Audit follow-up, corrective action verification and closing the audit
This domain tests what happens after the closing meeting: whether corrections and corrective actions are real, whether effectiveness is verified, and how the audit is formally closed and the programme improved.
Core rules and concepts
- Separate correction (fix the instance), containment (stop the effect spreading) and corrective action (remove the cause). Auditors verify actions; they do not design them.
- Root cause: the auditee's analysis should reach system causes - missing process, unclear responsibility, no change control, no competence - not 'worker error'. If the proposal is 'retrain the operators', ask what in the system allowed the condition and whether recurrence is prevented.
- Two verifications: implementation (evidence the action was carried out) and effectiveness (evidence the condition has not recurred). Records prove implementation; sampling the same area, the next shift or the next project proves effectiveness.
- Timelines: certification bodies set a defined period for major nonconformity correction and corrective action (commonly up to 30 days) and verify before granting certification; minor nonconformities are usually verified at the next surveillance. Escalate when actions are not closed.
- Closing meeting: state conclusions, agree responsible persons and dates, and record disagreements. The report goes to the client, and confidentiality governs further distribution.
- Programme feedback: findings, complaints, changes and audit effectiveness feed the next risk-based programme and plan.
Worked example
A minor nonconformity: two new machines were commissioned without risk assessment. The first proposed corrective action, 'toolbox talk delivered to fitters', is rejected because it addresses the symptom. The auditee's revised analysis identifies that the capital purchase process had no OH&S trigger. Its new gate requiring a risk assessment before commissioning is accepted, and effectiveness is verified by sampling the next two installations rather than by reading the procedure.
Traps that cost marks
- Closing a nonconformity on submission of a procedure rather than on evidence.
- Accepting retraining as a root cause.
- Verifying the correction and calling it effectiveness.
- Letting an open major nonconformity drift to the next surveillance.