Closing Meeting, Corrective Action and the Certification Decision
Helix Medical Billing processes claims data for 40 hospital clients from India and Poland. At the closing meeting of its Stage 2 combined audit, the lead auditor has raised a major nonconformity: in two of eight contracts sampled, sub-processors were engaged without documented controller authorisation, and the sub-processor register lists five entities covered by no contract. A minor nonconformity concerns missing deletion evidence for one of five retention batches. The client produces an addendum signed the previous day authorising the five sub-processors and asks the auditor to close both nonconformities today and recommend certification. The client also argues that a general clause in all master contracts - "the processor may use subcontractors as required" - already constitutes authorisation. The certification decision is scheduled in three days.
1. How do you respond to the request to close the nonconformities at the closing meeting, and does the addendum change the finding?
Read the worked answer
Response Explain calmly and in the closing meeting minutes that the auditor records findings; the auditor does not close them, and nothing is closed on the day it is raised. Closure requires the client to submit a corrective action with root-cause analysis, the action taken, and evidence of implementation, and requires that evidence to be verified - by desk review or a follow-up audit, depending on the certification body's process. The audit conclusion stands as presented.
Effect of the addendum Very little, and not enough:
- It is dated after the audit and covers the future. It does not address the period during which the five entities processed claims without authorisation, or whether those entities were assessed (security, location, transfers, onward obligations).
- It does not touch root cause. The register contained entities with no contract at all and two samples had no authorisation - that points to a contract-review and supplier-onboarding process that does not operate, which will recur.
- Its scope is five entities, not the 40 client relationships whose contracts must now be reviewed.
A credible corrective action would include a full reconciliation of register to contracts to client authorisations, due diligence on each sub-processor, notification to affected clients, and a change to the onboarding control with a named owner.
2. Evaluate the client's argument that the general subcontracting clause constitutes authorisation.
Read the worked answer
The argument deserves examination rather than dismissal, but it is not the criterion.
Criteria: the ISO/IEC 27701 processor requirements, the actual contract text with each client, and applicable privacy law. The audit tests against those, not against the client's interpretation of them.
Test the clause against the requirement
- Does it require prior notice to the controller of intended changes to sub-processors?
- Does it give the controller an objection right, and is that right exercisable in practice?
- Is there evidence that notice was actually given for each of the five entities?
- Does the engagement of each sub-processor rest on a written contract imposing obligations equivalent to those owed to the controller?
General written authorisation with notice and objection can satisfy the requirement in some legal regimes. A bare permission to subcontract "as required", with no notice evidence and no objection mechanism, is unlikely to satisfy ISO/IEC 27701's expectation of documented authorisation from the PII controller, and it cannot cure the five register entries with no contract whatsoever.
Present the finding as fact plus criterion, so the client can see exactly which clause of the standard and which contract term you compared. Ask to see the actual contracts rather than accepting the paraphrase.
3. What are the consequences for the certification decision and the next surveillance audit?
Read the worked answer
Certification decision
- The decision belongs to the certification body's decision-maker, who is independent of the audit team, and rests on the audit report, the nonconformity status and the corrective action evidence.
- A major nonconformity that is open precludes a positive decision. The decision is deferred, not taken in three days as scheduled, unless and until closure is verified within the CB's defined timeframe.
- If closure is not achieved, a further audit (often limited scope) is required before a decision can be made.
- The minor must also have a corrective action plan accepted and a closure route defined (often verification at the next surveillance).
Programme implications
- The next surveillance must sample across the contract population properly - not eight contracts but a justified sample spanning both sites, all client sizes and the sub-processor chain - and must verify the register, the due diligence records and the notification evidence.
- Consider whether the weakness is systemic enough to justify increasing audit frequency or shortening the cycle.
- Re-check related areas that depend on the same process: transfer mechanisms, controller instructions recorded in contracts, and the complaint/breach channels to those controllers.
Record the client's statement in the report; it becomes part of the evidence the decision-maker sees.