What an audit actually looks at

The situation

Retailers send inspectors into the factories that make their clothes. They do not come to look at the garments. They come to look at working hours, pay, safety, and who is on the premises. This lesson is what such a visit is made of. It is three kinds of evidence, and they are not equally reliable.

14 September, 07:10, Zohry Garments in Banha. Two auditors from Tessaro Assurance are at the gate.

The audit is semi-announced. That means the buyer named a four-week window in August but did not name a day. The buyer is Thurlbeck, a British high-street retailer Zohry has supplied for four years. Two auditors, two days, against Thurlbeck's own supplier code.

Zohry employs 420 people. Six sewing lines, 288 sewing operators, plus cutting, finishing, packing, quality, maintenance, stores and office.

On the floor is purchase order TB-77420: 42,000 men's cotton twill overshirts, style TB-529, FOB USD 7.85, order value USD 329,700, on board 3 November. Sewing started on 12 September, two days ago.

One thing before any of the arithmetic in this course. A finding about a blocked fire exit or an unpaid hour is a fact about a person's life before it is a fact about an order. Somebody worked those hours. Somebody would have had to use that exit. The commercial consequences here are real, and they are worth knowing precisely. But they come second. A merchandiser who never lets them come second will one day sign something they should not.

An audit has three legs, and they are not equal

Every social audit, under every code, is built from three sources.

Documents. Payroll and time records. Personnel files and contracts. Social-insurance receipts. The operating licence. Machine and boiler certificates. The chemical inventory. The grievance log. Training and drill registers. Age-verification records for the youngest workers on site.

The walk. The auditor goes through the building — production floors, stores, canteen, toilets, generator room, chemical store, the yard — and looks at what is physically there.

Worker interviews. Private conversations with workers the auditor chooses, away from managers.

The three are not equally reliable, and the order matters. The records are the weakest leg, because they are the only one you can prepare in advance. A wall can be repainted and an exit cleared the night before. But that takes work, and it usually shows. A time record can be swapped for a different file in four minutes.

This is not cynicism about factories. It is the reason auditors are trained to cross-check three sources rather than read one.

The four records that should agree

Tessaro's lead auditor asked for one ordinary week: 5 to 10 September, Saturday to Thursday, with Friday as the rest day. Here is what four separate records say about that week.

Read the second row against the first. The time record says 96 people worked two evenings. That is 192 evening meals. The canteen billed for 1,164.

Nobody falsified the canteen invoice. Nobody thinks of a canteen invoice as a compliance document. Nor the bus contract, signed in June by the factory manager for practical reasons, which describes a factory that finishes at half past nine at night six nights a week. Nor the output boards, which the supervisor fills in because the plan depends on them.

The document that catches a factory is almost never the document the factory prepared. It is the one written by somebody who was solving a different problem.

The walk

On the second morning the auditors walked the building from the roof down. Here is what they physically looked at. Every marked exit, and where the route from it ends. Aisle widths, and what is stacked in them. Extinguisher service dates, and whether you can reach the extinguisher. Electrical panels: closed, labelled, unobstructed. Needle guards and eye guards actually fitted on the machines that were running. The chemical store. Drinking water and toilets. First-aid boxes against their own checklists. The generator room. The boiler certificate, and the person operating it.

An experienced auditor is looking for one difference: between a factory that has been tidied for an audit and a factory that is run. An extinguisher serviced in August and then hung behind a stack of carton flats tells you the service happened and the system did not.

The drill that was true and proved nothing

Zohry's drill register showed an evacuation drill on 3 June at 11:00. It was genuine. It was properly timed at 4 minutes 10 seconds, the register was signed, and 214 people were in the building.

The finding was written anyway.

Zohry's peak headcount is 398, and it happens at 20:00, when the second shift in finishing overlaps the sewing lines' overtime. In the evening, exits 4 and 5 are behind finished-goods pallets. The pallets are staged in the corridor overnight and cleared by seven the next morning. Exit 4 opens onto the yard, and the yard's only gate to the street is chained after 18:00, because finished goods were stolen from it in March.

