Auditing Improvement: Tracing Nonconformities Through to Closure

Why Closure Is Where Most Audit Programmes Fall Apart

Raising a nonconformity is the easy part. Writing it up, presenting it at the closing meeting, handing it to the auditee organisation and walking out the door, that part most auditors handle reasonably well. The part that consistently fails is what comes after. The follow through. The verification. The confirmation that the problem was actually fixed, not just papered over.

This article is about that gap. It is aimed at internal auditors, lead auditors, and quality managers who run audit programmes and want to make sure their nonconformities drive genuine improvement rather than disappear into a corrective action register that nobody checks.

If you have ever closed out a nonconformity based on a response that looked plausible but did not actually verify anything, this is the article for you.

Understanding What Closure Actually Means

Before you can trace a nonconformity to closure, you need to be clear on what closure means. A lot of organisations treat it as an administrative event. The corrective action owner writes something in the register, attaches a document, and marks the status as closed. That is not closure. That is paperwork.

Real closure means the root cause has been identified, the corrective action taken addresses that root cause, and there is objective evidence that the action was effective. All three elements must be present. If any one of them is missing, the nonconformity is not genuinely closed, regardless of what the register says.

The Three Elements of Genuine Closure

• Root cause identified: The organisation has gone beyond describing the symptom and has identified why the problem occurred. This is not always a single cause. It can be a chain of contributing factors.
• Corrective action implemented: Something has actually changed. A procedure was updated and communicated. A control was put in place. A training session was delivered. Not planned. Done.
• Effectiveness verified: There is evidence that the change worked. This means looking at what happened after the action was taken, not just confirming the action happened.

When you understand closure this way, it becomes obvious why so many corrective actions fail. Organisations skip root cause analysis, implement a surface fix, and declare victory. The same nonconformity then reappears at the next audit. If you have seen that pattern, you are not alone. It is one of the most common frustrations in audit practice.

The Corrective Action Process: What ISO Standards Require

Most ISO management system standards require a corrective action process that follows a consistent structure. Under ISO 9001 Clause 10.2, for example, the organisation must react to the nonconformity, evaluate the need for action to eliminate the root cause, implement action, review effectiveness, and update risks and opportunities if necessary. ISO 14001 and ISO 45001 have equivalent requirements under their respective Clause 10.2 provisions.

What this means practically is that the standard does not just ask organisations to fix things. It asks them to understand why things went wrong and to verify the fix worked. Auditors who do not check for all of these elements are not auditing the full requirement.

What the Standard Does Not Prescribe

The standards do not mandate a specific root cause analysis method. They do not require a five why analysis or a fishbone diagram. What they require is a systematic approach that is proportionate to the significance of the nonconformity. A minor nonconformity related to a missing record might be resolved with a straightforward process reminder and a check that the record is now being completed correctly. A major nonconformity involving a systemic failure in supplier control requires considerably more rigour.

As an auditor, you need to exercise judgement about whether the depth of analysis is proportionate. A one line root cause for a complex systemic failure should raise your suspicion immediately.

Tracing a Nonconformity: A Practical Walkthrough

Let us walk through what tracing a nonconformity to closure actually looks like in practice. Imagine you raised a nonconformity during an internal audit of an information security management system. The finding was that access rights for three former employees had not been revoked within the required timeframe, contrary to the organisation's own access control procedure.

Step 1: The Immediate Correction

The first thing the organisation should do is fix the immediate problem. In this case, that means revoking the access rights for the former employees. This is the correction, not the corrective action. It addresses the symptom. You want to confirm this happened, but it is not sufficient on its own.

When you review the corrective action response, check that the correction is documented. Who revoked the access? When? Is there a record? If the organisation cannot demonstrate the correction was made, you have a problem right there.

Step 2: Root Cause Analysis

Now the organisation needs to explain why the access rights were not revoked. Acceptable root cause analysis might reveal that the HR offboarding process does not include a step to notify the IT team when an employee leaves. Or that the IT team is notified but has no formal checklist to confirm all access points have been covered. Or that the access control procedure was updated six months ago but the team responsible was not informed of the change.

