What happens if an auditor finds something wrong?

Ask the auditor to explain the requirement, the evidence they examined and the gap they found. A finding needs an actionable response. Its effect on certification or a report depends on the assessment and the nature of the problem.

Do not invent missing records or rewrite history to make a finding disappear. Keep the original evidence and show what you changed afterward.

Establish the type of finding

For ISO certification, a nonconformity means a requirement has not been met. Its classification affects the response and what the certification body needs before making its decision. An improvement suggestion is different from a nonconformity.

Your certification body’s procedures determine response deadlines and verification requirements. NQA’s guidance on nonconformities illustrates how its process distinguishes findings and the evidence needed to address them. Confirm the rules with your own body rather than borrowing another body’s deadlines.

For SOC 2, discuss exceptions and their effect on the report with the CPA firm. Do not assume ISO’s classifications or closure process apply to that examination.

Correct the immediate problem

Suppose an access review missed a former employee’s account. Revoke the access and establish whether it was used after departure. Record what you found and handle any suspected incident through the appropriate process.

That immediate correction matters, but it does not explain why the account was missed.

Address the cause

Examine the process that allowed the gap. Was the system absent from the inventory? Did HR notify the wrong owner? Did the reviewer receive an incomplete account list?

Choose an action that addresses the identified cause. Assign an owner and a date, then decide how you will check that the action works. A reminder to “be more careful” gives the next reviewer little to verify.

Keep evidence of the follow-up

Retain the finding, your cause analysis, the corrective action and the verification result. If a later check still finds the same problem, reopen the work. Do not close it merely because a ticket says the implementation is complete.

An internal audit can expose these gaps before the external assessment. Yrso can organise the findings and follow-up actions, and our team can perform an evidence-driven internal audit. The external assessor decides whether the response meets its requirements.