Section 6.4: Audit Follow-up: Root Cause Analysis, Corrective Actions, and Verification

Section 6.4: Audit Follow-up: Root Cause Analysis, Corrective Actions, and Verification

The audit process does not end with the closing meeting or the distribution of the audit report. The true value of a Quality Management System (QMS) audit is realized during the follow-up phase. This phase focuses on addressing the identified nonconformities, implementing corrective actions, and verifying that these actions have successfully prevented recurrence. Under ISO 9001:2015 Clause 10.2 (Nonconformity and Corrective Action) and ISO 19011:2018 Clause 6.6, the responsibilities are clearly divided: the auditee is responsible for determining and implementing the actions, while the auditor is responsible for evaluating their adequacy and verifying their effectiveness.

Core Concepts: Correction vs. Corrective Action

A common mistake in audit follow-up is failing to distinguish between correction and corrective action. Lead auditors must ensure the auditee understands and applies these distinct concepts:

• Correction (Containment or Disposition): The immediate action taken to eliminate a detected nonconformity. This addresses the symptom of the problem. Examples include sorting inventory, reworked parts, or calibrating an expired scale.
• Corrective Action: The action taken to eliminate the cause of a detected nonconformity to prevent its recurrence. This addresses the systemic failure. Examples include changing a procedure, training staff, modifying software, or buying new equipment.

For every nonconformity, the auditee must propose both an immediate correction to contain the current damage and a systemic corrective action to prevent it from happening again.

---

Root Cause Analysis (RCA)

Before a corrective action can be developed, the auditee must perform a Root Cause Analysis (RCA). If the root cause is not correctly identified, the corrective action will be ineffective, and the nonconformity will recur.

The Auditor's Role in RCA

The auditor does not perform the RCA for the auditee. Doing so would violate the rule against consultancy. However, the Lead Auditor must evaluate the auditee's RCA to ensure it is logical and goes deep enough. If the auditee lists the root cause as "human error" or "operator forgot," the auditor must reject the analysis. "Human error" is a symptom, not a root cause. The analysis must explain why the human made the error (e.g., lack of clear instructions, inadequate training, poor lighting, or fatigue).

Common RCA Methodologies

Auditees often use established quality tools to determine the root cause:

1. The 5 Whys: A simple, iterative interrogative technique used to explore the cause-and-effect relationships underlying a particular problem. By repeatedly asking the question "Why" (typically five times), the organization peels away the layers of symptoms to find the systemic root cause.
2. Ishikawa (Fishbone) Diagram: A visual tool that categorizes the potential causes of a problem into categories: Man, Machine, Method, Material, Measurement, and Environment (the 6 Ms).
3. 8D (Eight Disciplines): A structured problem-solving methodology used to identify, correct, and eliminate recurring problems, common in manufacturing.

---

Developing and Evaluating the Corrective Action Plan (CAP)

The auditee submits a Corrective Action Plan (CAP) to the Lead Auditor. The CAP must document:

• The correction taken.
• The identified root cause.
• The proposed corrective action.
• The individual responsible for implementation.
• The implementation deadline.
• The method and scheduled date for internal verification of effectiveness.

Evaluating the CAP

The Lead Auditor must review and either approve or reject the CAP. When evaluating the plan, the auditor asks:

1. Is the root cause logical, and does it address the systemic failure?
2. Does the proposed corrective action directly address the identified root cause?
3. Are the implementation deadlines realistic and reasonable? (e.g., minor NCs are usually resolved within 30-60 days; major NCs may require immediate containment within 10 days and full resolution within 90 days).
4. Is a specific individual assigned responsibility?

If the plan is inadequate (e.g., the corrective action does not match the root cause), the Lead Auditor must reject the CAP and request a revision.

---

Verification of Corrective Actions

Once the auditee has implemented the corrective actions, they must submit evidence of implementation and effectiveness to the auditor. The auditor must verify these actions before the nonconformity can be formally "closed."

Verification Methods

Depending on the severity of the nonconformity, the Lead Auditor determines the appropriate verification method:

• Desk Audit (Documentary Review): Used for minor nonconformities or where the evidence of correction is easily verified through documents (e.g., submitted training records, revised procedures, calibration certificates, or photographs). The auditee emails the evidence, and the auditor reviews it off-site.
• On-site Verification (Follow-up Visit): Mandatory for major nonconformities or complex systemic issues. The auditor travels back to the facility to observe the process in action, interview operators, and verify that the new controls are actually being followed and are effective.

Documenting Verification and Closure

When verifying, the auditor must collect objective evidence demonstrating that the corrective action has been implemented and is working. This evidence is recorded in the follow-up section of the nonconformity report. If the evidence is satisfactory, the Lead Auditor signs and dates the NCR, formally closing it. If the corrective action was ineffective (e.g., the same error was observed again during verification), the finding remains open, and the auditee must perform a new RCA and submit a revised plan. In third-party audits, failure to close a major nonconformity within the allowed timeframe will result in the suspension or withdrawal of the organization's ISO 9001 certification.