Classifying nonconformities at a container depot closing meeting
During the closing meeting of an ISO 28000 surveillance audit at a container depot, the audit team has three findings. First, a 15-meter section of perimeter fence was cut and repaired with wire mesh; the repair is visible and the depot says it was fixed 'the same day.' Second, CCTV recording had been failing for 11 days because of a corrupted hard drive; no work order was raised and the failure was discovered by the auditor, not by the daily check. Third, access logs for contractor vehicles were missing for 6 of 20 sampled days; the gate guard says the logbook was 'sometimes forgotten' when the printer was down. The depot's security manager argues all three should be minor because 'nothing happened.' The audit team must decide classification and recommendation. The certification body's procedure defines a major nonconformity as a systemic failure or one that raises significant doubt about the management system's effectiveness.
1. Classify the three findings as major or minor and justify each classification.
Read the worked answer
I would classify by effect and systemicity, not by whether an incident occurred. The CCTV failure lasted 11 days, was not detected by the daily check and had no work order: that is a systemic monitoring failure, so major. The missing contractor vehicle logs on 6 of 20 sampled days, with the guard saying the logbook was 'sometimes forgotten,' is also systemic operational control failure, so major. The fence repair looks isolated if it was detected and repaired the same day, with no evidence of a wider patrol failure; that could be minor.
But if the auditor found the breach and the patrol did not, then detection is also ineffective and the finding may combine with the CCTV issue as a major. I would avoid three separate majors if they share one root cause; the report should describe the system failure clearly. 'Nothing happened' is not the criterion; the criterion is whether the control is effective and the management system can prevent recurrence.
2. What is the difference between correction and corrective action for the CCTV finding, and what evidence would you require before accepting closure?
Read the worked answer
Correction is the immediate fix: replace the corrupted hard drive, restore recording and confirm camera coverage. Corrective action is the response to the cause: why did the daily check not detect 11 days of no recording? Was the check only a visual look at the monitor, was there no fault alert, was maintenance responsibility unclear, was the hard drive age not monitored? I would expect a revised check with evidence (recording playback test, alerting, work order), training, assignment of responsibility, and a review of other sites' CCTV.
To accept closure I would need the work order, the completed check records for at least a month, a playback test witnessed or sampled, and evidence that a similar failure would be detected. I would not accept 'drive replaced' alone; that only corrects the symptom.
3. How should the audit team handle the closing meeting, the audit conclusion and follow-up given the disagreement?
Read the worked answer
At the closing meeting I would present each finding with the criterion, evidence and classification, and allow the depot to respond. I would not downgrade findings merely because the manager disagrees or because no incident occurred. I would record the disagreement and the factual basis. The audit conclusion should state that the management system is not fully effective because monitoring and operational control failed; the recommendation on certification should follow the certification body's procedure, and the decision remains with the independent decision-maker.
For major nonconformities, the depot must provide correction and corrective action, and the body will normally require follow-up verification-documentary and possibly onsite-before closing. I would set a timeline, require root-cause analysis, and check effectiveness, not just promises. The team should also verify whether the same failures exist at other sites before recommending continuation.