After the audit
ISO audit nonconformities: preparing your response and corrective actions
After a nonconformity, clarify the finding and prepare correction, cause analysis and corrective action. Connect each measure to an owner and evidence, then explain how you will check the outcome. Confirm deadlines and response assessment arrangements with the certification body.
Correction and corrective action serve different purposes
Correction addresses the identified problem. Corrective action addresses its cause to prevent recurrence. The ISO 9001 Auditing Practices Group paper on closing nonconformities distinguishes these elements and emphasises checking effectiveness. It is audit guidance, not an additional standard.
Read the finding before choosing a solution
Start with the cited requirement, evidence examined and wording of the finding. Ask for clarification if needed. Avoid answering a different problem or promising changes before understanding what was observed.
For the internal discussion, record where it happened, which records are available, who knows the process and whether similar situations might exist elsewhere. Do not treat the first assumption as a confirmed cause.
Illustrative example: an unconfirmed customer requirement
Imagine an order where work began without a clear confirmation of requirements. A possible correction is to clarify that order and address its consequences. The analysis would then explore why the workflow allowed work to begin: unclear responsibility, an optional application field or an unhandled exception?
One possible action is to change the approval point and communicate responsibilities. The team might propose checking a sample of later orders, selected according to risk and volume. This constructed example is for explanation; it does not describe a real audit or prescribe a business’s solution.
A simple record for tracking the response
- Finding: the report identifier and described problem.
- Correction: what you did about the identified situation.
- Cause: the explanation supported by your analysis.
- Action: the proposed change and why you chose it.
- Owner and deadline: who will complete it and when.
- Evidence: records showing implementation.
- Outcome: how and when you will check whether it works.
This is a suggested way to organise information. Use the response format and requirements agreed for your audit.
Submit a response that can be followed
Clear filenames and a reference to each finding help readers understand the submission. Identify work in progress and evidence that will follow. Ask what still needs assessment; sending files alone does not confirm that the finding is closed.
See the role of internal audits and the certification process.
Frequently asked questions
Is changing a procedure enough?
It depends on the finding and cause. Explain what changed in practice and what evidence shows the outcome, as well as the revised text.
Does every nonconformity have the same deadline?
Do not assume a universal deadline. Confirm timing and assessment arrangements in the report and the certification body’s communications.
Sources and updates
Prepared by InterConformity using the sources below. Examples and working lists are illustrative. Confirm the scope and applicable arrangements with the team for your organisation.
Your next step
How does this apply to your business?
Tell us about your activities, team and target standard. Let’s clarify the steps and proposal.