Closing an ISO/IEC 20000 audit
Domain 6 - Closing an ISO/IEC 20000 audit
This domain tests how to conclude an audit properly: the closing meeting, the audit report, findings classification, conclusions, corrective-action follow-up and records.
Closing activities
- Closing meeting: restate objectives, scope and criteria, present findings and conclusions, explain the basis for any nonconformity, and agree factual accuracy. Agreement on facts is not the same as agreement with the audit judgement.
- Audit report: include objectives, scope, criteria, team, dates, locations, findings, conclusions, limitations and any divergent views. Findings should be traceable to evidence. Reports are dated, reviewed and distributed according to confidentiality rules.
- Nonconformity reports: state the requirement, the objective evidence and the nonconformity. Avoid prescribing the solution; the auditee owns the correction and corrective action.
- Corrective action: the auditee investigates root cause, plans correction and corrective action, implements it and provides evidence. The auditor verifies effectiveness, not just the existence of a plan.
- Certification: the audit team's conclusion informs, but does not replace, the certification decision. The certification body makes the decision independently.
Worked example
An internal auditor finds that two of six service reviews had no minutes. The report classifies this as a nonconformity against the organization's service review procedure. The auditee proposes to hold more reviews. The auditor asks for root cause: the review chair was not aware of the minute requirement and no template existed. The corrective action includes a template, a briefing and a check in the next review cycle. The auditor verifies the next two sets of minutes and closes the finding.
Traps
- Writing management should improve... without a requirement and evidence.
- Letting the closing meeting become a negotiation of the finding's wording rather than a check of facts.
- Confusing correction (fixing the instance) with corrective action (removing the cause).
- Closing a finding because a plan exists, without verifying implementation.
- Breaching confidentiality by circulating the report too widely.