Audit Follow-up, Corrective Action and Continual Improvement
Domain 5 tests closure discipline. The exam checks whether you distinguish correction from corrective action, verify effectiveness, and feed results back into the programme.
Correction, corrective action, preventive action
Correction fixes the immediate issue - for example, running the missed generator test. Corrective action removes the root cause so it does not recur - for example, assigning a maintenance owner and deputy and adding automatic escalation in the CMMS. Preventive action addresses a potential issue that has not yet occurred. Root-cause methods include 5 Whys and cause-and-effect analysis; do not accept “human error” as a root cause without asking why the system allowed it.
Verification and closure
Verify implementation first: was the action actually done? Then verify effectiveness: did it prevent recurrence? Use records, observation and a follow-up sample. Close only after the effectiveness check. Track actions in a register with owner, due date, status and escalation for overdue items. A promised action is not a closed finding.
Continual improvement
Use finding trends, repeated root causes, incident data and management review to update the audit programme, design standards, training and maintenance routines. This is the Plan–Do–Check–Act loop applied to the audit system itself. Follow-up may be a separate audit or a defined verification activity.
Worked example
A finding states that the generator load test was not performed for 14 months. Correction: perform the test now. Root cause: the maintenance-calendar owner left and no deputy was assigned. Corrective action: assign an owner and deputy and add the test to the CMMS with automatic escalation. Verification: check the CMMS entry and the next test date. Effectiveness: review two consecutive quarterly test records. Close after the second on-time test. Closing after the first test only treats the symptom and leaves recurrence likely.
Traps that cost marks
- Closing a finding when the action is merely planned.
- Accepting “retrain staff” as the sole action without verifying competence or system change.
- Fixing the symptom and calling it root cause.
- Skipping the effectiveness check.
- Treating follow-up as optional.
- Failing to feed repeated findings into the risk assessment and audit programme.