Closing an ISO 45001 Audit
Closing meeting, report and follow-up
The closing meeting presents findings and conclusions to the auditee's management and confirms that they are understood. There should be no surprises: major nonconformities ought already to have been raised and factually agreed during the audit. Disagreements are recorded in the report, not negotiated away, and the auditee does not "approve" the report - it belongs to the audit team and the client.
A complete report covers objectives, scope (including limitations such as sites not visited or sampling), criteria, dates and locations, the audit team and participants, a summary of how the audit was conducted, the findings and observations, and conclusions on conformity and effectiveness. It should state that sampling limits the certainty of the conclusions. Distribution and retention are controlled by the client or programme manager, subject to confidentiality.
Follow-up: corrective action is the auditee's responsibility. The auditor verifies implementation and effectiveness, either at the next scheduled audit or at a dedicated follow-up. Verification must confirm that the root cause was addressed, not merely that a form was completed. Under accreditation, unresolved major nonconformities normally prevent certification.
Then close the administration: record retention, auditor competence and performance records, auditee feedback, and updates to the audit programme (for example, bringing forward the next audit of a weak process).
Traps: leaving with vague promises instead of agreed dates and owners; treating a proposed action plan as verification; recommending particular suppliers or solutions, which is consulting and damages independence; disclosing confidential findings beyond the agreed distribution; issuing a report that lists findings but contains no conclusions.
Rule of thumb: every finding closes with a who, what and when - evaluation, implementation and verification dates.