Audit Reporting and Follow-up
Domain 5 tests whether your report can be defended line by line, and whether corrective actions are verified rather than simply accepted.
Core rules
- ISO 19011 report content: objectives, scope, criteria, dates and sites, team, findings, conclusions, and any statement of conformity.
- Conclusions must stay inside the evidence. A claim that the EMS conforms rests on sampled findings, and caveats belong in the report.
- Reports are factual, concise, and free of blame; distribution and confidentiality arrangements are agreed at planning.
- Corrective action needs containment, root cause, and a systemic fix; retraining alone rarely addresses cause.
- Follow-up verifies implementation and effectiveness before closure, with dates and evidence recorded.
- Certification reports address whether the system is effectively maintained, not merely documented.
Worked example
Finding: three of twelve hazardous-waste containers lacked accumulation-start dates. The organization responds with “retrain the handlers.” The auditor tests the root cause: the drum-labelling procedure never included a date field, and the weekly inspection checklist omitted it. Effective corrective action amends the label and the checklist, then verifies two months of inspections. Retraining handlers who were following a defective procedure would not have prevented recurrence, so the action is returned for revision.
Traps that cost marks
- Writing conclusions that outrun the sample (“no legal noncompliances exist”).
- Specifying the exact corrective action, which compromises future impartiality.
- Subjective wording - “sloppy recordkeeping” instead of the record, date, and requirement.
- Closing actions on a document upload rather than evidence of effect.
- Omitting positive practices and effective controls, which weakens credibility.