Closing an ISO 22000 audit
What the domain tests
Domain 6 tests closing an audit: the closing meeting, findings and conclusions, the audit report, follow-up and the boundary between audit and certification decision.
Core rules
- Prepare conclusions from all findings and the audit objectives. The closing meeting presents findings, conclusions and recommendations, and gives the auditee a chance to clarify factual accuracy.
- Explain nonconformities clearly, including grade under the applicable scheme. Do not promise certification, and do not consult on how to fix the problem.
- The audit report records objectives, scope, criteria, team, dates, sites, findings, conclusions and any limitations. It is a factual record, not a marketing document.
- Follow-up verifies corrective action and its effectiveness; it does not re-audit the whole system unless the scheme requires it.
- In third-party certification, the audit team's conclusion is an input; the certification decision is made by the certification body's competent decision-maker, independent of the team.
- Respect confidentiality and retain records according to the programme.
Worked example
An auditor finds a major nonconformity: the recall procedure has never been tested and contact details are outdated. At the closing meeting the auditor presents the evidence and the requirement, states the conclusion that the FSMS is not fully effective in emergency preparedness, and explains the scheme's follow-up process. The auditor does not say you will fail certification. The certification decision body later decides the outcome based on the report and corrective action.
Traps
Using the closing meeting to introduce new findings not previously discussed; promising a certificate; writing recommendations as requirements; failing to record dissenting views; and treating the audit report as the certification decision.