Main Page > 14 Red Flags > ​​Audits > Red Flag 6

6. Allows the Company or Supplier Being Audited to Pay Directly for and/or Choose the Auditor

  • What this means 
  • Why investors should care
  • What to look for
  • Checklist
<
>
The EU Corporate Sustainability Due Diligence Directive (CSDDD) states that third party verification should be “free from any conflicts of interests and from external influence.”[1] Similarly, one of the key elements of ISO 17065 “Conformity Assessment – Requirements for Bodies Certifying Products, Processes, and Services" is that the “certification body operates impartially and independently from any commercial, financial, or other pressures that could compromise its impartiality.”[2]
 
Conflicts of interests pose a genuine risk in social auditing. Experts contend that the audit incentive structure, especially the lack of legal liability for inaccurate findings, undermines social auditing. Audits remain essential to understanding conditions in operations and to verifying companies sustainability claims. For initiatives, because audits are typically paid for by the supplier pursuing certification, auditors may feel pressure to overlook violations. [3] Likewise, schemes' reliance on member fees can disincentivize robust enforcement against member breaches, eroding the credibility of both schemes and audits.[4] 
 
Studies show that when enterprises pay for their own audits their quality decreases.[5] Human Rights Watch conducted interviews with auditors who described the tensions they feel when hired directly by buyers or suppliers. Specifically, they found that companies prefer to hire “friendly” auditors, pressure auditors for lenient audits, and demand to hide damaging findings so that they can continue placing orders with a certain supplier.[6] Another study found outright instances of collusion between auditors and suppliers.[7] Moreover, highly competitive market conditions within the auditing industry can lead auditors to cutting corners to reduce costs, keep clients happy, and compete effectively within the industry.[8]
 
