Closing the Major: A Photo, a Procedure, and Two of Four Staff
It is the final day of a certification audit at a 300-person payment processor. The team raised one major nonconformity (restore testing not performed for 14 months against the organization's quarterly requirement) and five minor nonconformities. At the closing meeting the audit team leader states the recommendation is "not recommended for certification until the major is closed". The CEO signs the report but disputes the major, calling it "a documentation issue". Six weeks later the auditee submits: a photograph of a completed restore test, a revised backup procedure, and a record of a one-hour briefing attended by two of the four IT staff. The certification body's procedure requires correction and corrective action for a major to be completed and verified within 90 days of the closing meeting.
1. Is the submitted evidence sufficient to close the major? Justify your answer element by element.
Read the worked answer
No. Each element answers a different question, and three of the four required questions are unanswered.
- Photograph of a restore test: shows that something was done, not that the requirement was met. No evidence of what was restored, whether the restored database was complete and consistent, who verified it, or whether the result was recorded per the procedure. Unverifiable evidence is weak evidence.
- Revised procedure: a correction of documentation. It does not show the revised procedure is being followed.
- Briefing attended by two of four staff: partial implementation, and training is a correction activity, not a corrective action - it does not show the failure will not recur.
What is missing is the causal layer: why the test was skipped for 14 months, and why nothing detected the omission. A credible submission would include root-cause analysis, an owned schedule with evidence of at least one full cycle executed and verified, a detection mechanism (monitoring, checklist, internal audit coverage), and application across all staff in the process.
I would not close the major on this evidence; I would specify what is required and how effectiveness will be verified.
2. What are the options and consequences if the 90-day limit is not met, and can a certificate be issued in the meantime?
Read the worked answer
No certificate while a major is open. Issuing one would certify a system with a known failure of a control that the organization itself deemed necessary.
The timeline runs from the closing meeting under the CB's own procedure:
- Within 90 days: the auditee submits correction and corrective action with evidence; verification of effectiveness is completed by the audit team (desk review where the evidence permits, otherwise a follow-up visit or additional sampling). Only then can the recommendation move to certification.
- At or beyond 90 days without acceptable closure: the audit cannot be closed favourably. Typically the audit is closed without recommendation and a further Stage 2 audit (or a defined re-audit) is required before certification. The CB's procedure, not the auditor's convenience, governs.
I would also distinguish the five minor nonconformities: their correction and corrective action plans are normally verified for implementation at the next audit, and effectiveness later. The major is the one that gates the decision. And I would say clearly to the client, in writing, that a promise to test next quarter is not verification.
3. The CEO disputes the major as "a documentation issue" and asks the account manager to have it downgraded. How should this be handled?
Read the worked answer
Separation of roles is the answer, and it should be stated openly. The account manager has no authority over audit findings; commercial pressure cannot change a conclusion. Downgrading is possible only on evidence and criteria:
- If the auditee supplies evidence that the requirement was in fact met (test records, alternative verification, a compensating control that genuinely achieves the objective), the finding is re-examined on its merits. If it was wrong, it is corrected - and the reason is recorded.
- If the objection is that the finding is inconvenient, the finding stands.
The correct channel for disagreement is the certification body's appeals process, which the client should be told about explicitly, together with the complaints process. The appeal is handled by people not involved in the audit.
Internally: the audit team leader records the dispute, the auditee's stated position and the evidence considered, and the certification decision-maker sees that record. The decision must be defensible to an accreditation assessor and to a hospital whose payments run through this platform - which is the real argument to put to the CEO.