What is not acceptable as a root cause is something like staff were not following the procedure. That is a description of the nonconformity, not an explanation of why it occurred. Push for the underlying reason. Why were staff not following the procedure? Was it unclear? Were they unaware of it? Was there no mechanism to prompt compliance?

Step 3: The Corrective Action

Once the root cause is understood, the corrective action should logically address it. If the root cause was that HR does not notify IT when employees leave, the corrective action might be to add an IT notification step to the HR offboarding checklist and to verify that this step is being completed through periodic checks.

When you review the corrective action, ask yourself whether it would actually prevent recurrence. If the root cause was a process gap, a training session alone is unlikely to be sufficient. If the root cause was a lack of awareness, updating a procedure without communicating it does not solve the problem.

Step 4: Verifying Effectiveness

This is the step that gets skipped most often. Verifying effectiveness means checking whether the corrective action actually worked. It requires some time to pass. You cannot verify effectiveness the week after the action was implemented. You need to see evidence that the changed process or control is working in practice.

For the access control example, effectiveness verification might involve reviewing the HR offboarding records for the three months following the corrective action to confirm that IT was notified in every case and that access was revoked within the required timeframe. If the records show consistent compliance, the corrective action was effective. If there are gaps, it was not, and further action is required.

As an auditor, when you return for a follow up audit or a surveillance audit, this is what you should be checking. Not just whether the action was taken, but whether it worked.

Common Failure Modes in Corrective Action Follow Up

There are several patterns that auditors encounter repeatedly when reviewing corrective action processes. Recognising them helps you ask better questions.

The Action That Was Never Implemented

The corrective action register shows an action was planned. The due date has passed. When you ask for evidence of implementation, the auditee cannot produce it. This is surprisingly common. The action was documented in good faith, but nobody followed through. This is a failure of the corrective action process itself and may warrant a new nonconformity about the management of corrective actions.

The Action That Addressed the Wrong Root Cause

The organisation conducted root cause analysis but reached the wrong conclusion. The corrective action was implemented correctly based on that conclusion, but because the root cause was misidentified, the problem has continued or recurred. This requires you to revisit the root cause analysis, not just the action.

The Effectiveness Check That Was Not Evidence Based

The corrective action register shows an effectiveness verification date and a note that says something like action reviewed and found effective. When you ask what was reviewed, the auditee cannot point to specific records or data. This is a common shortcut. Effectiveness verification must be based on objective evidence, not a subjective assessment that things seem better.

The Systemic Issue Treated as an Isolated Event

A nonconformity is raised against one instance of a problem. The organisation fixes that instance but does not consider whether the same failure mode exists elsewhere in the system. For example, if one supplier was found to have no current approval on file, the corrective action should not just be to update that one supplier's record. The organisation should check whether the same gap exists for other suppliers and address any systemic weakness in the supplier approval process.

As an auditor, you should be asking whether the scope of the corrective action is proportionate to the scope of the problem. For related guidance on raising findings that prompt this kind of thinking, see our article on how to write a nonconformity report that actually gets fixed.

How to Structure Your Follow Up Audit

When you return to verify corrective actions, whether as part of a formal follow up audit or during the next scheduled internal audit, you need a structured approach. Turning up and asking did you fix it? is not an audit. You need to plan what evidence you will look for and how you will assess it.

Preparing for Follow Up

Before the follow up audit, review the original nonconformity report. Remind yourself of the specific evidence that led to the finding, the clause that was not met, and the corrective action that was proposed. Then review the corrective action response the organisation submitted. Note any gaps or questions in the response that you want to explore during the audit.

Prepare specific questions and identify the records you want to see. If the corrective action involved updating a procedure, you want to see the updated procedure and evidence that it was communicated. If it involved training, you want to see training records. If it involved a process change, you want to see records from after the change that demonstrate the new process is being followed.

Conducting the Follow Up

During the follow up, work through the three elements of closure systematically. Confirm the correction was made. Assess whether the root cause analysis is credible and proportionate. Review the corrective action against the root cause to confirm it logically addresses it. Then examine the effectiveness evidence.

Do not accept verbal assurances. If the auditee tells you the problem has been fixed, ask to see the evidence. If they say the team has been retrained, ask to see the training records. If they say the procedure was updated, ask to see the updated procedure and the communication that went out to the team.

