Closing an ISO 37001 audit
What the domain tests
Closing questions test the closing meeting, audit report, finding classification, corrective action and follow-up. You must separate facts from opinions and correction from corrective action.
Core rules
- The closing meeting presents findings and conclusions, explains sampling limitations and agrees practical next steps; it is not a negotiation to remove findings.
- The audit report records objectives, scope, criteria, team, dates, findings, evidence and conclusions. Findings should state the criterion, the evidence and the gap.
- A nonconformity is non-fulfilment of a requirement. Classification as major or minor depends on the audit program’s rules and impact; do not invent a classification without a scheme.
- Correction fixes the immediate issue; corrective action addresses the root cause. The organization proposes action; the audit team or program owner verifies closure as planned.
- Follow-up may be desk-based or on-site and should be scheduled in the audit program.
Worked example
An auditor finds no due diligence for a high-risk agent. The report should not say “compliance is weak.” It should cite the due diligence requirement, the sampled agent, the missing records and the risk assessment that rated the agent high risk. The corrective action might include a retrospective review, a new risk-based threshold and training; the correction is to screen that agent now.
Traps
Letting the auditee rewrite findings; reporting opinions as evidence; accepting “we will be careful” as corrective action; confusing correction with root-cause action; and closing without a follow-up plan.