Closing an ISO 37301 Audit
Domain 6 tests how you turn evidence into conclusions, report them, and close the audit properly. The closing stage is where findings are consolidated, the audit conclusion is formed, and corrective action is agreed, not where new issues are invented.
Closing sequence
- Consolidate and grade findings, checking each against its criterion and evidence.
- Prepare the audit report: objectives, scope, criteria, team, dates, findings, and conclusion.
- Hold a closing meeting to present findings and conclusions, explain their basis, and agree correction and corrective-action timeframes.
- Distribute the report to those with authority to act and to the audit client, respecting confidentiality.
- Follow up corrective actions and verify effectiveness before closing the finding.
- Retain audit records.
Worked example
At a closing meeting, an auditee disputes a nonconformity about missing management review. The auditor reads the requirement from Clause 9.3, shows the meeting minutes for the period with no compliance review, and explains the gap. The auditee agrees to hold a review and conduct a root-cause analysis. The auditor records the nonconformity, accepts the correction date, and schedules a follow-up for effectiveness. The auditor does not promise certification; the certification decision belongs to the certification body.
Traps
Do not surprise the auditee with new findings at closing. Do not write opinions instead of evidence-based findings. Do not accept 'we will retrain staff' as a corrective action without root-cause analysis. Do not confuse the audit conclusion with a certification decision. Do not omit follow-up or record retention.