Audit reporting and follow-up
This domain tests whether you can turn evidence into a clear, defensible report and then verify that corrective action actually works. Reporting should present findings against audit criteria, distinguish conformity from nonconformity, and state conclusions within the audit scope. Follow-up closes the loop through correction, root-cause analysis, corrective action, verification, and closure.
Core rules and concepts
- Report content: objectives, scope, criteria, team, dates, sites, findings, evidence summaries, conclusions, and any limitations.
- Findings: state the criterion, the evidence, and the gap. Avoid unsupported adjectives.
- Recommendations: keep them separate from requirements; a recommendation is not a nonconformity.
- Corrective action: distinguish correction (fix the immediate issue) from corrective action (remove the cause).
- Follow-up: verify implementation and effectiveness, not just receipt of a action plan.
Worked example
An audit finds that hazardous-waste transfer records are missing for two shipments. The report states the criterion, the sampled shipments, and the missing records. The correction is to retrieve or reconstruct the records where possible. The corrective action investigates why the manifest process failed, such as no second-person check, and adds a verification step. Follow-up samples later shipments and checks the new control. Closing the finding after receiving a procedure would be premature; effectiveness requires evidence.
Traps that cost marks
Writing conclusions beyond the scope; presenting recommendations as mandatory findings; accepting a correction as corrective action; and closing findings without verification evidence. Another trap is a vague finding such as “records poor” with no criterion, sample, or impact.