Reporting and following up on an internal audit
Reporting and following up on an internal audit
This domain tests how you produce a factual, timely audit report and how you follow up corrective actions to closure. The exam emphasizes clear findings, appropriate distribution, root-cause action and verification of effectiveness.
Core rules and concepts
- The audit report should include objectives, scope, criteria, dates, team, findings, conclusions and any agreed opportunities for improvement. It should be factual, concise and traceable to evidence.
- Findings should state the criterion, the evidence and the gap, and identify the process and location. Conclusions address whether the management system is effective within the audit scope.
- Issue the report promptly to those responsible for acting and to others with a need to know. Respect confidentiality and avoid distributing beyond the agreed recipients.
- Corrective action addresses the cause, not only the symptom. The auditee proposes correction and corrective action; the auditor does not prescribe the solution.
- Follow-up verifies implementation and effectiveness. Closure requires evidence that the action was taken and that the nonconformity is unlikely to recur, not merely a promise or a revised document.
- Track actions in the audit programme and escalate overdue or ineffective actions through management review.
Worked example
An auditor finds an obsolete work instruction at a machine while the current version is controlled elsewhere. The correction is to remove the obsolete copy. The corrective action might revise document control to prevent uncontrolled copies at machines, train affected staff and check other workstations. Follow-up samples several machines and reviews issue records. Closing only after the obsolete copy is removed would verify correction, not effectiveness; the auditor must test whether the control change works.
Traps that cost marks
Do not write recommendations as requirements. Do not close a finding when the report is issued. Do not verify only that a document was revised. Do not confuse correction with corrective action. Do not disclose audit information without authorization. Do not accept an action plan that addresses the symptom but not the cause.