Chapter 11 of 13 · Months 4–6
Auditor Interviews, Nonconformities, Corrective Action
- What will the auditor ask, and who should answer?
- What is the difference between a major and a minor nonconformity?
- How do I write a corrective action the auditor will accept?
Auditors interview people. They want to hear from the people who run controls, not only from you. This makes many GRC people nervous. It should not, if the system is real.
Preparing people for interviews
- Tell them what the audit is for and roughly what they may be asked.
- Ask them to describe what they actually do, in their own words.
- It is fine to say "I do not know, but I can find out" or "that is handled by another team."
- Bring evidence they would normally use, such as a ticket or a report.
- Never script answers. Scripted answers fall apart at the second question.
The question you might not ask out loud
Should I sit in every interview and answer for people?
Sit in if the auditor agrees, to take notes and fetch evidence. Do not answer for people. If you speak over a control owner, the auditor learns that the owner may not understand the control.
Kinds of finding
Certification bodies grade findings. The usual grades are a major nonconformity, a minor nonconformity and an observation or opportunity for improvement. A major usually means a requirement is not met at all, or a failure that puts the system in doubt. A minor is a single lapse that does not break the system. Check your certification body's own definitions; they set the rules for your audit.
Writing a corrective action
- Fix the immediate problem, such as removing the leaver's access.
- Find the root cause. Ask "why" until you reach something you can change.
- Check whether the same cause affects other areas.
- Choose an action that removes the cause, with an owner and a date.
- Say how you will check it worked, and when.
- Keep the evidence of each step.
Rule of thumb:"Retrain staff" is the most common weak corrective action. It is only right when the cause truly was missing knowledge. If the cause was a missing step in a process, change the process.
Corrective and preventive action, often shortened to CAPA, is the habit behind all of this. Auditors at surveillance visits will check that last year's actions were done and that they worked. A finding that comes back is a sign the root cause was not found.