Audit Finds 37% of Changes Without Evidence
An internal audit covering ISO 9001 and a client-mandated data centre standard samples 240 changes raised in the past year. Eighty-nine (37%) have no evidence of authorisation, 31 have no post-implementation review, and 14 were emergency changes that were never retrospectively approved. The risk register was last reviewed eleven months ago and four risks have passed their review dates. Twenty-two of 130 controlled documents are past their review date, including the electrical switching procedure. An 800 kW chiller replacement was completed eight months ago without any management-of-change record; consequently the electrical single-line diagram, the load schedule and two arc-flash labels no longer reflect the installed configuration. One subcontractor working under the maintenance contract has no current insurance certificate on file. The client requires a closure plan within 90 days with evidence per finding.
1. Rank the findings by risk and justify the sequence, distinguishing what must be corrected immediately from what can be corrected within 90 days.
Read the worked answer
Separate configuration-integrity risk from documentation hygiene. The client will present this as one list; it is not. The highest-consequence finding is the undocumented chiller replacement, because the single-line diagram, load schedule and arc-flash labels are the documents people use to make safety decisions under time pressure. A wrong single-line diagram is an electrocution and arc-flash exposure; a missing post-implementation review is an improvement opportunity.
Sequence.
- Immediate (days): physical verification walkdown of the installed configuration against the single-line diagram and load schedule; re-issue corrected drawings, update arc-flash labels and label the equipment as verified with a date and a name. Suspend work on the affected equipment until the drawings are confirmed, or impose a permit condition that requires physical verification at the point of work. Also obtain the subcontractor's insurance certificate or remove the subcontractor from site today.
- Within 30 days: retrospective approval of the 14 emergency changes with a documented rationale, and a decision on any that would not have been approved. Risk register review with owners and dates, including a new entry for the configuration discrepancy and the subcontractor exposure.
- Within 60 days: the electrical switching procedure re-reviewed and re-approved by a competent person before any further switching; then the remaining overdue documents triaged by criticality rather than by date.
- Within 90 days: change-process redesign with sampling-based assurance, and the evidence pack for the client.
The judgement. Do not lead with the 37% figure because it is the largest number. Lead with the finding that can injure somebody. Auditors and clients both respect a risk-based sequence; they distrust a plan sorted by count.
2. What process changes and ongoing measures would prevent recurrence, and how do you demonstrate closure to the client without overclaiming?
Read the worked answer
Fix the process at the point where it failed. 37% missing authorisation is not 89 individual lapses; it is a system that permits a change to be closed without an approval record. Make the approval a mandatory gate in the tooling - a change cannot move to implementation without a named approver and a date, and cannot be closed without a post-implementation review or a documented reason for waiving one. Emergency changes get a standing 5-working-day retrospective approval clock with automatic escalation. Any change touching the electrical distribution, cooling topology or fire systems must trigger a management-of-change record that names the documents to be updated and the person responsible for updating them; closure requires evidence of the updated drawing.
Document control. Move from calendar-based review of all 130 documents to risk-tiered review: safety-critical and switching documents annually and after any change, the remainder on a longer cycle. Add a document-impact field to the change record so that the single-line diagram cannot silently drift again.
Measures. Percentage of changes with approval evidence at time of implementation (target 100%); emergency changes retrospectively approved within 5 days; overdue safety-critical documents (target zero); configuration discrepancies found per walkdown; risk register items past review date; subcontractor compliance evidence current. Sample monthly and report the sample size with the result.
Demonstrating closure honestly. Provide, per finding, the root cause, the action taken, the evidence artefact (document reference, screenshot, signed record) and the date. Where an action is not complete, say so and give the date. Never present a revised procedure as proof that behaviour changed - the client's auditor will test a sample, and an overclaimed closure is worse than an openly tracked open item.