Closing Two Minor Nonconformities: Retraining, a Late Management Review, and the Certification Decision
At the closing meeting of an ISO/IEC 42001 surveillance audit, you issue two minor nonconformities: (1) an operator changed the confidence threshold of a fraud model without following the change-approval step; (2) the last management review did not address the status of actions from the previous review or changes in AI-related risk. Ten days later the client submits corrective action evidence. For (1): root cause stated as "operator error", corrective action "operator retrained", evidence a signed training attendance sheet. For (2): a revised review procedure, plus minutes of a review held three days after the audit at which the CEO was absent and only two of the required inputs were discussed. The client requests immediate closure so that its certificate can be confirmed before a customer's supplier-approval deadline.
1. Evaluate the corrective action submitted for the first nonconformity. Would you close it?
Read the worked answer
No - not on this evidence.
The submission confuses correction with corrective action. Retraining addresses the individual; it does not explain why a threshold change could be made without approval. The plausible causes are systemic: the approval step may be impractical or unenforceable in the tooling, permissions may allow direct configuration changes, or monitoring may not detect unapproved changes. None has been examined.
What is missing:
- A cause analysis that reaches the process and control environment, not just the person.
- Action addressing that cause - for example, restricting configuration rights, adding a technical gate, or reconciling deployed parameters against approved changes.
- Evidence of implementation, and a means of judging effectiveness: subsequent change records showing the step was followed, or monitoring output demonstrating detection.
Response. Return it to the client with specific reasons, ask for a revised analysis, and state what evidence would be accepted. Propose a verification method and timeframe - a desk review of the next three change records, or verification at the next surveillance visit - and record the decision and rationale in the file. The customer deadline is not a factor in the technical judgement and should be answered separately, in writing, by the programme manager.
2. The client argues the second nonconformity is closed because a management review has now been held and the procedure revised. How do you assess that?
Read the worked answer
A review held three days after the audit, without the chief executive, covering two of the required inputs, is evidence of a correction made under audit pressure - not evidence that the review process now works.
Assess on two levels.
- Was the specific gap addressed? The missing inputs were the status of previous actions and changes in AI-related risk. The minutes show they were not covered. The gap therefore persists in the very event offered as evidence.
- Is the process effective? Effectiveness needs a review that is properly convened, attended by those with authority, and working from the full set of required inputs - including audit results, performance against AI objectives, interested-party feedback and incident information. A revised procedure alone proves intent, not operation.
Decision. Keep the nonconformity open. Set a defined verification point: the next scheduled management review, with evidence submitted for desk review within a stated period, and reserve the right to verify at the next on-site audit. If the subsequent review again omits required inputs, escalate - a repeated failure of the same required process indicates the system is not effective, and a further minor grading would no longer be defensible.
Record the reasoning; the file must show why a plausible-looking submission was not accepted.
3. What is the correct sequence and ownership of the certification decision at this point, and what would you recommend?
Read the worked answer
Sequence. Correction and corrective-action verification come first; only then can the audit team recommend, and only an authorised decision-maker independent of the audit team can decide. The lead auditor does not close nonconformities on their own authority where the CB's procedures reserve that to another function, and never issues the certification decision.
Your recommendation as lead auditor: nonconformity (1) remains open pending an acceptable cause analysis and effectiveness evidence; nonconformity (2) remains open pending a properly constituted review. Recommend that certification not be confirmed on the current file. Note the wider signal - two minors, one of them a required process operating incompletely, plus a late, partial review - and state whether it affects confidence in the effectiveness of the AIMS overall; the decision-maker needs that view, not just a closure status.
Practical handling. Confirm in writing what would allow closure and by when, and route the client's commercial deadline to the programme manager so that it does not contaminate the technical file. If the deadline forces a decision before verification is possible, the decision-maker may confirm certification with the nonconformities tracked, or defer - but that choice must be documented with reasons, and it is not the auditor's to make.