Closing a weak nonconformity and a thin corrective action
Closing meeting for an internal audit at a 300-person manufacturer of medical device components. The auditor wrote: "Rework process not always followed - NC". The evidence: of 10 rework orders sampled, 3 lacked the re-inspection sign-off that procedure PR-07 requires before release. The operations manager objects: "That's an observation, the parts were fine and nothing bad was shipped - and you didn't sample enough, we do 400 rework orders a year." Three weeks later the corrective action plan arrives: retrain the two operators, add a reminder at the toolbox talk, due in six months. The internal audit programme runs a 12-month cycle, and this process was last audited 11 months ago.
1. Rewrite the nonconformity statement so it is defensible.
Read the worked answer
The original states a conclusion with no criteria and no evidence, and it hints at a cause. A defensible statement has three parts.
Requirement (criteria): Procedure PR-07 §5.2 requires 100% re-inspection, with sign-off, of reworked product before release.
Objective evidence: Of 10 rework orders sampled, 3 (OR-1041 dated 12/03, OR-1047 dated 19/03, OR-1063 dated 02/04) had no re-inspection sign-off, and the associated product was released to despatch.
Finding: Reworked product was released without the required re-inspection sign-off.
Rules applied: no root cause (that is the auditee's job under 10.2.1), no remedy suggested, no named individuals, no adjectives such as "poor" or "not always". Include the site, process, clause reference (8.5.1 and 8.7 as applicable) and the audit date. That text survives challenge from the operations manager, an accreditation assessor, or a customer.
2. How do you handle the operations manager's objection at the closing meeting - does the nonconformity stand?
Read the worked answer
The finding stands unless the facts are wrong. "The parts were fine" answers a product-quality question; the requirement is the sign-off, and conformity is judged against the criterion, not against the outcome.
The sampling objection is legitimate on scale, not on validity. 3 of 10 is evidence the control failed at least three times; whether the failure is systemic is a severity question, and it can be tested - offer to review more orders if time allows, and record the sample limitation and its basis in the report.
At the meeting:
- Restate the criteria and the evidence plainly.
- Ask a direct question: are the facts disputed - which orders, which dates?
- If the auditee produces the missing sign-offs elsewhere, revise the finding on the spot; that is not a loss of face.
- Record the disagreement, the auditee's position and the agreed response route (corrective action request with a deadline) in the minutes.
Do not downgrade a nonconformity to an observation to keep the room calm. That is the single most damaging thing an auditor can do to the credibility of the programme.
3. Evaluate the proposed corrective action and set out how you would verify it, given the audit programme cycle.
Read the worked answer
Assess against 10.2.1.
- React (a): has containment happened - are the 3 orders and any unsampled releases identified and re-inspected now? The plan is silent; ask.
- Root cause (b): "operator error" is not a cause. Why is sign-off skippable? Is the rework order separated from the inspection record, is there no system block on release, is rework done on a shift with no inspector available?
- Action (c)–(d): retraining two people plus a toolbox talk addresses neither the cause nor recurrence if the process design allows release without sign-off.
- Timing (e): six months is longer than the remaining audit cycle and does not reflect risk on a medical device component.
What to require: a proper cause analysis (5-why or fishbone) covering process design; a corrective action with a named owner and a date inside the cycle; and a proposed effectiveness measure - e.g. 20 consecutive rework orders with verified sign-off.
Verification. Effectiveness means the condition no longer occurs and no similar condition exists elsewhere - not that a training record exists. Since this process was audited 11 months ago and the cycle is 12 months, schedule a short verification audit or documented desktop review at three months and enter it in the audit programme (9.2.2), so follow-up does not drift to the next annual visit.