Reports and quality
When the audit finds something
A finding is not a failure. What is: the same finding two years running.
The usual reaction to a finding is to fix the specific case and reply that it is corrected. It works for closing the paperwork and guarantees the same thing appears next year, because what was fixed was the symptom.
The three levels of response
| Level | What is done | What happens next year |
|---|---|---|
| Fix the case | The missing document is sorted | It reappears, with a different document |
| Fix the cause | What made it go missing is changed | It does not return, if that was the cause |
| Check it does not return | Look again after three months | It genuinely closes |
Important
The third level separates a system that works from one that reacts. A finding closed without later verification is not closed: it is waiting to be rediscovered.
How to respond well
- 1
Accept the finding if it is correct
Arguing when they are right costs credibility for when they are not.
- 2
Look for why it happened, not who did it
It is nearly always a process asking for something operations could not give.
- 3
Set an action with an owner and a date
An action without a name and a date is an intention.
- 4
And verify afterwards, with evidence
Three months later, looking at data rather than impressions.
Watch out
Beware the disproportionate corrective action. Adding three new controls for a minor finding creates a process nobody follows, and next year's finding will be that your invented controls are not followed.
What to have from last year
An auditor who sees a repeated finding acknowledged and explained judges very differently from one who discovers it themselves by comparing reports.
Worth knowing
The commonest findings on third-party documentation are always the same three: something expired undetected, something approved unchecked, and something that cannot be evidenced even though it was done. All three share a root.
›What if the finding is unfair?
Answer with evidence, not arguments. With the data, it falls by itself.
›How long is there to respond?
Whatever the scheme sets; the sensible pattern is immediate action and deferred verification.
›Should minor findings be recorded?
Yes: they are the ones that repeat and that foreshadow serious ones.
A real case
The situation
A company closes a finding by uploading the missing document.
What you do
- Looks into why it was missing and finds nobody owned the alert
- Verifies three months later
What you get
The finding does not repeat the following year, which was the real goal.
The situation
The audit leaves fourteen findings and six months later nine are still open.
What you do
- Records each finding with an owner, an action and a date
- Checks the open ones monthly, not the week before the next audit
- Closes with evidence of what was done, not with a «done»
What you get
The next audit finds nine fewer findings, and those remaining have dates.
The situation
Every finding is closed the day before the follow-up audit.
What you do
- Spreads the closing dates across the period
- Reviews progress halfway through
What you get
Closure reflects a real change rather than a three-day sprint.
The situation
A finding is assigned to a department and nobody specific picks it up.
What you do
- Assigns it to a named person
- Checks they have the permissions to close it
What you get
There is somebody to ask, and somebody who can act.
The situation
The finding is closed and the same problem reappears a year later.
What you do
- Notes the cause as well as the correction
- Checks whether that finding had come up before
What you get
You tackle what produces it rather than what is visible.
The situation
The auditor asks for evidence of closure and is shown an email.
What you do
- Attaches the evidence of what was done to the finding
What you get
Closure is demonstrated rather than asserted.
The situation
Minor findings nobody prioritises end up blocking certification.
What you do
- Marks which ones condition the certification
What you get
Effort goes to what actually blocks.
The situation
A finding you disagree with is accepted anyway.
What you do
- Records the disagreement with its reasoning
What you get
The position is documented for the next audit.
This article answers
- responding to an audit finding
- corrective action plan
- audit non-conformity what do i do
- closing a finding