Corrective Action Plans, Root Cause and Verification Evidence

Corrective action plans are your response to non-conformities found during the audit. A strong corrective action plan demonstrates that you understand the non-conformity, understand why it occurred and have a clear plan to fix it. A weak corrective action plan is generic, vague or treats the symptom without addressing the root cause.

The first step in writing a corrective action plan is understanding exactly what the auditor found. If the finding states “Clause 5.15 non-conformity: Impacts on individuals and society were not assessed”, you need to understand whether the auditor means that no impact assessments were conducted at all, or whether assessments were conducted but were incomplete or inadequate. Meet with the auditor to clarify if needed. Do not assume you understand the issue.

Once you understand the finding, conduct root cause analysis. Root cause analysis asks why the non-conformity occurred. For example, if the non-conformity is “No risk assessments conducted for three AI systems”, possible root causes include: the systems were deployed too quickly to allow time for assessment, staff did not know that risk assessment was required, the risk assessment methodology was not available at the time of deployment, or resources were allocated to other priorities. Each root cause points to a different corrective action.

If the root cause is lack of awareness, your corrective action is training and communication. If the root cause is an unavailable methodology, your corrective action is developing the methodology. If the root cause is deployment speed, your corrective action is changing the deployment process to require risk assessment completion before release.

Documenting Corrective Actions

When you document your corrective action plan, use this structure: State the non-conformity as the auditor described it. State what root cause analysis you conducted and what root cause you identified. State specifically what corrective action you will take. State who is responsible for taking the action and by what date. State what evidence will demonstrate that the corrective action has been taken and closed.

For example: Non-conformity: Three AI systems were deployed without risk assessment (Clause 5.15). Root cause: The risk assessment methodology was not defined at the time these systems were deployed. Corrective action: Risk assessment methodology will be documented by [date], reviewed and approved by [date], and applied retrospectively to the three affected systems by [date]. Evidence: Methodology document (attached), approval email and three completed risk assessments.

Be realistic about timelines. If you commit to closing a finding in 30 days and it takes 60 days, you will be in breach of your corrective action plan. If you are uncertain about the timeline, build in safety margin. Explain to the auditor if circumstances change (e.g., a key person goes on leave) and you need to extend your timeline.

Verification Evidence

When you submit evidence to verify closure of a non-conformity, ensure that the evidence genuinely demonstrates closure. Do not submit evidence that only shows intention. For example, if the corrective action was to conduct risk assessments for three systems, the evidence should be the completed assessments, not a plan to conduct assessments or a meeting agenda.

For some non-conformities, verification evidence requires demonstrating that new controls are operating, not just in place. For example, if the non-conformity was “Incident escalation procedures were not followed in two incidents”, your corrective action might be to revise the procedure and provide training. Your verification evidence should include the revised procedure, training records and evidence of two new incidents since the training where the procedure was correctly followed.

Auditors will re-examine evidence sampling for verification. They might select different incidents to test or interview different staff members. Be prepared for the possibility that the auditor’s verification reveals additional issues that you will need to address before closure is confirmed.

Once you have submitted corrective action evidence, the auditor will review it and either accept closure or request additional evidence. Typically, you will hear within 10 to 15 business days whether closure has been accepted.

A final point about corrective actions is that they should result in genuine improvement, not just paperwork fixes. If a non-conformity arose because staff were not aware of a control, adding a control to a document does not close the finding. Training staff and retaining evidence of their training closes the finding. This distinction between apparent compliance and genuine compliance is what auditors look for during verification.