So the drill measured the evacuation of a little more than half the building, through routes that were all open, at an hour when they always are.

Nobody did anything wrong. Somebody scheduled a drill for a time that suited a drill, which is what everybody does. A safety record can be entirely true and prove nothing, and that is harder to spot than a false one. The rule that comes out of it: run the drill at the headcount you actually work, at the hour you actually work it, and write both numbers on the register.

The interviews

Forty-two workers were interviewed — 34 on their own and eight in two small groups. Four things about how that is done, and all four matter.

1. The auditor picks the sample, from the payroll list, not from a line a manager suggests. If the sample is offered to the auditor, it is not a sample.
2. In private, in the worker's own language, with no manager, supervisor or HR staff present, and none of them within earshot.
3. Mixed on purpose — by department, by gender, by length of service, by shift. It always includes anyone hired through a labour contractor rather than directly by the factory.
4. The interview tests the documents. It does not replace them. An auditor asks what time you left last Wednesday because a time record already answers that question.

Two duties sit on top of this, and they are not paperwork.

No worker may be identifiable from a finding. This is why a report says "several workers reported" instead of naming a line, a shift or a job. A finding written precisely enough to be traced back to one person has put that person at risk to make a report tidier.

Retaliation is itself a finding, and a serious one. A manager who spends the afternoon working out who was interviewed, and what they said, has committed a worse breach than most of what is in the report. If you are the merchandiser in the building when the auditor takes somebody off the line: you do nothing, you ask nothing afterwards, and you make sure the supervisor does not either.

Reading the report

A properly written finding has five parts: what was observed, the evidence for it, the clause of the code it breaches, its grade, and the date by which it must be closed. If any of the five is missing you cannot act on it. Ask for it before you sign anything.

Grades are not the same across the industry. Thurlbeck's report uses its own five bands. This is Thurlbeck's scheme, not a universal one. Other schemes differ: amfori BSCI, SMETA, WRAP and SA8000 each describe and rate findings in their own way. The same fact can appear under two different words in two reports. Read the code the report is written against, never the adjective.

Zohry's report came back with eleven findings and no zero-tolerance finding.

Read that list as a merchandiser rather than as a compliance officer, and one thing stands out. Ten of the eleven have a cause inside the building: a padlock, a fan, a cabinet, a box on a wall, a ballot, a filing routine.

The first one does not. Nobody at Zohry decided to work sixty-eight hours. That decision was made somewhere else, and lesson three is the arithmetic that shows where.

Act as a senior social compliance manager in an apparel factory. I have received a social audit report and must return a corrective action plan. Buyer [BUYER]. Audit firm [FIRM], dates [DATES], announced or semi-announced or unannounced: [WHICH]. The code it was audited against is [BUYER'S CODE / amfori BSCI / SMETA / WRAP / SA8000] and here are the relevant clauses: [PASTE OR SUMMARISE]. Here is the full finding list with the auditor's own wording, the evidence recorded and the grade given: [PASTE]. Our site facts: [HEADCOUNT], [NUMBER OF LINES], shift pattern [PATTERN], rest day [DAY], peak headcount and the hour it occurs [NUMBER AND TIME]. Do this. First, for each finding write a ROOT CAUSE that explains why it was true, not one that restates the finding — and say plainly when the cause sits outside this factory. Second, propose at least two actions for every finding, one that only removes the symptom and one that removes the reason, and price both as a one-off cost and an annual cost so I can choose with numbers. Third, name the type of person who should own each line and the calendar date it should carry, given the grade and its deadline. Fourth, state the CLOSING EVIDENCE you would accept, and explicitly rank it: tell me where a photograph is not enough and what document replaces it. Fifth, flag any finding that has appeared in a previous report — I will paste last year's list here: [PASTE] — and treat a repeat as a decision rather than a lapse. Finally, apply one test to every line: if the person who caused this finding left tomorrow, would the fix still hold? Name every line that fails that test.