Closing an ISO 22301 Audit
Domain 6 tests how findings become conclusions: closing meeting, report, nonconformity classification and follow-up, within ISO 19011 and certification-body expectations.
Closing sequence
- Consolidate findings; verify each has a requirement, evidence and significance.
- Hold the closing meeting with auditee management: restate scope and criteria, present findings, conclusions and any limitations; agree factual accuracy, not necessarily the classification.
- Issue the audit report: objectives, scope, criteria, dates, team, findings, conclusions, good practices, distribution and confidentiality.
- Classify nonconformities consistently: major for system failure or significant risk, minor for an isolated lapse; record the rationale.
- Agree correction and corrective-action timelines; follow up to verify effectiveness, not just promised action.
Worked example
At the closing meeting, a site manager disputes a major nonconformity for an untested plan. The auditor restates the clause (8.5 exercise programme), the evidence (no exercise records for 18 months) and the risk (critical activity with an MTPD of 24 hours). The classification stands; the manager agrees a 30-day corrective-action plan. Reasoning: disagreement about facts must be resolved; disagreement about classification can be escalated through the appeals process.
Traps
Springing findings at the closing meeting; downgrading a major nonconformity to avoid conflict; omitting audit limitations; promising certification; failing to record the auditee's response.