Audit Nonconformity Under Sponsor Pressure: Missing Peer-Review Records
During an internal audit of your peer-review process, you sample 25 of the 180 high-risk (Class C) work items completed last quarter. Seven have no review record in the ALM tool. The process owner explains that the reviews did happen, that the ALM tool's integration failed during a two-week server migration, and that four of the seven are documented in a team lead's personal notebook. In two other sampled items, the only recorded reviewer is the item's author. Procedure PR-07 requires (a) a retained review record for every Class C item, (b) at least two reviewers, and (c) that the author not be a sole reviewer. The audit sponsor, the development director, asks you to record all of this as an 'observation' because the root cause is 'a tooling issue' and a nonconformity would affect his organization's bonus metric. You are the lead auditor; your quality organization reports to the same director.
1. Classify the findings and justify the classification with the evidence available, stating what additional evidence would change it.
Read the worked answer
There are two distinct findings, not one. They have different causes and different risk, and merging them under 'tooling' would hide the more serious one.
Finding 1 - records not retained, contrary to PR-07(a). Incidence is 7 of 25, or 28%. Projected across 180 Class C items that is roughly 50 items with no retrievable evidence of review. This is systemic, not a one-off: it affects a whole population and spans a two-week window plus an unknown period after. Personal notebook entries do not satisfy 'retained record' - they are uncontrolled, undated by an authoritative system, unbacked-up, not retrievable after the person leaves, and not linkable to the work item. Treat as a major nonconformity on record control as well as on review evidence.
Finding 2 - reviewer independence, contrary to PR-07(b) and (c). Incidence is 2 of 25 (8%); lower frequency, higher consequence. A review by the author alone defeats the control's entire purpose, because it removes the independent detection that peer review exists to provide. Frequency alone must not drive severity here.
Evidence that would change the picture: a fully reconstructed, verifiable, system-of-record trail for the seven items; a documented, formally approved alternative record location during the outage; or a sampling error (for example, items actually below the Class C threshold). A tool outage is a root-cause explanation, not an exemption - procedures generally bind regardless of tool state, unless they explicitly authorize an alternative.
2. Distinguish the correction from the corrective action for each finding and outline the verification of effectiveness.
Read the worked answer
Correction fixes the instances; corrective action removes the cause and must be verified separately.
Corrections (immediate, within days):
- Inventory all 180 Class C items from last quarter, not just the sample, and identify every item lacking a conforming record.
- For items with genuinely missing evidence, re-review rather than reconstruct from memory; a reconstructed record asserting that a review occurred is not the same as a review.
- Re-review the two items whose only reviewer was the author, with two independent reviewers.
- Transcribe notebook entries into the controlled system only with dates, attendees and evidence of what was actually examined.
Corrective actions (root cause):
- Finding 1: the migration plan lacked a post-migration data-integrity reconciliation and had no manual fallback. Add an automated record-count reconciliation and alerting after any integration change, define a controlled manual fallback in PR-07, and explicitly prohibit personal notes as a record of review.
- Finding 2: the independence rule is either unknown or unenforced. Add a tool rule that rejects the author as sole approver, make independence a mandatory checklist item, and have reviewers confirm they did not author the item.
Verification of effectiveness is not 'training delivered'. Sample 25 Class C items each month for two quarters against PR-07(a)-(c), track the nonconformity rate toward zero, and confirm the reconciliation alert fires in a controlled test failover.
3. How do you handle the sponsor's request to downgrade the findings, given your reporting line?
Read the worked answer
The classification follows the evidence. The request is documented and escalated; it does not change the conclusion.
Immediate handling:
- Meet the director, restate the objective evidence (7/25 and 2/25, with the procedure clauses), and record the request and the response in the audit file. Do not characterize it as interference; characterize it as a management response to a draft finding.
- Invite contrary objective evidence. If the director can show a conforming record for the seven items, or that the two independence cases were actually reviewed by others, the finding changes on the evidence - that is a legitimate path to downgrading.
- Confirm in writing that the request to reclassify is based on the bonus metric, which is not a valid audit criterion, and that you cannot use it.
Independence. Your quality organization reports to the sponsor. That is a structural objectivity threat the audit program itself should record. Escalate the unresolved disagreement to the audit function's owner or the next level above the director (audit committee or equivalent), and disclose the reporting-line conflict in the report so readers can weigh it.
Why not comply. An 'observation' framing would suppress the population-wide record gap and the independence failure from the corrective-action process, so the cause would persist into the next release and the next audit. If the director believes the classification is wrong, the legitimate remedy is a documented appeal with evidence to the audit program owner - not a quiet relabeling.