necessary information is gathered and verified. The person or persons investigating and deciding must not have been involved in the audit or certification activities related to the complaint. This preserves impartiality. A related point is that the complaint process itself must not result in discriminatory action against the complainant.
6. Decision and action: Corrections and corrective actions are decided, including root cause analysis.
7. Response: Progress reports and the outcome are given to the complainant. Formal notice is given at the end of the process.
8. Confidentiality: The complainant's identity and the subject are protected, as appropriate. Whether, and to what extent, the subject and outcome are made public is decided together with the client and the complainant.
9. Closure and learning: Records are retained, trends are analysed, and the results feed program review and management review.

D. Appeals process (clause 9.7)
This works in a similar way to complaints. There is a documented, publicly available process. The appeal is investigated by persons not involved in the original decision. Decisions are free of conflict of interest and are communicated formally.

E. Internal audit programs (ISO/IEC 27001 clause 9.2)
For a first-party internal audit program, the same principles apply. Auditors must be objective and impartial, results are reported to relevant management, and documented information is retained. Complaints or concerns about the internal audit function are handled through the organization's nonconformity and corrective action process (clause 10.2). They also feed management review.

Practical Example
A certified client complains that the lead auditor raised a major nonconformity without objective evidence. The audit program manager does the following:
• Logs and acknowledges the complaint.
• Assigns an independent reviewer who was not on the audit team.
• Examines the audit evidence, working papers and interview notes.
• Finds that the evidence supports only a minor nonconformity.
• Corrects the grading.
• Informs the client of the outcome.
• Arranges calibration training for the auditor.
• Records the case for trend analysis.
• Reports it at the next audit program review.

Exam Tips: Answering Questions on Quality and Complaint Management in an Audit Program
1. Think impartiality first. If an answer option has the involved auditor investigating a complaint about themselves, it is almost always wrong. The correct answer gives the investigation to someone independent of the activity being complained about.
2. Distinguish complaint and appeal. An appeal challenges a decision, such as a certification decision or a nonconformity grading. A complaint is dissatisfaction with service, behaviour or a certified client. Exam scenarios often test this difference.
3. Remember the sequence. The order is receive, acknowledge, validate, record, investigate, decide, respond and close. Answers that skip acknowledgement or communication with the complainant are weaker.
4. Link to continual improvement. The best answers show that complaints and quality findings feed audit program review and management review, and lead to corrective action with root cause analysis.
5. Refer to the right standard. Use ISO 19011 clause 5 for audit program management, ISO/IEC 17021-1 for certification body requirements on complaints and appeals, and ISO/IEC 27006 for ISMS-specific requirements. Citing the correct reference strengthens essay answers.
6. Use the PDCA structure. When asked how to ensure audit program quality, structure your answer as plan, do, check and act. Mention objectives, risks, competence, monitoring, records and improvement.
7. Mention evidence and records. Quality is demonstrated through documented information, such as complaint logs, competence records, review reports and KPIs. Examiners look for this.
8. Confidentiality and no retaliation. State that complainants are protected and that information is treated confidentially.
9. Scenario questions: First identify the issue (quality failure, complaint or appeal). Then identify who should act (usually the audit program manager or an independent person). Then give the immediate correction, the corrective action, and the follow-up and monitoring.
10. Watch for distractors. Be careful with options such as 'ignore anonymous complaints', 'let the lead auditor decide', 'close the complaint without informing the complainant' or 'only take action if the client threatens legal action'. These contradict good practice.
11. Auditor performance evaluation: Know the methods: review of records, feedback, observation (witnessing), testing and post-audit review. Know that evaluation is continual and based on predefined criteria.
12. Keep answers concise and justified. In written answers, state the action, the reason (the principle or requirement behind it) and the expected outcome. For example: 'Assign an independent reviewer to ensure impartiality, as required by ISO/IEC 17021-1, to reach an objective decision.'

Key Takeaway
Quality and complaint management protects the credibility of the audit program. It works through competent and impartial people, consistent processes, independent review, transparent complaint and appeal handling, documented evidence, and continual improvement driven by monitoring and feedback.