Closing audit findings: separate correction, cause analysis and corrective action
Practical guide · Educational reading
A practical guide to separating correction, cause analysis and corrective action—and deciding what evidence supports closing an audit nonconformity.
Audience / jurisdiction: International guidance for internal auditors, quality managers and process owners; no jurisdiction-specific legal obligations asserted.
Direct answer: close against evidence, not promises
To close an audit nonconformity convincingly, distinguish three activities: correcting the detected problem, investigating why it happened, and taking action that addresses the cause. Then review evidence that the action was implemented and is effective. Completing a task is not, by itself, evidence that the underlying problem has been resolved.
The ISO 9001 Auditing Practices Group (APG) paper Nonconformity – review and closing provides external educational guidance on these distinctions. It is not an additional ISO requirement or mandatory audit criterion, and its papers have not undergone ISO/TC 176 or IAF endorsement. The workflow below is an editorial suggestion; actual requirements must come from the applicable standard, organizational arrangements and any relevant scheme rules.
Sources: [1]
Build a traceable response
Start with a clear finding record. As a suggested format, identify the applicable requirement, what was observed and the supporting evidence. Keep this original record separate from explanations developed during the investigation.
Next, record the immediate response: what affected work was reviewed, what was corrected and whether containment was needed. This answers what happened to the detected problem, not necessarily why it occurred.
Investigate possible causes using records, interviews and process observations. APG cautions against assuming that the first identified factor is the established root cause. Test whether the explanation fits the evidence and whether the same weakness could affect other work.
Select an action linked to the supported cause. A useful editorial test is to complete the sentence: “This change addresses the cause because…” Assign an owner and an internally selected completion date. These activities need not follow a rigid sequence; the response should suit the situation.
Sources: [1]
Separate implementation from effectiveness
Use two separate review questions: Was the change completed? Does evidence show that it works? For example, a revised procedure can demonstrate implementation, while records of subsequent work can help demonstrate effectiveness.
Define the intended effectiveness evidence before deciding to close. Suggested considerations include the affected process, transaction volume, risk and opportunities to observe the changed controls. Avoid choosing a universal sampling period simply because it is convenient.
APG guidance supports reviewing objective evidence of implementation and effectiveness before closure. Depending on the finding, this may involve on-site examination or remote documentary review. Record the evidence examined, the conclusion and any remaining uncertainty.
Sources: [1]
Worked example: missing quotation approvals
Hypothetical example: a service team’s internal procedure requires approval before quotations are issued. Three sampled quotations have no approval records.
The immediate response is to review the affected quotations and assess whether customer-facing corrections are needed, without backdating approvals. The investigation compares the documented workflow with actual practice and tests whether the system permits sending without approval and whether approval responsibility is clear.
Suppose the evidence confirms both weaknesses. A cause-linked response could introduce an approval control and designate a backup approver. Configuration-test results and the responsibility assignment would support implementation.
For effectiveness, review subsequent quotations, including cases handled by the backup approver. Choose the scope to suit volume and risk. Record whether the results support closure; if effectiveness remains untested, do not describe the completed configuration change as proof of success.
Sources: [1]
Avoid shortcuts and check before closure
Common mistakes include recording “staff reminded” without explaining its link to the cause, treating a rewritten procedure as proof of changed practice, accepting an untested explanation, and closing against a promised action. These editorial cautions follow the distinction between correction, cause analysis, implementation and effectiveness.
Suggested action checklist: separate the three response activities; test causes against evidence; link actions to those causes; assign owners and dates; define effectiveness evidence; and retain the closure rationale.
Use a structured investigation where helpful, but do not present a particular technique, such as “five whys,” as a universal requirement.
Sources: [1]
Sources
Your experience
What evidence would show that your latest corrective action changed the process, rather than merely completed a task?
Originally published by AdviseISO, a knowledge-sharing initiative of W3 Solutionz.
