Repeat findings and a training-only corrective action
Ten months ago an internal audit issued 14 findings, including missing cable labels and uncontrolled cabinet power changes. The corrective action plan was 'retrain technicians' and 'send reminder emails'. The follow-up audit finds labelling correct in two of five halls, with the other three still using handwritten paper labels. Change control is still bypassed: 9 of 20 emergency work orders in the last quarter changed cabinet power without a change record. A new finding is that UPS firmware versions differ across the three UPS modules, and no firmware baseline exists. The operations director says the CAPA is 'closed because training was completed'. You are preparing the follow-up report for the audit committee.
1. Evaluate the adequacy of the corrective action plan and the operations director's closure rationale.
Read the worked answer
The corrective action plan does not address root cause. Retraining and reminder emails address awareness, but the repeat findings suggest the problem is systemic: there may be no labelling standard, no acceptance check at installation, no enforcement in change control, and no easy way to raise a change request during emergency work. Training alone cannot fix a process that allows or encourages bypass. The fact that labelling improved in two halls and not three also suggests inconsistent local practice, not a single knowledge gap.
The operations director is confusing implementation with effectiveness. Completing training is an output; it does not prove that labels are correct or that cabinet power changes are controlled. Closure should require evidence that the corrective action was implemented and that it prevented recurrence. A 9-out-of-20 bypass rate in the last quarter is strong evidence that the change-control corrective action is not effective. The new firmware inconsistency finding points to a wider configuration-management weakness, which should be linked to the same root-cause analysis rather than treated as an isolated issue.
I would reopen or escalate the CAPA, require a root-cause analysis (for example 5 Whys or fishbone), and define actions that change the system: a labelling standard with acceptance criteria, a change-control tool that works for emergency work, and a firmware baseline with version control.
2. Design the follow-up and effectiveness verification. What would you sample, over what period, and when would you close the findings?
Read the worked answer
The follow-up should have two stages. First, verify implementation: confirm that a labelling standard exists, that all five halls have been relabelled to it, and that the change-control procedure and tool have been updated. Sample labels across all halls and racks, not just the two that improved. For change control, select a sample of emergency and normal work orders from the last quarter and trace each to a change record, approval and post-implementation review.
Second, verify effectiveness over time. For labelling, sample at least 100 labels or 10% of racks across all halls, including moves, adds and changes completed after the new standard. For change control, sample 20-30 work orders over at least three months, including emergency work, and calculate compliance. For firmware, verify that a baseline exists, that all UPS modules are on an approved version or have an approved exception, and that the change process covers firmware updates.
Closure should not be based on a single clean sample. I would require sustained evidence over a defined period, such as three consecutive months of change-control compliance above an agreed threshold and a labelling sample with no significant defects. The audit committee should see the repeat-finding trend, the root-cause analysis, the revised actions, owners and dates. If the next sample still fails, escalate the finding and consider a focused audit of the change-management process.
3. What continual-improvement actions would you recommend to prevent recurrence across the estate?
Read the worked answer
The repeat findings indicate that corrective action is being handled as isolated fixes rather than as learning. I would recommend integrating the findings into the risk register and management review, with owners at estate level rather than site level. The organisation should track a small set of leading and lagging indicators: label accuracy from sample checks, percentage of cabinet power changes with a change record, emergency-work-order rate, firmware baseline compliance, and repeat-finding rate. These should be reviewed monthly by operations and quarterly by the audit committee.
The change-control process needs to be redesigned for reality. If emergency work is common, the process should include a fast-track route with retrospective approval and mandatory records, not an exemption that encourages bypass. Cabinet power changes should require a checklist that includes labelling and firmware/configuration checks. The labelling standard should be part of project handover and installation acceptance, so new work does not recreate the defect.
For configuration management, establish a firmware baseline for UPS and other critical systems, with version control, tested update procedures and exception approval. Training should be competency-checked, not just delivered, and should be combined with supervision and audit sampling. Finally, the audit programme should follow up repeat findings within six months and report trend data to the audit committee, so that a training-only CAPA is challenged before it is closed.