Closing a major nonconformity that is correction without corrective action
Following a stage 2 audit of a 300-person insurance company, the auditor raised one major nonconformity: "There is no evidence that business continuity plans were exercised at planned intervals. The most recent exercise was 30 months ago, contrary to clause 8.5 and to procedure BCM-P-04, which requires an annual exercise." Certification was withheld pending correction and corrective action. Thirty days later the client submits: procedure BCM-P-04 revised to version 3; a tabletop exercise held for 12 participants, evidenced by an attendance sheet and photographs; a statement that the exercise report is "being finalised"; a root cause recorded as "staff turnover"; no analysis of whether other plans, sites or suppliers share the same cause; and no defined effectiveness check. The CB's procedure allows a major nonconformity to be downgraded to minor where correction is verified and the corrective action is judged likely to be effective, with verification at the next surveillance audit. The certificate expiry date is three weeks away.
1. Assess the submission against clause 10.1. Is correction, root cause analysis, corrective action and effectiveness review adequate?
Read the worked answer
Test the submission as a logical chain, not as a pile of documents.
- Correction - react and control: an exercise was held, so something happened. But a report still "being finalised" means the organization cannot show what was learned, what failed, or what it decided to change. An exercise with no evaluation is an event, not a control. An attendance sheet and photographs prove occurrence, not effectiveness - they are the easiest evidence to produce and the weakest to rely on.
- Root cause: "staff turnover" is a condition, not a cause. The real question is why an annual commitment did not survive a personnel change - no named owner, no scheduled date in the BC calendar, no escalation when the date passed, no competence backup. An action built on "staff turnover" will not prevent recurrence, because turnover recurs.
- Extent of condition: the auditor must ask whether plans at other sites, and plans depending on the same staff and suppliers, also went unexercised. The submission does not consider this at all.
- Effectiveness review: nothing states how the organization will know the action worked - for example, exercises completed against the annual plan for two consecutive cycles, with findings tracked to closure.
On that evidence the corrective action is not acceptable and the major nonconformity remains open.
2. Do you close, downgrade or keep it open, and what verification would you perform before the certification decision is taken?
Read the worked answer
Keep it open. Downgrading is a recommendation to the certification decision-maker, not a courtesy to protect an expiry date, and it requires two things: verified correction and a corrective action judged likely to be effective. Neither is present - the exercise report is unfinished, the root cause is not a cause, and the extent of condition is unknown.
Verification plan:
- Review the completed exercise report: scenario, objectives, participants, observations, and actions with named owners and dates.
- Interview two or three of the twelve participants separately and ask what they observed and what changed afterwards; compare with the report.
- Obtain evidence that the next exercise is scheduled, resourced and owned - a calendar entry with a name against it.
- Confirm version 3 of BCM-P-04 was communicated, and that the change is reflected in the risk assessment and in the next management review agenda.
- Do the document and interview work remotely, then verify on site at the next scheduled activity.
For the three-week expiry, state in writing what is missing, what would close it and a realistic timeline, and let the decision-maker choose between extended verification and withholding certification. The auditor's job is to make that decision defensible, not to make the date.