Close the cause, then check the result

PRACTICAL GUIDANCE

The starting point

A useful corrective action record explains the requirement, the evidence, the cause and what will demonstrate that the problem has been addressed. Completing a task and demonstrating effectiveness are different steps.

Start with a clear finding

A nonconformity is a failure to meet a requirement. Before responding, make sure the finding identifies the relevant criterion and the evidence that supports the gap. If the wording is unclear, ask for clarification rather than guessing which change the auditor expects.

Our suggested record begins with the finding reference, requirement, observed evidence, affected process and responsible owner. Preserve enough detail to understand the issue later. Avoid replacing a specific finding with a vague label such as “documentation issue”, which can hide whether the real problem was ownership, implementation or an incorrect decision.

Separate correction from corrective action

Correction addresses the identified problem. Corrective action addresses its cause so that recurrence is less likely. Cause analysis and checking effectiveness are therefore important parts of reviewing an organisation’s response.

Illustrative example: an inappropriate active account is disabled. That corrects the observed access condition. The organisation then investigates why its leaving process missed the account, changes the relevant arrangement and checks later cases. The example does not establish the correct response to every access incident; the facts and wider consequences still need assessment.

Investigate extent and cause

Our recommendation is to ask two different questions: where else might this problem exist, and why did the process allow it to occur? The first helps define the affected population and immediate work. The second guides a more durable change.

Use a cause analysis method proportionate to the issue. A short structured discussion may be enough for a simple failure; a complex incident may need specialist investigation. Do not stop at “human error” without considering the instructions, workload, information, authority and checks surrounding the decision. Avoid selecting the cause merely because it is easy to fix.

Make the action testable

For each action, record the owner, intended outcome, due date, dependencies and evidence of completion. If the action is to revise a process, identify which step will change and how affected people will learn about it.

Define the effectiveness test before marking the action complete. For example, inspect an appropriate later sample, repeat an exercise or examine whether the same failure pattern continues. Choose a review point that provides meaningful evidence; an immediate check may show that a document changed without showing whether the new process works.

Close with evidence and retain the learning

Our recommended closure record distinguishes action completed, effectiveness checked and formal acceptance where the external audit process requires it. Keep links to the supporting evidence and record who made the conclusion.

If the action did not work, reopen the issue or define further action rather than changing the success criterion after the event. Review repeated findings across processes. Several local failures may point to a common problem in resources, ownership or change management. Management review can then address the wider issue instead of approving the same small fix repeatedly.

A practical response structure

The following is an editorial working structure, not a mandatory form. Adapt it to your standard, risk and certification body’s process.

• Requirement and evidence: what was expected, and what was observed?
• Extent and immediate response: what is affected, and what needs prompt attention?
• Cause analysis: what allowed the failure, supported by what evidence?
• Action: what will change, who owns it, and by when?
• Effectiveness: what later evidence will demonstrate the intended result?
• Closure: who reviewed the evidence and what conclusion was reached?

Related guidance and practical next steps