My question is - what was this audit organization doing?
In the bizjet world there is a standard operating model called IS-BAO (International Standards for Business Aircraft Operations) which is in turn is based on ICAO SARPS.
IS-BAO is really a set of best practices. E.g., among others, IS-BAO requires that an SMS is established; that a formal training program must exist; and more relevant to this accident, that SOPs and checklists are to be followed.
There are different stages (levels) to an IS-BAO audit, but basically the audit is primarily a document checking exercise.
E.g., on the use of checklists, the auditor might see that: 1) the company's FOM requires use of checklists; 2) current and correct checklists are onboard the aircraft; and 3) that the company pilots must take recurrent (annual) proficiency training at Flight Safety including proper use of checklists.
Based on
documentation of those three things, the auditor then passes the checklist requirement.
But what the auditor has
not done is to personally fly with the pilots to see if they actually use checklists, since in-flight inspection is not required for an IS-BAO audit. Nor has the auditor gone through the FOQA data him/herself to see if there's evidence that checklist items are being missed.
These are things which are expected to be done by the flight department internally. But one problem with small ops is the lack of segregation of duties. It's difficult to police yourself.