While conflicts of interests are difficult to root out, auditors can be insulated from profit interests when there is a firewall between the organization being audited and the one that pays for it. Without a firewall, the risk that auditors will overlook labor abuses in order to keep the business of a company or supplier increases. Establishing dedicated auditing bodies, which is advocated by the Worker-Driven Social Responsibility (WSR) Network, is one method, which enables better problem identification and follow through on audit findings: 
[An] independent, third-party monitor, created specifically for the WSR program, investigates complaints from farmworkers and conducts field audits on farms. This creates a virtuous constant feedback loop, in which complaint resolutions provide for ongoing monitoring and enforcement complemented by the broader investigations and more expansive changes enabled through audits and corrective action plans.[9]
Conversely, auditor monopoly in a region can reduce audit performance and result in insufficient oversight. For instance, managers at sugar processors in Maharashtra told researchers commissioned by Bonsucro to study the implementation of the Bonsucro Smallholder Production Standard in India that they questioned the quality checks carried out by the sole auditor servicing the region, Control Union. This led researchers to conclude that "the dependency on Control Union and lack of competition creates little incentive for the auditor to improve."[10]
[1] European Parliament, Legislative Resolution of 24 April 2024 on the Proposal for a Directive of the
European Parliament and of the Council on Corporate Sustainability Due Diligence and Amending
Directive (EU) 2019/1937, accessed June 5, 2024, https://www.europarl.europa.eu/doceo/document/TA-9-2024-0329_EN.html.
[2] International Organization for Standardization, ISO/IEC 17065:2012 Conformity assessment — Requirements for bodies certifying products, processes and services (last reviewed in 2018), https://www.iso.org/standard/46568.html.
[3] Aruna Kashyap, ‘Obsessed with Audit Tools, Missing the Goal:’ Why Social Audits Can’t Fix Labor Rights Abuses in Global Supply Chains (Human Rights Watch, November 15, 2022), 14, https://www.hrw.org/report/2022/11/15/obsessed-audit-tools-missing-goal/why-social-audits-cant-fix-labor-rights-abuses.
[4] MSI Integrity, Not Fit-for-Purpose: The Grand Experiment of Multi-Stakeholder Initiatives in Corporate Accountability, Human Rights and Global Governance (July 2020), 146, https://www.msi-integrity.org/wp-content/uploads/2020/07/MSI_Not_Fit_For_Purpose_FORWEBSITE.FINAL_.pdf.
[5] John Jiang, Mary Harris Stanford, and Yuan Xie, “Does It Matter Who Pays for Bond Ratings? Historical Evidence,” Journal of Financial Economics 105, no. 3 (September 2012): 607–21, https://doi.org/10.1016/j.jfineco.2012.04.001.; Esther Duflo, et al., “Truth-Telling by Third-Party Auditors and the Response of Polluting Firms: Experimental Evidence from India*,” The Quarterly Journal of Economics 128, no. 4 (November 2013): 1499–1545, https://doi.org/10.1093/qje/qjt024.; Jodi L. Short, Michael W. Toffel, and Andrea R. Hugill, “Monitoring Global Supply Chains,” Strategic Management Journal 37, no. 9 (September 2016): 1878–97, https://doi.org/10.1002/smj.2417.
[6] Aruna Kashyap, ‘Obsessed with Audit Tools, Missing the Goal,' 14-16.
[7] Genevieve LeBaron et al., Forced Labour Evidence Brief: Social Auditing and Ethical Certification (Re:Structure Lab, July 2022), 10, https://static1.squarespace.com/static/6055c0601c885456ba8c962a/t/62d746146f5dc5205a17621c/1658275349325/ReStructureLab_SocialAuditingandEthicalCertification_July2022.pdf.
[8] Ilona M. Kelly et al., Fig Leaf for Fashion. How social auditing protects brands and fails workers (Clean Clothes Campaign, 2019), 38, https://cleanclothes.org/file-repository/figleaf-for-fashion.pdf/view.; Transparentem, Hidden Harm: Audit Deception in Apparel Supply Chains and the Urgent Case for Reform (October 2021), 24, https://transparentem.org/project/hidden-harm/.
[9]  Antonella Angelini and Shauna Curphey, “The Overlooked Advantages of the Independent Monitoring and Complaint Investigation System in the Worker-driven Social Responsibility Model in US Agriculture,” Business and Human Rights Journal 7, no. 3 (October 12, 2022): 497, https://doi.org/10.1017/bhj.2022.25.
[10] Ana Perez Adroher et al., The Impact of Bonsucro on Human Rights in the Sugarcane Sector: A Focus on India (Columbia University School of International and Public Affairs, 2019), 69-70,  https://www.sipa.columbia.edu/sites/default/files/migrated/downloads/Bonsucro%2520Report_FINAL%2520DEC%252017%25202019.pdf.
In 2012, a fire broke out at the Ali Enterprises Factory in Pakistan killing over 250 workers and injuring hundreds more.[1] Three weeks prior to this tragedy, RINA, an Italian auditing firm, had certified the factory to be compliant with the SA8000 standard set by Social Accountability International (SAI). For factories to be SA8000 certified, they directly contract with an SA8000 accredited audit firm that performs the necessary audits to achieve accreditation.[2] RINA had ignored multiple safety requirements set both by international standards and the Pakistani government, such as the need for a working fire alarm system and an adequate number of functional emergency exits.[3] The catastrophe resulted in lawsuits against the German retailer KiK Textilien and the auditing body RINA, Ali Enterprises Factory Fire Affectees Assoc. v. RINA Services S.p.A.[4] Plaintiffs alleged that RINA breached the OECD Guidelines by conducting factory audits paid for by the factory owner and failing to establish a conflict of interest-free payment system.[5] In the report “Human Rights Fitness of the Auditing and Certification Industry,” ECCHR and its partners further explain how these conflicts of interests are exacerbated by poor quality control processes: “Although the SA8000 scheme provides elaborate methodological guidance, its accreditation body SAAS [Social Accountability Accreditation Services] does not appear to have ensured that its substantive and methodological standards were actually applied in this case.”[6]

