Four steps
- Acceptance: the process owner accepts the finding and its class, or objects; the objection is recorded too.
- Plan: correction, root cause, corrective action, owner, due date.
- Implementation: the work is done and its evidence recorded.
- Verification: after enough time, effectiveness is tested; only then does it close.
Whose decision closure is
The auditor who raised the finding, or the person managing the audit programme, closes it — a process owner cannot close their own finding. That is auditor independence applied to the follow-up stage.
Open findings as an indicator
Two numbers are tracked and reported to management:
- the number of open findings,
- the age of open findings — particularly those past their due date.
Age says more than count: if all ten open findings are from this month the system is working; if two are two years old it is not.
Recurring findings
A finding raised again shows the earlier corrective action never reached the root cause. Recurring findings are flagged separately and the root cause analysis is redone, deeper — the real cause is usually one layer above what was found the first time.