Three overdue gauges and 45 minutes left

What the sample supports 3 of 20 (15%) in the sample are overdue. That is enough to establish that the control is not operating as intended - a nonconformity exists. It is not enough to say "15% of 412 gauges are overdue" or to conclude anything about the population.

Why the sample is weak Sorting by instrument ID and taking the first 20 is not a random sample. IDs usually correlate with asset type, purchase year or cell, so those 20 may over- or under-represent the risk. Two things were lucky and must not be mistaken for method: all three failures landed in one cell and with one laboratory.

What to do in the remaining time

1. Draw a small stratified sample: about 15 instruments split across cells and weighted towards gauges used for product acceptance and final inspection.
2. Test the consequence, not just the date: were the overdue gauges used to accept product since they expired? Pull the inspection records.
3. Check the lab's reduced scope against the instruments it calibrated - if it calibrated gauges outside its remaining scope, the calibration itself may be invalid, which is a product-risk issue, not a paperwork issue.
4. Ask what detects an overdue gauge before use. The supervisor's remark suggests the answer may be "nothing", which changes the finding's severity.

If time runs out: report what the evidence supports, state explicitly that only 20 of 412 were examined, and flag the population question as requiring follow-up - do not paper over it with a percentage.

Classification turns on system failure, not on the count of bad records. Twenty wrong records can be minor; one missing control can be major.

Pushing towards minor

• A register, an external calibration provider and a defined interval exist; the process is designed.
• No product impact identified so far.
• A small, localised lapse is a candidate for correction plus corrective action.

Pushing towards major

• "When we're busy we slip a bit; everyone knows" describes a known and accepted deviation, not a lapse. If true, the process has no effective detection or prevention and the system is failing systematically.
• Medical-device context: measurement traceability feeds conformity decisions and is subject to regulatory expectations, so the consequence of failure is high.
• The failed instruments cluster by cell and by laboratory, which suggests more than random slippage.
• Two-year audit interval means this would have gone undetected by the audit programme.

How to decide Resolve the two open questions - is there a control that blocks use of an overdue gauge, and did expired gauges influence product acceptance? If no blocking control and/or product was accepted using them, raise it as major and say why. If there is a functioning pre-use check and the lapses are recent, minor is defensible. Write the rationale in the report either way; an unexplained classification invites dispute.

Decline, and say why. As an internal auditor you may identify that a control is missing - that is a finding. Designing or selecting the fix moves you into implementing the process you will later audit, which destroys the independence the audit function depends on.

What to do instead

• Write the finding against the requirement and the evidence; leave the how to the process owner.
• If asked for ideas, keep them clearly outside the finding: an observation or opportunity for improvement, labelled as advisory, non-binding, and not something you will later verify as "your" solution.
• It is legitimate to ask the auditee to demonstrate that whatever they choose actually prevents use of an overdue gauge - that is testing effectiveness, not consulting.

Also flag the systemic point in the closing meeting: the auditee's real question implies their current detection relies on a person noticing a date. Whether they buy software or change the interval is their decision, but the corrective action must address why the deviation became normal practice, not just the three gauges.