nonconformity-root-cause-and-corrective-action
Use this for each finding on its own; batch only findings that clearly share a cause. You get one document per finding in a new folder, ./nonconformity-root-cause-and-corrective-action/: a draft response the team can send to the auditor once signed, holding the finding restated, the root cause analysis, the action plan, the effectiveness check and a ready-to-paste row for the finding tracker (<finding-id>.md). This skill drafts for a human to review and sign; this skill never marks a control effective. The auditor decides whether the response is acceptable.
Inputs to gather
The finding exactly as the auditor wrote it (grade, requirement reference, evidence the auditor saw, the sample), the audit report section around it, and the documents and records the finding names. Ask the reader who owns the process, whether the auditor gave a response deadline, and whether the same area had findings before. Previous findings on the same process change the analysis: a repeat finding means the last corrective action did not work, so Step 3 must explain why it failed, and why its effectiveness check did not catch the failure.
Check the grade first. A major finding usually carries a response window and follow-up rules set by the certification body; escalate it to the accountable manager the same day. An observation or opportunity for improvement needs a considered accept or decline with a reason, not a root cause analysis and an action plan the team then has to deliver.
Step 1: restate the finding in one line
Write what was expected, what was found and the evidence, in the auditor's terms. If the team disagrees with the finding, say so here with facts and stop: a disputed finding goes back to the auditor before any root cause work. Do not soften the wording; auditors read a reworded finding as a sign the team did not understand it.
Step 2: separate correction from corrective action
- Correction fixes the instance the auditor saw: revoking the leaver's account, approving the missing change, updating the expired document. If the owner already made it, record what was done, by whom and the proof. If not, draft it as a proposed correction for the owner to approve and carry out promptly; the agent never makes it.
- Corrective action removes the cause so the problem does not come back anywhere. Most rejected responses are a correction presented as a corrective action.