A closed nonconformity that came back, and a closing meeting under commercial pressure
In the previous surveillance audit of a steel fabricator you raised a minor nonconformity against 8.4.1: three suppliers of welding consumables had no evidence of evaluation, selection or monitoring. The certification body accepted a corrective action pack and closed it on desktop review. Eleven months later, at the current surveillance audit, you sample 10 suppliers added since and find 5 with no evaluation; the purchaser says the new approved-supplier spreadsheet 'is not really used yet'. At the closing meeting the operations director calls the finding unfair, says 'the standard doesn't require a spreadsheet', refuses to sign the attendance sheet, and asks you to remove the finding because the company is bidding for a contract in three weeks and 'a major would kill us'.
1. How do you run the closing meeting when a finding is disputed, and what do you do about the unsigned attendance sheet?
Read the worked answer
The closing meeting presents findings and ensures they are understood; it is not a negotiation over whether the evidence exists. ISO 19011:2018 expects findings and conclusions to be presented so that the auditee understands them, and disagreement to be recorded.
Sequence:
- Restate the requirement and the evidence, not the solution: clause 8.4.1 requires criteria for evaluation, selection, monitoring of performance and re-evaluation. The spreadsheet is irrelevant - what is missing is any criteria and any records, for 5 of 10 sampled suppliers.
- Invite the auditee to provide evidence that contradicts the finding. If they can show evaluation records (emails, audit reports, certificates reviewed), verify them and revise the finding, recording why. If they cannot, the finding stands.
- Confirm understanding rather than agreement: 'Do you understand the finding and the evidence behind it?'
- Record the disagreement, the reason given, and any evidence offered, in the report. Tell them the route to challenge it - the certification body's appeals/complaints process.
On the signature: the attendance sheet records attendance, not acceptance. Note on the record that it was not signed and why (disagreement with findings), and have the other attendees sign. Do not let an unsigned sheet become a dispute about whether the meeting happened. Keep the tone factual and do not discuss the tender - commercial consequences are not audit criteria.
2. How should the previously closed nonconformity be treated now, and what are the consequences for the certificate?
Read the worked answer
The prior corrective action has demonstrably not been effective: the same requirement fails again, on a larger sample, eleven months after closure. Two things follow.
For the client: raise a nonconformity referencing both the current evidence and the earlier finding and CAPA reference, and assess the corrective action process itself under 10.2 (root cause analysis, action, effectiveness review). A recurrence of a previously closed finding, with a corrective action that was never implemented in practice, is normally a major - it shows the corrective action process is not effective, not just that one supplier list is out of date.
For the certification body: the desktop closure was evidently insufficient. Report it internally; the CB should review why closure was accepted without objective evidence of implementation and effectiveness, and consider on-site verification of the corrective action this time. This is a CB process issue and must not be presented to the client as the auditor's excuse.
Consequences: with a major nonconformity, certification cannot be maintained until correction and corrective action are implemented and verified. Typically the CB suspends the certificate for a defined period set by its procedure (ISO/IEC 17021-1 limits suspension to six months) and requires a follow-up audit within a shorter window; failure to resolve leads to withdrawal. The decision rests with the CB's decision-maker, not the auditor, and not with the client's tender timetable.
3. What goes into the audit report, and what do you tell the client about next steps and timelines?
Read the worked answer
Report content:
- objectives, scope, criteria, sites, dates, audit team, and the sampling basis (10 suppliers sampled, method, population);
- the finding with clause, requirement, objective evidence and grading, plus the link to the earlier closed nonconformity and its CAPA reference;
- any other findings and observations, kept clearly separate from nonconformities;
- a record of the disagreement raised at the closing meeting and the evidence offered;
- the statement on conformity, appropriately qualified, and the fact that the certification decision is made by the CB's decision-maker, not the audit team;
- next steps and deadlines per the CB's procedure (e.g. correction and root-cause analysis within a defined number of days, evidence of implementation, and an on-site or documented verification).
What to tell the client, factually:
- the finding is not removed by commercial timing; the tender deadline does not change the evidence;
- the fastest legitimate route is early submission of correction, root-cause analysis and objective evidence of implementation, and an early follow-up - the CB can usually schedule this well inside three weeks if the evidence is ready;
- they may use the CB's appeals process if they believe the evidence is wrong, and raising an appeal does not stop the corrective action clock;
- until verification, the certificate status is at risk and they must not represent themselves as certified for the affected scope if suspended.
Do not promise outcomes that belong to the decision-maker, and do not soften the finding to protect the relationship.