"One clause, we'll fix it in a week"
At the closing meeting of a surveillance audit at a chemical distribution site, the lead auditor issues one major nonconformity: the site has not evaluated its compliance with a new national chemical storage regulation in force for five months, and 3 of 20 sampled safety data sheets are out of date. The site manager disputes the major: "it's one clause, we'll fix it in a week", and asks the auditor not to raise it because a tender closes in six weeks and the certificate is a condition of bidding. The certification body's procedure permits verification of major nonconformity closure by desk review within 90 days. At the previous audit a minor nonconformity on management review was closed by desk review, with no sampling evidence submitted.
1. Justify the major classification, and explain the reasoning you would use to test whether minor might be defensible.
Read the worked answer
The classification test. A major nonconformity is not "a big clause". It is one where a required element of the management system is absent or not implemented, where the failure is systemic, or where there is significant doubt that the system will deliver its intended outcomes - including meeting compliance obligations. A minor is an isolated lapse within a system that otherwise functions.
Why this is major on the facts:
- 9.1.2 requires a process to evaluate fulfilment of compliance obligations, to maintain knowledge and understanding of compliance status, and to retain evidence. A new regulation in force for five months with no evaluation at all means the process failed to detect a change in compliance obligations (6.1.3) and did not evaluate. That is the absence of an output the process exists to produce, not a missing signature.
- 3/20 out-of-date SDS (15% of sample) points to the same root cause: the organisation is not tracking changes in its legal and hazard information. It is corroborating evidence, not an unrelated clerical error.
- Consequence: an unevaluated storage regulation at a chemical distributor is a live safety and environmental risk.
Testing the minor argument honestly: if the sample had shown one outdated SDS, and the compliance evaluation schedule existed and was current for every other obligation with this one regulation simply missed in a recent update cycle, minor would be arguable. That is not this case. Extending the sample is the right response before finalising either way - but the auditor should not be talked out of a classification by a deadline.
2. How do you handle the manager's request at the closing meeting, and what does the audit team leader personally record?
Read the worked answer
Principles first (19011 clause 4): integrity, fair presentation, due professional care, independence, evidence-based approach. The tender deadline is irrelevant to the finding; the finding must be reported accurately and without being coloured by its commercial consequences.
In the meeting:
- Restate the finding, the requirement and the evidence, factually and without blame.
- Explain the effect - the certificate's standing depends on the CB's decision, and concealing a major would misrepresent the site's compliance status to the tender authority and to other interested parties.
- Clarify roles: the auditor reports; the certification body decides. The auditor has no authority to withdraw a finding for commercial reasons, and offering to do so would be a breach of integrity.
- Do not accept "we'll fix it in a week" as closure. Corrective action must address why the change in legal obligations was not detected.
- Confirm the client's right to comment on the finding and to have its disagreement recorded; note the disagreement in the report rather than arguing it away.
What the lead auditor records: the finding with evidence and sampling basis; the client's response and any disagreement; the classification and its rationale; the required closure evidence; and any escalation (e.g. a request to suppress a finding) to the CB's technical/competence function. If pressure continues, it goes in writing to the certification body, not into a private accommodation.
3. The CB proposes to verify closure by desk review within 90 days. What should be required, and when is desk review not acceptable? Consider also how this affects the next audit.
Read the worked answer
What closure actually requires. Two distinct things: correction (evaluate compliance against the new regulation; update the SDS files) and corrective action (root cause analysis of why a five-month-old legal change went undetected, and a change to the legal-update/legal-register process). Verification of the first without the second is not closure of a major.
Desk review is acceptable only if the evidence is objective and complete:
- the signed compliance evaluation covering every requirement of the new regulation, not a summary assertion;
- the revised legal register with the regulation entered, dated, with responsibility assigned;
- updated SDS files with the checking method and the remaining population checked (not only the 3 sampled);
- documented root cause and the action taken, with evidence the process change operates (e.g. a subsequent legal update actually processed, with a trigger and review interval).
When desk review is not acceptable: if the submission is assertion rather than evidence (as at the previous audit); if the correction must be verified physically (storage arrangements, segregation, secondary containment, signage - the auditor has not seen whether physical compliance exists, only that no evaluation was done); or if sampling is needed to confirm the 15% failure rate is not systemic. On these facts, at least a partial on-site verification of physical storage compliance should be planned.
Effect on the programme. The 90-day window does not reset the audit cycle: the next surveillance audit must sample this regulation and the legal-update process again, verify effectiveness rather than closure, and the audit time should be increased to allow it. If the major is not closed within the CB's defined period, the certification status must be addressed under ISO/IEC 17021-1 (suspension of the certificate), not extended informally. The prior audit's paper-only closure should also be flagged as a CB process weakness for programme review.