The CEO Wants the Major Downgraded: Closing Meeting, Corrective Action and a Lost Notebook
Five days of audit at a logistics group produced two major and five minor nonconformities. Major 1 records that a USD 340,000 commission was paid to an agent on a public tender award with no due diligence record, no written anti-bribery clauses and no evidence of approval. At the closing meeting the CEO says: nothing was proven, the agent was recommended by a board member, and it happened once, so downgrade it to an observation or we will not sign the report. Major 2 concerns an unresolved conflict of interest involving a procurement manager. Ten days later the group submits a corrective action plan. For minor 4, a gift register not reviewed for 14 months, the plan reads: all staff will be reminded by email to follow the gifts procedure. The technical reviewer needs the file in three working days. You also notice that your handwritten notes for minors 4 and 5 are missing; you still have the team auditor's notes and the documents collected on site.
1. How do you handle the CEO's demand at the closing meeting? Can the finding be downgraded, and what do you do about the refusal to sign?
Read the worked answer
The closing meeting is a communication event, not a negotiation. A finding stands or falls on evidence measured against criteria, and the CEO's argument is about consequences, not about facts.
Nothing was proven misstates the finding. The nonconformity is not that a bribe was paid; it is that before a USD 340,000 payment to an agent on a public tender, the required controls were absent: no due diligence under 8.2, no anti-bribery clauses under 8.5/8.6, no approval evidence under 8.3. Absence of records is directly verifiable. No proof of bribery is needed, and none is being asserted.
It happened once is precisely why 8.2 exists. Due diligence is performed before engagement because the first payment is the one that matters. Recommended by a board member is a conflict-of-interest indicator, not a defence; it strengthens the finding and should prompt a check on whether a declaration exists and whether the same board member is behind Major 2.
My response, calmly and on the record: restate the criteria, the evidence, and the consequence under the certification body's rules, namely that a major nonconformity must be corrected and the corrective action verified before certification, typically within a defined period such as 90 days. Say that the certification decision is made by an impartial decision-maker, not by me. Record the client's disagreement in the closing meeting minutes and in the audit report; fair presentation requires it. A signature is not a condition of the report's validity, so note the refusal rather than pressing for it, and never trade a finding for a signature.
2. Evaluate the corrective action plan for minor 4. Would you accept it, and what would you require?
Read the worked answer
The plan treats a design failure as a knowledge failure. The nonconformity is that the gift register went unreviewed for 14 months; reminding staff to follow the gifts procedure does nothing to ensure anyone reviews the register. The action is at best a correction and will decay as soon as attention moves.
Ask first why it lapsed, because that determines the fix: was there no named owner, did the reviewer leave, was the review nobody's job after a reorganisation, or was it simply never monitored? Then require a plan that answers the root cause:
- a named owner and a defined review frequency, with the review recorded;
- what the review must examine: entries above threshold, recipient and role, pending decisions, patterns across a single recipient;
- escalation rules for anomalies, to a level independent of the commercial function;
- evidence that the 14-month backlog has now actually been reviewed, including anything found;
- a monitoring measure (9.1) reported into management review (9.3) so the lapse is visible next time;
- independent assurance, for example a check by internal audit or the compliance function.
A plan without these elements should be rejected with written reasons and the timeline reset. For a minor nonconformity, the certification body's rules usually allow verification by desk review of evidence or at the next audit, so state in advance what evidence you will accept, such as a sample of signed review minutes, rather than accepting a promise of an email.
3. Your notes for two minor nonconformities are missing and the file is due in three working days. What do you do?
Read the worked answer
First, do not reconstruct from memory and present the result as contemporaneous notes. Audit evidence must be traceable and verifiable; a record that looks original but is not will collapse the first time a finding is challenged, and it undermines the whole file.
Recover what exists: the team auditor's notes, documents and records collected on site, interview records, photographs, emails, checklists, any typed notes or laptop files, and the closing meeting minutes. Rebuild each finding as a finding statement, criteria, evidence and observation, and cross-check every element against a document or a second person's contemporaneous record. Keep only what is supported. If one minor nonconformity rests solely on my lost notes, either reword it to the strength that is supported or withdraw it. A smaller true finding is worth more than a larger vulnerable one.
Record the gap honestly in the audit file: a dated note stating that the original notes were mislaid and describing how the evidence was reconstructed and cross-checked. Reviewers can work with a disclosed gap; they cannot work with a concealed one.
Communicate before submitting: tell the team leader or technical reviewer, so the decision on whether anything needs re-verification is theirs with full knowledge. On the deadline, ask for an extension if re-verification is needed. A late file that survives scrutiny is better than a punctual one that does not.