Closing an ISO 9001 audit
Findings, report, follow-up
Closing begins before the closing meeting: the team consolidates findings, removes duplication, confirms each has criteria and evidence, agrees grading and clears disagreements with the audit team leader. The closing meeting presents findings and conclusions, states whether audit objectives were met, notes any scope limitations or diverging opinions, and agrees correction/corrective-action timeframes and who reports back. It does not become a negotiation about whether the evidence exists.
The audit report is factual and concise: objectives, scope, criteria, dates and locations, team, sampling basis, findings, conclusions on conformity and, where applicable, on the effectiveness of the QMS, plus limitations. It is distributed as agreed, with confidentiality respected and records retained.
Follow-up verifies that correction was made and corrective action taken, then - critically - that the action was effective. Verification may be desk-based or on site, depending on risk and the programme. The audit is closed only when verification is complete and recorded.
Traps: the auditor must not design or prescribe the corrective action, only verify it; accepting 'we will fix it' as closure; confusing correction (fix the instance) with corrective action (remove the cause); assuming the audit team decides certification - for third-party audits the certification decision is made by the certification body, independent of the team's conclusion.
Rule of thumb: write your report so a reader who was not present could find the same evidence again.