Managing Audit Findings, Nonconformities and Corrective Actions
This domain tests whether you can turn audit evidence into defensible findings and drive corrective action to verified closure.
Findings and nonconformities
A finding needs three elements: criteria (the ONF or ASC requirement), evidence (what was observed and where) and conclusion (nonconformity, observation or opportunity for improvement). Classify major versus minor by systemic impact: absence of a required ONF element or a failure affecting many applications is usually major; an isolated lapse may be minor. Distinguish correction - fixing the specific instance - from corrective action, which removes the root cause. Verify effectiveness before closure, and check whether the same issue exists elsewhere.
Worked example
Finding: the ASC library has no verification guidance for 7 of 12 high-risk ASCs. Criteria: the ONF requirement that ASCs include verification guidance and Part 5's ASC data structure. Evidence: library export dated and sampled. Conclusion: major nonconformity, because validation cannot be performed consistently for the highest-risk controls. Correction: add guidance for the seven ASCs. Corrective action: introduce a peer-review checklist at ASC publication. Verification: sample newly published ASCs and recheck the library.
Traps
- Writing 'weak security culture' without criteria and evidence.
- Prescribing a specific product instead of the required outcome.
- Closing an action because a screenshot or promise was provided.
- Confusing correction with corrective action.
- Failing to test the extent of the issue in other teams or applications.