The draft finding nobody can defend

What is wrong with the draft

1. No requirement cited. "Procedure not followed" does not say which clause of QP-07, or which part of the standard, was breached.
2. Conclusion, not evidence. "Ineffective" is the auditor's judgement, and the judgement has not been argued. A finding must let a third party reach the same conclusion from the evidence stated.
3. "Major" is unargued. The severity label carries weight and needs a reason.
4. Contradicted by the file. The suppliers were evaluated by questionnaire inside the annual cycle, which is the procedure's own alternative route - so on the face of it the finding may be wrong.
5. Solution smuggled in as a finding. The reminder system belongs in an opportunity for improvement, clearly marked as advisory.

A defensible form

Requirement: QP-07 §4.2 (approved suppliers shall hold a current third-party certificate or be evaluated by questionnaire annually). Evidence: suppliers 118 and 204 hold certificates expired 3 and 7 months ago; both were questionnaire-evaluated 5 months ago scoring 88 and 91 (threshold 75); both supply low-risk consumables. Statement: on the sampled files, conformity with the certificate route was not maintained, although the annual questionnaire route was satisfied. Classification: minor - the procedure concedes an alternative route and no low-risk supply was affected.

Notice what changed: it is testable, and it concedes the counter-argument.

The auditee's argument is strong and must be taken head-on. QP-07 offers two routes: a current certificate, or annual questionnaire evaluation. Both suppliers took the second route, on time, and passed comfortably. On the document as written, the process was followed.

Where the auditor can still legitimately look

• Does QP-07 mean the routes are alternatives for all suppliers, or that certificate-holding suppliers must keep the certificate current? Read the whole procedure, including any definitions or annexes, before deciding. If the text is genuinely ambiguous, the auditor cannot raise a nonconformity against the reading the company has adopted.
• Was the questionnaire effective for the risk? Check what it covers - if it is a self-declaration with no verification for suppliers of product-contact packaging, the evaluation may not meet the intent of 8.4.1 even though the box was ticked. That would be a different, stronger finding, evidenced by the questionnaire content.
• Is there drift on a high-risk supplier that the low-risk sample concealed? If yes, that is where the real finding lives.

Likely outcome: no nonconformity on these two files. Record the ambiguity in QP-07 as a weakness or opportunity for improvement, and note in the report that the certificate-expiry observation was examined and not sustained - with the reason. A withdrawn finding, explained, builds more credibility than one defended on shaky ground.

Do not negotiate the evidence in the room.

1. Separate the two things being disputed: the facts (which files, which dates, which scores) and the interpretation (whether that constitutes a nonconformity). If the facts are contested, re-open the files on the spot. If only the interpretation is contested, note the disagreement.
2. Restate the finding neutrally, with the requirement quoted, and ask the auditee to show the clause or record that supports their reading. If they produce something you missed, change the finding - that is the system working.
3. If disagreement remains: record the auditee's position in the report alongside the finding, and state that the disagreement is unresolved. Signing is acknowledgement of receipt, not agreement; note who received it and when.
4. Escalate through your own procedure - lead auditor and audit programme manager - and remind the auditee of the formal appeal route, including the timeline.
5. Do not trade. Downgrading a finding to buy goodwill, or keeping it to protect your credibility, are both failures of fair presentation.

Follow-up thinking: whatever is agreed needs a corrective action that addresses cause, not just the two expired certificates. Two re-evaluated files closed is a correction; the corrective action question is why the certificate route decayed without anyone noticing, and whether QP-07 says what the company thinks it says.