Please Close It, We Fixed It Last Tuesday
During a surveillance audit of a chemical distributor, you raise a major nonconformity against 8.2. The bund around the 30,000 litre caustic tank has a crack and no drill has been run for 26 months; separately, a new ammonia refrigeration plant was installed seven months ago and no assessment of emergency situations was done for it. Within 20 days the client submits a pack: photos and a contractor invoice showing the bund repaired, a drill held three days after the audit with an attendance sheet, retraining of four staff, and a root cause of 'operator oversight'. The client asks you to close the finding, downgrade it to minor because it was fixed quickly, and confirm that certification continues.
1. Evaluate the corrective action pack against 10.2. Is it acceptable for closure?
Read the worked answer
Distinguish correction from corrective action (10.2): repairing the bund and running a drill are corrections, plus partial containment. The standard requires the organisation to react, evaluate the need for action to eliminate the cause, implement it, review effectiveness, and update the EMS if necessary.
Gaps in the pack:
- 'Operator oversight' is not a cause. Interrogate the three distinct failures: why the inspection regime did not detect a crack in a bund; why no drill was scheduled or tracked for 26 months; why the management-of-change process did not route the new ammonia plant into 8.2 and 6.1.2. These usually resolve to no assigned owner, no schedule or trigger, and no verification of completion - which are system causes, not human ones.
- A drill held three days after the audit, while the audit was open, tests the organisation's reaction time, not whether a recurring programme now exists. Evidence of effectiveness is forward-looking: a schedule with named owners, completed inspections, and a second drill executed without the audit as the trigger.
- Nothing in the pack addresses the ammonia plant's emergency scenarios: dispersion, detection, isolation, muster, and liaison with the emergency services.
- Retraining four staff addresses awareness only, and only for those four.
Conclusion: do not close. Accept the corrections as evidence of containment, request a proper causal analysis and a systemic action plan, and state what verification will be required and when - typically document review plus on-site verification at the next scheduled audit, or an earlier special visit if the risk warrants it.
2. The client asks for the finding to be downgraded to minor because it was fixed quickly. How do you respond, and what governs that decision?
Read the worked answer
The grading rule belongs to the certification body, not to the negotiation. Grading reflects the nature of the failure at the time it was identified, not the speed of the fix. Speed of correction is a positive signal to record in the report but it does not retro-fit the finding.
Why this was major on the facts: a containment failure on 30,000 litres of caustic plus a seven-month-old unassessed ammonia installation means the organisation cannot currently demonstrate that it has determined potential emergency situations and planned its response (8.2). That is the absence of effective implementation of a required element, not a stray lapse.
How to handle the conversation:
- Explain the criteria and show how the evidence met them; do not present the grade as a preference.
- Make clear that closure of the finding and the certification decision are separate steps, and that you as auditor recommend; the decision is taken by the impartial decision-maker on the basis of your report and the corrective action evidence.
- If the client disputes the grade, point them to the CB's appeals and complaints process. Do not trade the grade against the closure decision.
- Record the client's request and your response in the audit file - it is part of the evidence of an impartial process.
3. What do you record, and what must the certification decision function know?
Read the worked answer
Record in the file:
- The original finding with evidence, the requirement cited, the grade and the grading rationale.
- The correction evidence received (invoice, photographs, drill record) and the date received, with your assessment of what each item does and does not demonstrate.
- The corrective action plan, your acceptance or rejection of the root cause, and the defined verification activity with dates and responsibility.
- The client's request to regrade and your response.
What the decision-maker needs to know:
- Whether the nonconformity is closed or still open, and if open, what interim containment is in place.
- The residual risk while it remains open: a caustic bund now repaired, but an unassessed ammonia system and no verified drill programme.
- Whether the organisation's own 9.3 management review has considered the finding, since a major nonconformity is exactly the input that should reach top management.
- The recommendation on continuation of certification, stated as a recommendation with reasons.
Do not write 'corrective action verified effective' on the strength of a three-day-old drill; use language that matches the evidence, such as 'correction verified; corrective action to be verified at the next audit'.