Audit reporting, follow-up and closure of corrective actions
This domain tests whether you can produce a defensible report and understand follow-up as verification of effectiveness rather than verification of promises.
Report content (ISO 19011:2018, 6.5)
Include the audit objectives, scope (units, processes, locations, period), identification of the client, audit team and auditee participants, dates and locations, criteria, findings and their evidence, conclusions, the degree of fulfilment of the criteria, any deviations from the plan, and unresolved or diverging opinions. Recommendations, if within scope, are clearly separated from findings. The report is dated, reviewed, approved, issued within the agreed timeframe and distributed only to agreed recipients; it is confidential.
Follow-up and closure
For each nonconformity the auditee reacts (correction), evaluates the need for action (root cause), implements corrective action, and reviews effectiveness - ISO 14001 clause 10.2. Follow-up should verify both implementation and effectiveness, with evidence and a date. Closing on the basis of a corrective action plan alone is premature; closure requires evidence that the action was done and worked. Where immediate verification is impossible, define the method and timing.
Correction versus corrective action
Correction fixes the immediate problem (re-label the drum). Corrective action addresses the cause (revise the labelling process, train staff, add a check). Root cause analysis should be proportionate; "operator error" is rarely a root cause - ask why the system allowed the error.
Worked example
A nonconformity was raised because a pH meter used for permit monitoring had no calibration record for eight months. The auditee submits: meter calibrated on 3 March, a calibration schedule created, operators trained. Correction is done; the schedule and training address the cause. Closure decision: sample calibration records for the following quarter and interview one operator about the schedule. Three months of on-time calibration supports closure. A schedule with no completed entries means the action was not effective: keep the nonconformity open and escalate.
Traps
- Closing a nonconformity on documentary proof of a plan.
- Writing a report with findings but no conclusion.
- Omitting scope or criteria so the report cannot be interpreted later.
- Sending the report to unintended recipients, or circulating raw notes.
- Treating "no nonconformities" as "no findings" - conformity and good practice can be reported.