Audit Reporting, Corrective Action, and Follow-up
This domain tests the output of the audit: findings written so they are defensible, graded consistently, and closed only when the underlying cause is fixed and verified. Expect scenario items on nonconformity wording and on when a corrective action can be closed.
Anatomy of a finding
A well-written nonconformity has three parts: the requirement (the clause, regulation, or procedure and what it demands), the objective evidence (what was observed or read, with dates, lots, record numbers, and how many of how many), and the significance (why it matters - product risk, system weakness). Write facts, not opinions, and do not prescribe the solution in the finding; the auditee owns the fix.
Grading should follow the scheme or programme definitions consistently: critical (direct risk to product safety or legality, often requiring immediate action and certification consequence), major (system breakdown or significant gap), minor (isolated lapse), observation or opportunity for improvement.
Closing meeting and report
The closing meeting presents findings and grades as understood at the time, allows factual correction, and sets timelines. The report records objectives, scope, criteria, dates, team, sites, sampling, findings, conclusions, and distribution, and it is confidential to the client.
Corrective action and follow-up
Distinguish correction (fix the batch), root cause (why it happened), corrective action (remove the cause), and verification of effectiveness (evidence it has not recurred, over time). Follow-up may be a desk review of evidence or an on-site revisit, depending on severity and scheme rules. Escalate when deadlines pass or evidence is weak.
Worked example
Finding as drafted: "Sanitation is inadequate." Rewritten: "Requirement: procedure SS-04 requires quaternary ammonium sanitizer at 200 ppm at the filler. Evidence: on 3 of 5 observations on 12 June, the measured concentration was 50 ppm while the log recorded 200 ppm. Significance: food-contact surfaces were not sanitized as specified, and the log is inaccurate." Reasoning: the rewrite is verifiable, bounded, and cites a criterion; it also exposes a record-integrity issue that the root cause must address. Accepting "retrained staff" as closure, without titration checks, would be premature.
Traps that cost marks
- Packing two nonconformities into one statement.
- Closing a finding when the correction is done but effectiveness is unverified.
- Using opinions or blame language.
- Prescribing the auditee's corrective action in the report.
- Overdue follow-up left open without escalation.