Separately, The New York Times chronicled the case of auditing firm UL Solutions, which disciplined one of its auditors after he failed three Walgreens suppliers for abusive working conditions in 2017 and 2018. (The report cites the auditor’s “communication style” as the reason given for the discipline.) In 2023, when the same auditor flagged labor issues at a warehouse supplying Costco, UL Solutions barred him from returning, citing the warehouse’s complaints that he was demanding and argumentative. The New York Times reports that the auditor “believed that the supplier objected to his finding 21 violations when the previous audit had found none.”[7] This example shows that when buyers or suppliers fund audits, conflicts of interest can arise, discouraging thorough inspections and accurate reporting and, compromising audit quality.
 
The catastrophic collapse of the Brumadinho tailings dam at the Córrego do Feijão mine in Brazil in 2019, which unleashed a torrent of hazardous mud into surrounding communities, also suggests a possible company-auditor conflict of interest at play. Dam owner Vale directly hired TÜV SÜD to certify the safety of the dam in accordance with Brazilian law.[8] According to reports, “employees inferred TÜV SÜD would lose their business with Vale if they denied the safety of one of the many sedimentation ponds belonging to Vale.”[9] The NGO also asserts that TÜV SÜD, “had a conflict of interest due to a parallel engagement. At the time, it was also negotiating a consulting contract involving the same dam—a contract significantly more valuable than the auditing assignment, and one that required a positive stability declaration.”[10] TÜV SÜD denies the claims that it was under any pressure from Vale and asserts that their audits were conducted “cautiously and were guided solely by technical considerations.”[11] Nonetheless, the Brumadinho Dam catastrophe came with a huge financial cost to the operators: a court-ordered $290 million fine.[12]
 
