Closing an ISO/IEC 27701 Audit
The closing meeting
Present findings, their grading and the audit conclusion, and make sure the auditee understands each one. The meeting is for presenting results, not negotiating them; disagreements are recorded and can be pursued through the complaint and appeal process.
Nonconformity reports and the audit report
Each nonconformity states the requirement, the objective evidence and the gap. The auditee - not the auditor - determines the correction, the root-cause analysis and the corrective action. The audit report records objectives, scope, criteria, dates, team, a note that the audit was sample-based, the findings, and conclusions on conformity, plus a recommendation on certification where applicable.
Certification decision
For third-party certification, the decision is taken by the certification body, independent of the audit team, on the basis of the report and evidence of effective corrective action. Auditors recommend; they do not certify. Where a major nonconformity is raised, corrective action must be verified - typically within a defined period, commonly up to 90 days - before certification can proceed; otherwise the audit may be terminated or the client must be re-audited.
Follow-up and records
Verify that corrective actions were implemented and are effective, handle complaints and appeals through a documented process, and retain audit records under confidentiality controls.
Traps
An auditor drafting the corrective action for the client. Recommending certification while a major nonconformity remains open. Believing the auditee must agree with every finding for it to stand. Confusing correction (fixing the instance) with corrective action (fixing the cause).
Rule of thumb: verify two things after a nonconformity - that the instance was fixed and that the cause was removed.