Closing a major nonconformity on emergency drills
A follow-up audit is being conducted at a facilities management company with three sites. The previous ISO 45001 audit raised a major nonconformity because no emergency drills had been conducted at any site for 18 months. The corrective action plan stated: conduct drills at all three sites by 30 June, revise the emergency preparedness procedure, and train all supervisors. The follow-up is on 15 September. Site A and Site B provide drill records with dates and attendance sheets. Site C's manager says a drill was held in July but the attendance sheet was lost and photos were on a phone that was replaced; he offers verbal confirmation from two cleaners. The procedure has been revised but is still marked 'draft' with no approval date. Training records show 85% of supervisors attended, with no effectiveness check. The auditor must decide whether the major nonconformity can be closed and what to report.
1. What evidence would you require to verify correction, root cause action and effectiveness for the emergency drill nonconformity?
Read the worked answer
I would separate correction, corrective action and effectiveness. Correction: were drills actually conducted at all three sites after the finding? I would require dated records, attendance, scenario, debrief and any actions. For Site C, verbal confirmation is weak; I would interview attendees separately, check other corroboration such as emails, calendar entries, training logs or maintenance records, and consider observing a drill if feasible. Corrective action: has the procedure been approved, communicated and implemented, not just drafted? I would check approval, version control and supervisor knowledge. Root cause: the original cause was not simply 'no drills'; I would check whether scheduling, ownership and review of emergency arrangements were fixed. Effectiveness: training attendance at 85% is an output, not evidence that supervisors can act. I would sample supervisors' understanding and check whether drills are now scheduled and reviewed.
2. Decide whether the major nonconformity should be closed, kept open, or re-raised, and explain the reasoning.
Read the worked answer
I would not close the major nonconformity on the current evidence. Sites A and B provide reasonable correction evidence, but Site C has no reliable record, and the procedure is still draft. A major nonconformity requires effective correction and corrective action across the scope; a plan or partial implementation is not enough. I would keep the finding open and report the remaining gap. If the evidence shows the organisation cannot demonstrate drills at Site C and has not approved the procedure, I would re-raise or maintain a major nonconformity, because the systemic control of emergency preparedness is still not effective. I would avoid closing on verbal assurance. If the only gap were a lost attendance sheet but other strong evidence confirmed the drill, I might treat it as a documentation weakness and verify correction, but the draft procedure still needs approval.
3. How would you sample across the three sites and document the follow-up conclusion?
Read the worked answer
I would sample all three sites because the original finding covered all sites, but vary depth by risk and evidence quality: records and interviews at A and B, and deeper verification at C. I would select supervisors and workers across shifts, not only managers. I would document the sampling rationale, the evidence reviewed, the interviews conducted and the limitations. The follow-up report should state clearly whether the major nonconformity is closed, open or re-raised, and the objective evidence for that decision. I would record the Site C uncertainty rather than resolve it by assumption, and set a date for re-verification if the finding remains open.