→ Demonstrates: Reputational risk, operational risk, legal risk, direct financial risk
[1] Zia ur-Rehman, Declan Walsh, and Salman Masood, “More Than 300 Killed in Pakistani Factory Fires,” The New York Times, September 12, 2012, https://www.nytimes.com/2012/09/13/world/asia/hundreds-die-in-factory-fires-in-pakistan.html.
[2] “SA8000 Certification: Getting Started,” Social Accountability International, accessed March 7, 2024, https://sa-intl.org/resources/sa8000-getting-started/.; “SA8000: The ‘Gold Standard’ for Failing Workers?,” Worker-Driven Social Responsibility Network, July 17, 2018, https://wsr-network.org/resource/sa8000-the-gold-standard-for-failing-workers/.
[3] “Justice for the Ali Enterprises victims,” Clean Clothes Campaign, accessed March 7, 2024,  https://cleanclothes.org/campaigns/past/ali-enterprises.; “Case Study: Ali Enterprises (Pakistan),” Worker-Driven Social Responsibility Network, accessed March 7, 2024, https://wsr-network.org/what-is-wsr/csr-and-msis/msi-case-study-ali-enterprises-pakistan/.
[4] “KiK: Paying the price for clothing produced in South Asia: Pakistan factory fire victims sued German retailer KiK,” European Center for Constitutional and Human Rights, accessed March 7, 2024, https://www.ecchr.eu/en/case/kik-paying-the-price-for-clothing-production-in-south-asia/.; OECD Watch, Ali Enterprises Factory Fire Affectees Assoc. v. RINA S.p.A (September 11, 2018), https://www.oecdwatch.org/complaint/ali-enterprises-factory-fire-affectees-assoc-v-rina-s-p-a/#printing-Ali%20Enterprises%20Factory%20Fire%20Affectees%20Assoc.%20v.%20RINA%20S.p.A.
[5] OECD Watch, Ali Enterprises Factory Fire Affectees Assoc. v. RINA S.p.A, 23.
[6] Claudia Müller-Hoff, Human rights fitness of the auditing and certification industry? A cross-sectoral analysis of current challenges and possible responses (ECCHR, Brot für die Welt, and MISEREOR, 2021), 46,  https://www.ecchr.eu/en/publication/human-rights-fitness-audits/.
[7] Hannah Dreier, “They’re Paid Billions to Root Out Child Labor in the U.S. Why Do They Fail?” The New York Times, December 28, 2023, https://www.nytimes.com/2023/12/28/us/migrant-child-labor-audits.html.
[8] Dr. Thomas Oberst (of TÜV SÜD), email to RightsCoLab, April 23, 2024.
[9] Müller-Hoff, Human rights fitness of the auditing and certification industry?, 14.; “Three Years on from Brumadinho Dam Disaster TÜV SÜD Face €400 Million Lawsuit,” Pogust Goodhead, February 1, 2022, https://pogustgoodhead.com/three-years-on-from-brumadinho-dam-disaster-tuv-sud-face-e400-million-lawsuit/.
[10] Müller-Hoff, Human rights fitness of the auditing and certification industry?,14.
[11] TÜV SÜD asserts that it "did not have a conflict of interest when auditing Dam B I," noting that the audits by TSB were mandated by Brazilian law. The organization emphasizes that "ensuring independent audits is one of TÜV SÜD's core values," as stated in its Code of Ethics, which underscores the principles of independence, integrity, and legality. TÜV SÜD also disputes the allegations regarding pressure from Vale, affirming that "the engineers of the Brazilian TÜV SÜD company TSB did not yield to any pressure" and that their audits were conducted with caution, based solely on technical considerations. Dr. Thomas Oberst (of TÜV SÜD), email to author, April 23, 2024.
[12] Witold J. Henisz and James McGlinch, “ESG, Material Credit Events, and Credit Risk,” Journal of Applied Corporate Finance 31, no. 2 (2019): 105–17, https://doi.org/10.1111/jacf.12352.
In their company engagements, investors can ask what the scheme does to combat conflicts of interest and corruption in auditing. Examples of initiatives with quality controls:
➔    GoodWeave’s Certification System Overview requires an oversight mechanism for auditors. The policy reads:
The GoodWeave Quality Assurance Unit conducts annual audits of its certification systems to ensure compliance with policies and procedures throughout all country offices.
Additionally, GoodWeave is the recipient of external audits by two parties:
  • ISEAL – to maintain our ISEAL Code Compliant Status according to their independent evaluation procedure.
  • Oversight Body – a qualified third-party to ensure GoodWeave follows its own policies and procedures that have been based on core elements of international standards for assurance providers, namely ISO 17065, highlighted above and ISO 19011, Guidance for Auditing Management Systems.[1] ​
➔    Electronics Watch, an industry-independent monitoring organization, trains local organizations and independent researchers as their compliance “monitoring partners” to “protect the rights of workers in global supply chains.”[2]

➔    While not a social certification, the Marine Stewardship Council’s General Certification Requirements includes an Impartiality Committee, which “conduct[s] a thorough and detailed review of the impartiality of the assessment, audit, certification, and decision-making processes.”[3]
[1] GoodWeave, GoodWeave Certification System Overview (April 2023), https://goodweave.org/wp-content/uploads/2023/05/Appendix-B-Certification-System-Overview-APRIL-2023.pdf.
[2] “Who We Are,” Electronics Watch, accessed March 14, 2024, https://electronicswatch.org/en/who-we-are_783.
[3] Marine Stewardship Council, MSC General Certification Requirements (May 2019), https://www.msc.org/docs/default-source/default-document-library/for-business/program-documents/general-certification-requirements/msc-general-certification-requirements-v2-4.pdf?sfvrsn=d1b5f2f_20.
Does the scheme have a credible firewall to insulate auditing from conflicts of interests?
❐  Yes 
❐  No
❐  Partially

A firewall can be created through, for example:
  • A dedicated independent body that conducts audits and investigates complaints for the scheme
  • ​An oversight mechanism that ensures the scheme follows its own policies and procedures
This project is a collaboration among the following organizations:
 This site is maintained by Rights CoLab. 
Copyright © 2024