Granting access based on an entity reference field using rules
This should do the trick for you. You only have to write the code for extract_uid_from_audit(); if you don't know how we can help as well.

function mymodule_node_access($node, $op, $account) {
    if(!empty($node-&gt;type) &amp;&amp; ($node-&gt;type == "non_conformance")
             &amp;&amp; $op=='update') ){
        $uid = extract_uid_from_audit($node);
        if($uid = $account-&gt;uid)
             return NODE_ACCESS_ALLOW;
    }
}