Closing an ISO 28000 Audit
This domain tests the closing sequence: agreeing findings, reporting, and following up without drifting into consultancy or promising an outcome.
Closing meeting
Prepare it with the team first, and confirm facts with the auditee during the audit rather than at the closing meeting - surprises there damage credibility. Present findings in a structured form, explain the classification, allow questions, record disagreement, and state the audit conclusion against the criteria. Do not promise certification or design the solution; recommend, at most, the direction of corrective action.
The report
It should contain objectives, scope, criteria, dates and locations, the audit team and participants, findings with evidence, conclusions, and any limitations or divergences of opinion. Findings must be traceable to criteria and evidence so the report is defensible if challenged. Distribution and retention follow the programme's rules and confidentiality obligations.
Follow-up
The auditee proposes correction and corrective action with root-cause analysis and a timeframe. The auditor evaluates whether the response addresses the cause and verifies implementation, often through submitted evidence or a follow-up audit. For certification, the decision is taken by a competent person not involved in the audit.
Worked example
A draft closing statement says: 'Access control is weak and should be improved.' The auditor rewrites it: 'Clause 8 operational control: the site access procedure requires visitor badges for all visitors. On 14 March, three contractors in the server area wore no badges (observed 10:15-11:00, confirmed by the visitor log, which had no entries).' Criterion, evidence, dates - and no prescribed solution.
Traps
Raising a new finding at the closing meeting; writing opinions instead of evidence; promising 'you will pass'; failing to record the auditee's disagreement; and closing nonconformities on the basis of a plan rather than implemented action.