1. Interpret the finding accurately

Start with the exact criterion, auditor evidence and required timeframe. Ask what evidence would demonstrate the required outcome.

2. Identify root cause

Examine whether the gap came from unclear responsibility, system design, capability, oversight or inconsistent implementation.

  • Use a structured why conversation.
  • Include roles closest to the process.
  • Check whether the issue exists elsewhere.
  • Record the reasoning behind the cause.

3. Define corrective action

Each action needs an owner, due date, expected evidence and a method for checking effectiveness.

4. Demonstrate implementation

Show that people understood and used the change, not only that a document was approved.

5. Test effectiveness

Sample the process after implementation and confirm the control produces the intended outcome.