Audit reporting and closure
Reporting
The audit report is a factual record for the audit client and interested parties. ISO 19011 expects objectives, scope, criteria, dates, locations, team, findings, conclusions and any agreed follow-up. Findings should be traceable to evidence and criteria. Conclusions address whether the ISMS conforms and is effective within the audit scope; they are not a certification decision unless the audit is a certification audit.
Core rules
- Issue findings promptly and give the auditee a chance to correct factual errors, not to negotiate away nonconformities.
- Distinguish correction (fix the immediate issue) from corrective action (remove the cause so it does not recur).
- Require root-cause analysis proportionate to the finding, an action plan, an owner and a due date.
- Verify implementation and effectiveness before closure. Evidence may include records, samples, interviews or a follow-up audit.
- Retain audit records and respect confidentiality and data protection.
- Feed results into management review and the audit programme.
Worked example
An access-review nonconformity is raised. The organisation submits a new procedure and says reviews will now happen. That is a correction plan, not closure evidence. Closure requires evidence that the revised process operated: completed reviews for the next two quarters, a sample showing removal of leaver access, and confirmation that the owner monitored completion. Only then can the auditor verify effectiveness and close the finding.
Traps
Do not close a finding on a promise, a policy revision alone, or a single fixed instance. Do not confuse correction with corrective action. Do not put confidential evidence or personal opinions in a widely distributed report. Do not let the report become a consultancy proposal.