ISO audits · Corrective action
How to close an ISO audit nonconformity with evidence that works
An ISO audit finding needs more than an updated procedure. Use a worked example to connect correction, cause, corrective action and effectiveness evidence.
Your ISO audit report contains a nonconformity. The team updates a procedure, adds a training attendance sheet and marks the action complete. The reviewer asks for more evidence. The missing link is often the explanation of why the failure occurred and how the response prevents it happening again.
A stronger response tells a short, verifiable story: what failed, what was corrected, what caused it, what changed and how you know the change works. The ISO/IAF Auditing Practices Group describes correction, cause analysis and corrective action as distinct parts of a response, with effectiveness verified during review. Its papers are guidance, not additional standard requirements.
1. Start with the recorded finding
Read the requirement, evidence and nonconformity statement together. If the scope is unclear, seek clarification from the audit contact before writing a response. Keep the response tied to the actual finding rather than rewriting the entire management system.
Record the agreed deadline and submission method. Certification bodies can have different response and verification arrangements. Do not apply a generic internet deadline to your audit.
2. Separate the immediate fix from the system change
Illustrative example, not a client case: a workshop releases three fabricated items without the final inspection record required by its own process.
- Immediate response: identify affected items, assess their status and consequences, and complete appropriate checks. Retain evidence of the decisions and any customer communication needed.
- Cause investigation: examine job allocation, release authority, system access and what happened on the relevant shift.
- Corrective action: change the release control to address the established cause, assign responsibility and demonstrate its use.
In this example, replacing three missing forms would not, by itself, explain why the release process allowed the gap.
3. Replace blame with a testable cause
“The employee forgot” describes an event. It does not explain the conditions that made it possible. Ask what the person could see, what the process required and what prevented an incomplete job from moving forward.
Suppose the investigation finds that the job system allowed dispatch without an inspection approval, while the backup inspector had no access to the approval screen. That is a specific explanation your team can test against records and interviews. It also directs attention to release controls and access permissions. Use the facts of your investigation; do not copy this cause into an unrelated finding.
4. Build one coherent evidence pack
Use a short index so the reviewer can connect the finding to the response. For the workshop example, the pack could contain the affected-job review, investigation notes, revised release workflow, evidence that access was corrected and completed jobs using the new control.
Explain each attachment in one sentence. “Release control changed on 4 November; the attached jobs show approvals after that date” is more useful than a folder of unexplained screenshots. Never create historical records to make the system appear to have operated differently.
5. Define how effectiveness will be checked
Decide what observation would show that the cause has been addressed. In the example, inspect a suitable sample of later dispatches, including work handled by the backup inspector, and check that release approvals are present and completed in the correct sequence.
Select the sample and review period according to risk, volume and the nature of the change. “Ten jobs over four weeks” might be a team's proposed method; it is not a universal ISO rule. Record who reviewed the evidence, the result and any further action.
Keep review responsibilities clear
Get-ISO can discuss an independent audit or gap assessment within an agreed scope. Independence and potential conflicts must be considered before accepting work. The appointed certification body determines whether its finding can be closed; an external assessment does not replace that decision.
Reference and further reading
ISO/IAF Auditing Practices Group: Nonconformity — review and closing and the APG guidance disclaimer. The workshop example and evidence-pack method are illustrative Get-ISO guidance. See also our audit preparation checklist.
General guidance. Use the applicable standard, scheme documents and agreed engagement criteria. Examples are illustrative and do not establish a certification outcome.