Be specific about the timeframe. If the corrective action was implemented two weeks ago, it may be too early to verify effectiveness for anything other than the most straightforward fixes. In that case, you may need to schedule a second follow up or note in your report that effectiveness verification is pending.

Documenting Your Closure Decision

When you decide a nonconformity can be closed, document your reasoning. Your audit records should show what evidence you reviewed, why you concluded the root cause analysis was adequate, why you assessed the corrective action as appropriate, and what evidence you relied on to confirm effectiveness.

This matters for two reasons. First, it provides a clear record if the same issue recurs later. Second, it demonstrates that closure was based on evidence, not a subjective judgement call. If a certification body auditor later reviews your internal audit records and finds that nonconformities were closed without documented evidence of effectiveness, that is itself a finding against your audit programme.

For a broader look at how to document audit outcomes clearly, our article on managing corrective actions after an ISO audit covers the practical mechanics in detail.

When to Escalate Rather Than Close

Not every corrective action response warrants closure. There are situations where you need to escalate rather than accept the response and move on.

If the root cause analysis is superficial and does not credibly explain the failure, send it back. If the corrective action does not logically address the identified root cause, send it back. If the effectiveness verification is not based on objective evidence, send it back. If the same nonconformity has recurred despite a previous corrective action, this warrants a more serious conversation about whether the management system is functioning effectively.

In an internal audit context, escalation might mean raising the matter with the management representative or including it as an agenda item for the management review. In a certification audit context, a corrective action response that does not meet the standard may result in the nonconformity remaining open, with consequences for the certification decision.

The key point is that closing a nonconformity prematurely does not help anyone. It creates a false sense that the system is working when it is not, and it sets up the organisation for a repeat finding at the next audit.

Building a Culture Where Corrective Actions Actually Get Done

The technical process of tracing nonconformities to closure is only part of the picture. The other part is organisational culture. In organisations where corrective actions are treated as administrative burdens rather than genuine improvement opportunities, the process will always be weak regardless of how well the audit programme is designed.

As an auditor, you can influence this by the way you write and communicate your findings. Nonconformities that are clearly written, linked to specific evidence, and explained in terms of the risk or impact they create are more likely to be taken seriously. Vague or bureaucratic findings that people cannot understand are more likely to be dismissed or dealt with superficially.

You can also influence it by following through consistently. If auditees know that corrective actions will be properly verified at the next audit, they are more likely to take them seriously. If they know that a cursory response will be accepted, the quality of responses will reflect that.

For auditors who want to strengthen their skills in this area, the root cause analysis for corrective actions article provides practical techniques for evaluating the quality of root cause analysis during audits.

Linking Nonconformity Closure to Continual Improvement

One of the things that distinguishes a mature management system from a compliance exercise is whether nonconformities feed into genuine continual improvement. This means not just closing individual nonconformities but looking at patterns across the audit programme and using that data to identify systemic weaknesses.

When you review corrective action data at the management review, ask whether there are recurring themes. Are the same clauses generating nonconformities repeatedly? Are certain processes or departments consistently struggling? Are corrective actions being completed within agreed timeframes? This kind of analysis turns the corrective action process from a reactive exercise into a proactive improvement tool.

For internal auditors who want to build this capability, the article on from findings to improvement: corrective action follow up for internal auditors walks through how to make this connection practical.

Practical Training That Covers the Full Audit Cycle

Tracing nonconformities through to closure is a skill that takes practice to develop. It requires judgement about root cause quality, an understanding of what effective corrective actions look like across different types of management systems, and the confidence to push back when a response is not adequate.

At Audit Workshop, our internal auditor and lead auditor courses cover the full audit cycle, including corrective action follow up and effectiveness verification. Training is delivered by Dilawar Laghari, who has conducted more than 500 external ISO certification audits across quality, environmental, and safety management systems. The courses are built around real audit scenarios, not just theory, so you come away with practical skills you can apply immediately.

If you are developing your auditing skills or looking to strengthen your understanding of the improvement clauses across ISO 9001, ISO 14001, ISO 45001, or ISO 27001, our courses are worth exploring at auditworkshop.com.