Follow-up and Corrective Action
Follow-up verifies that corrective actions were implemented and effective. Understand the sequence: finding → correction (contain the issue) → root cause analysis → corrective action (address the cause) → implementation → verification of effectiveness → closure. The auditor's role is to verify, not to design or approve the action; the auditee owns the action.
Know what good verification looks like: checking implementation evidence, testing whether the problem recurs, and confirming that the action addressed the cause rather than the symptom. Timelines should be agreed and tracked. Repeat findings signal weak root cause analysis and should escalate in significance or attention. Follow-up may be desk-based (evidence review) or on-site, depending on risk.
Traps: accepting a stated action without evidence; confusing correction with corrective action; closing findings based on a promise or a procedure revision alone; failing to check effectiveness over time; and treating follow-up as optional. Also watch for questions where the auditor is asked to choose the corrective action - that is the auditee's responsibility.
Worked example: A spill occurred because a drum was unlabeled. Correction: label the drum. Root cause: labeling step missing from the receiving procedure. Corrective action: revise the procedure and train staff. Verification: sample drums over the next quarter and confirm labeling compliance. Rule of thumb: If the same finding appears twice, the root cause work was inadequate.
Auditor Ethics, Professional Conduct, and Competence
This domain covers the integrity, impartiality, and competence expected of auditors. Core principles: integrity, objectivity, confidentiality, professional competence and due care, and professional behavior. Understand impartiality - auditors must not audit their own work, must declare conflicts of interest, and must resist pressure from auditees or management. Independence in appearance matters as much as in fact.
Competence includes EMS knowledge, regulatory understanding, audit techniques, and sector-specific expertise, maintained through training and experience. Auditors should acknowledge the limits of their competence and seek resources when needed. Professional conduct covers respectful communication, confidentiality of information, evidence-based judgment, and honesty about uncertainty and sampling limitations.
Traps: accepting gifts or hospitality that could compromise judgment; auditing a process the auditor previously managed; allowing management to influence findings; disclosing confidential auditee information; overstating competence; and confusing confidence with competence. Watch for questions where the "right" answer is to decline an assignment or declare a conflict - that is often correct.
Rule of thumb: Ask "would an independent observer see this as impartial and evidence-based?" If not, disclose or step aside.