The Closing Meeting & Follow-up Actions

Lesson 9 covered writing the report. This lesson covers the audit's final on-site activity — the closing meeting — and what happens afterward to actually resolve the findings it presents.

No surprises at the closing meeting

A well-run closing meeting should contain no surprises: every finding presented should already have been discussed with the relevant people during the audit itself (Lesson 5's ongoing communication), not revealed for the first time in the closing meeting. The closing meeting's purpose is to formally present the findings and their classifications (Lesson 8), confirm the auditee understands them, discuss the timeline and process for corrective actions, and explain what happens next (report finalization, certification decision timing, any follow-up audit requirements for major nonconformities). An auditor who saves a significant new finding for a dramatic reveal at the closing meeting has violated the fair presentation and communication expectations that should have applied throughout the audit, not just at its conclusion.

Handling a disputed finding

Occasionally, the auditee disagrees with a finding or its classification at the closing meeting. The correct response isn't to simply back down to avoid conflict, nor to refuse any discussion at all — it's to revisit the specific evidence together: does the auditee have additional evidence that wasn't available to the audit team, which might genuinely change the finding? Or is the disagreement really about interpretation of a criterion, not the underlying facts? If genuinely new, relevant evidence is presented, the finding should be reconsidered on its merits (echoing Lesson 7's discipline). If the auditee simply disagrees with an accurately evaluated finding, it stands, and the disagreement itself (with the auditee's stated position) is often documented in the final report — which is itself part of fair presentation, since a report that silently omits a genuine, substantive disagreement doesn't accurately reflect what happened.

Corrective actions: symptom vs. root cause

Once a nonconformity is accepted, the auditee proposes a corrective action. A corrective action that only fixes the immediate instance ("we've now disabled the one departed employee's account that was still active") is a correction, not a full corrective action — it addresses the symptom, not why the process allowed it to happen. A genuine corrective action addresses the underlying cause (e.g., "we've implemented an automated daily reconciliation between HR's departure records and IT's active account list, so this type of gap is caught within 24 hours going forward"). This exact distinction was introduced in Foundation's clause 9-10 lesson and Implementer's practice — this roadmap now applies it from the auditor's side: an auditor reviewing a proposed corrective action plan should specifically check whether it addresses root cause, not just accept whatever the auditee proposes at face value.

Verifying closure actually happened

A corrective action plan with a committed date isn't itself closure — closure requires verifying, typically at the next scheduled audit (surveillance, for a minor nonconformity) or a dedicated follow-up visit (often required for a major nonconformity), that the corrective action was actually implemented and is functioning, not just documented as complete. An auditor who accepts a written statement that "this has been fixed" without requesting evidence of the fix (new records, a demonstration, an updated process) at the follow-up point is repeating exactly the evidence-based approach failure this roadmap has warned against since Lesson 1 — just applied to closure instead of the original finding.

Why this final stage matters as much as the earlier ones

An audit's overall value is only as real as its follow-through. A perfectly conducted audit whose findings are never verified as actually corrected produces a certificate (or an internal audit report) that no longer reflects reality by the time anyone relies on it. This is why audit programs (Lesson 2) explicitly track corrective action status as one of their core ongoing records, not treat the closing meeting as the effective end of the audit's real work.