Closing an ISO 21001 Audit
What this domain tests
Closing questions cover findings classification, the closing meeting, the audit report, conclusions and recommendations, follow-up of corrective action, and the boundary between auditing and consultancy.
Core rules
- Classify findings: a major nonconformity means the management system cannot achieve its intended results or a requirement is not implemented at all/systemically; a minor is an isolated lapse; observations and improvement opportunities are recorded separately.
- The closing meeting presents findings and conclusions, agrees correction timeframes, explains the appeals and complaints process, and avoids surprises - significant issues must already have been raised during the audit.
- The audit report contains objectives, scope, criteria, dates and sites, audit team, findings with evidence and criteria, conclusions on conformity and effectiveness, and any scope limitations.
- Recommendations may suggest where to look; they must not become design or implementation consultancy, which compromises impartiality for a certification body.
- Follow-up verifies that corrective action was implemented and effective, not just promised. A closure letter or verification record documents this.
- For certification, the certification decision is taken by competent personnel independent of the audit team.
Worked example
Draft statement: "Assessment records were poorly kept in the business school." Rewritten as a nonconformity: "Clause 8.6 - release of educational products and services. Three of ten learner files sampled (IDs 104, 118, 127) showed certificates issued on 12 March without any recorded assessment result or authorised sign-off." Reasoning: the rewrite names the criterion, states verifiable evidence and sample size, and avoids interpretation, so the organization can correct it and the auditor can verify closure.
Traps
- Springing a new major nonconformity at the closing meeting.
- Writing recommendations that tell the organization how to redesign its processes.
- Closing a nonconformity on receipt of a corrective action plan alone.
- Omitting scope limitations or sampling constraints from the report.