Closing an ISO 18788 audit
Domain focus
This domain tests what happens after fieldwork: the audit report, nonconformity grading, corrective-action follow-up, record retention and the boundary between auditor and certification decision.
Core rules
The audit report should state objectives, scope, criteria, dates, team, sites sampled, findings, conclusions and any limitations. Findings must be factual, concise and traceable to evidence; nonconformities need a clear requirement and evidence. A major nonconformity typically indicates a system failure, absence of a required control, or a significant legal or human-rights risk; a minor one is an isolated lapse. Justify the grade by impact and pervasiveness, not by the auditee's preference.
Corrective action requires correction, root-cause analysis, action and verification of effectiveness. Follow-up may be a document review or an on-site audit, within an agreed timeframe. The certification decision is made by the certification body's competent decision-maker, independent of the audit team. Retain records securely and handle complaints and appeals.
Worked example
An auditor finds no functioning grievance mechanism at one site, although the standard requires one. Workers describe no route to report concerns, and no log exists. Because the gap affects human-rights protection and is systemic at that site, the auditor grades it major, writes the requirement and evidence, and requires a procedure, worker communication, training and verification after 60 days. A single missing signature on a log would more likely be minor.
Traps
Do not write recommendations as findings. Do not grade by count or by how upset the client is. Do not close a nonconformity on a promise or a procedure alone; verify implementation. Do not let the audit team make the certification decision. Do not omit distribution, confidentiality or records retention.