13.2 Quality Reviews of Audit Records

13.2 Quality Reviews of Audit Records

Quick Answer: Quality review of audit records verifies that working papers and the audit report are complete, accurate, clear, and traceable — criteria linked to evidence, findings worded so the auditee can act, and conclusions defensible to a certification body. ISO 19011 expects proper retention/disposal; ISO/IEC 17021-1 expects CB review before certification decisions.

Even strong fieldwork fails if the record cannot support the conclusion. Domain 5 tests whether you know what "good audit records" look like, who reviews them, and how poor documentation creates risk for the auditee, the audit team, and the CB.

---

1. What Counts as Audit Records

Audit records are broader than the final PDF report. Typical EMS audit record set includes:

Personal shorthand is fine during the day; by report issue, notes must be interpretable by another competent auditor or reviewer. If only the original author can decode them, the quality bar is not met.

---

2. Traceability: The Core Quality Test

A reviewer should be able to walk this chain without guessing:

1. Criterion cited (ISO 14001 clause, legal obligation, or documented EMS requirement)
2. Evidence collected (what, where, when, sample size / selection basis)
3. Evaluation (conformity, NC, OFI, or inconclusive / limitation)
4. Finding text (for NCs: clear statement of the gap)
5. Conclusion / grading (major/minor per programme rules; effect on certification recommendation)

Breaks in the chain are classic review findings against the audit team:

• NC cites "poor environmental culture" with no clause or evidence
• Notes say "waste OK" with no sample description for a high-risk hazardous-waste area
• Report grades a major, but working papers show a single administrative typo
• Benefit-of-the-doubt closure has no note that the missing certificate was later produced and verified

Exam tip: Traceability protects both fairness to the auditee and integrity of the certificate.

---

3. Who Performs Quality Reviews — and When

During the audit (Lead Auditor / team)

Daily team meetings are the first quality gate. The Lead Auditor reviews draft NCs for criteria linkage, evidence strength, and consistent grading across auditors. Conflicting judgments are reconciled with evidence, not egos.

Before report release (Lead Auditor accountability)

Under ISO 19011, the Lead Auditor is responsible for the audit report's content. That includes ensuring team inputs are consolidated, confidential information is handled correctly, and open items are statused per programme rules.

Certification body technical review (third-party)

ISO/IEC 17021-1 requires that certification decisions are made by personnel who were not part of the audit team, based on a review of audit conclusions and supporting information. Your records must stand alone: a reviewer who was not on site should understand why each NC exists and why conformity was concluded elsewhere.

Peer or programme review (internal / supplier audits)

Internal audit programmes often require independent review of reports before management review input. Supplier EMS audits may require buyer QA review. The quality criteria are the same: clarity, evidence, consistency.

---

4. Quality Checklist for Nonconformity and Report Content

Before you call records "done," stress-test them:

Nonconformity quality

• Requirement quoted or precisely referenced (not paraphrased into auditor opinion)
• Evidence factual, dated, and specific ("Manifest #1847 dated 12 Mar 2026 missing transporter signature" beats "waste paperwork issues")
• Gap logical (reader sees how evidence fails the requirement)
• Grading justified (systemic vs isolated; effect on EMS intended outcomes)
• Not mixing multiple unrelated gaps into one unworkable NC — or, conversely, artificially splitting one systemic failure to hide severity

Report quality

• Objectives, scope, criteria, client, auditee, dates, team identified
• Summary of findings and conclusions aligned with working papers
• Unresolved issues / limitations stated honestly (including where evidence remained inconclusive)
• Confidentiality and distribution controls observed
• OFIs clearly labeled so they are not treated as NCs in corrective-action systems

Language quality Avoid absolute claims you did not verify ("full legal compliance achieved") unless the audit objective and evidence truly support them. Prefer precise statements: "Within the sample examined, operational controls for solvent storage met the documented procedure and observed conditions."

---

5. Common Record Defects That Fail Reviews

1. Copy-paste criteria errors — wrong clause numbers (e.g., citing 8.2 for an operational-control failure that belongs under 8.1).
2. Evidence theater — long quotations from procedures with no test of implementation.
3. Invisible sampling — no explanation why those five effluent results or three contractors were chosen.
4. Grade drift — identical lapse graded minor in Plant A and major in Plant B without rationale.
5. Orphan OFIs — text that is clearly a requirement failure labeled "OFI" to avoid conflict (integrity failure).
6. Over-collection of sensitive data — unnecessary personal data or proprietary process detail retained beyond need.
7. Version chaos — final report disagrees with the NC log issued at closing.

Any of these can trigger CB queries, delayed certification decisions, or audit-programme nonconformities against the auditors.

---

6. Retention, Confidentiality, and Disposal

Quality review includes lifecycle control of records:

• Retain audit records for the period required by the audit programme, CB procedures, contracts, and applicable law (often years, not weeks).
• Protect confidentiality of auditee information — draft notes, photos of processes, and permit data are sensitive.
• Dispose securely when retention ends; do not leave unmarked USB drives or email archives uncontrolled.
• Own the boundary: report ownership typically sits with the audit client; team members follow programme rules on what they may keep personally.

Lead Auditors should confirm before the engagement how records will be stored (CB platform, client portal, encrypted share) and brief the team — quality includes information security hygiene, not only finding wording.

---

7. Linking Record Quality to Benefit of the Doubt

Sections 13.1 and 13.2 connect directly. When you apply benefit of the doubt, the record must show:

• What evidence was missing or conflicting
• What additional evidence was sought and the result
• Why an NC was not raised
• Any residual audit limitation communicated in the report

Silent leniency (no NC and no notes) fails quality review as badly as an unsupported NC. The defensible auditor leaves a trail that a technical reviewer can follow to the same professional judgment.

---

8. Practical Pre-Issue Review Routine

A compact Lead Auditor routine before releasing EMS audit records:

1. Re-read each NC aloud as if you were the process owner receiving it.
2. Spot-check three conformity areas: do notes show real sampling?
3. Confirm majors/minors match programme definitions and site risk.
4. Align closing-meeting slides / NC list with the draft report.
5. Strip or protect sensitive attachments not required for the decision file.
6. Verify names, dates, sites, and standard editions (ISO 14001:2015) are correct.
7. Sign off only when another competent reviewer could defend the file.

Mastering this routine is as examinable as knowing Clause 6.1.2 — certification credibility rests on both the fieldwork and the record.