Qms Audit Expert

QMS Audit Expert

ISO 13485 internal audit methodology for medical device quality management systems.

---

Table of Contents

• Audit Planning Workflow
• Audit Execution
• Nonconformity Management
• External Audit Preparation
• Reference Documentation
• Tools

---

Audit Planning Workflow

Plan risk-based internal audit program:

1. List all QMS processes requiring audit 2. Assign risk level to each process (High/Medium/Low) 3. Review previous audit findings and trends 4. Determine audit frequency by risk level 5. Assign qualified auditors (verify independence) 6. Create annual audit schedule 7. Communicate schedule to process owners 8. Validation: All ISO 13485 clauses covered within cycle

Risk-Based Audit Frequency

Audit Scope by Clause

Auditor Independence

Verify auditor independence before assignment:

• [ ] Auditor not responsible for area being audited
• [ ] No direct reporting relationship to auditee
• [ ] Not involved in recent activities under audit
• [ ] Documented qualification for audit scope

---

Audit Execution

Conduct systematic internal audit:

1. Prepare audit plan (scope, criteria, schedule) 2. Review relevant documentation before audit 3. Conduct opening meeting with auditee 4. Collect evidence (records, interviews, observation) 5. Classify findings (Major/Minor/Observation) 6. Conduct closing meeting with preliminary findings 7. Prepare audit report within 5 business days 8. Validation: All scope items covered, findings supported by evidence

Evidence Collection

Audit Questions by Clause

Document Control (4.2):

• Show me the document master list
• How do you control obsolete documents?
• Show me evidence of document change approval

Design Control (7.3):

• Show me the Design History File for [product]
• Who participates in design reviews?
• Show me design input to output traceability

CAPA (8.5):

• Show me the CAPA log with open items
• How do you determine root cause?
• Show me effectiveness verification records

See references/iso13485-audit-guide.md for complete question sets.

Finding Documentation

Document each finding with:

Requirement: [Specific ISO 13485 clause or procedure]
Evidence: [What was observed, reviewed, or heard]
Gap: [How evidence fails to meet requirement]

Example:

Requirement: ISO 13485:2016 Clause 7.6 requires calibration
at specified intervals.

Evidence: Calibration records for pH meter (EQ-042) show
last calibration 2024-01-15. Calibration interval is
12 months. Today is 2025-03-20.

Gap: Equipment is 2 months overdue for calibration,
representing a gap in calibration program execution.

---

Nonconformity Management

Classify and manage audit findings:

1. Evaluate finding against classification criteria 2. Assign severity (Major/Minor/Observation) 3. Document finding with objective evidence 4. Communicate to process owner 5. Initiate CAPA for Major/Minor findings 6. Track to closure 7. Verify effectiveness at follow-up 8. Validation: Finding closed only after effective CAPA

Classification Criteria

Classification Decision

Is required element absent or failed?
├── Yes → Systematic (multiple instances)? → MAJOR
│   └── No → Could affect product safety? → MAJOR
│       └── No → MINOR
└── No → Deviation from procedure?
    ├── Yes → Recurring? → MAJOR
    │   └── No → MINOR
    └── No → Improvement opportunity? → OBSERVATION

CAPA Integration

See references/nonconformity-classification.md for detailed guidance.

---

External Audit Preparation

Prepare for certification body or regulatory audit:

1. Complete all scheduled internal audits 2. Verify all findings closed with effective CAPA 3. Review documentation for currency and accuracy 4. Conduct management review with audit as input 5. Prepare facility and personnel 6. Conduct mock audit (full scope) 7. Brief personnel on audit protocol 8. Validation: Mock audit findings addressed before external audit

Pre-Audit Readiness Checklist

Documentation:

• [ ] Quality Manual current
• [ ] Procedures reflect actual practice
• [ ] Records complete and retrievable
• [ ] Previous audit findings closed

Personnel:

• [ ] Key personnel available during audit
• [ ] Subject matter experts identified
• [ ] Personnel briefed on audit protocol
• [ ] Escorts assigned

Facility:

• [ ] Work areas organized
• [ ] Documents at point of use current
• [ ] Equipment calibration status visible
• [ ] Nonconforming product segregated

Mock Audit Protocol

1. Use external auditor or qualified internal auditor 2. Cover full scope of upcoming external audit 3. Simulate actual audit conditions (timing, formality) 4. Document findings as for real audit 5. Address all Major and Minor findings before external audit 6. Brief management on readiness status

---

Reference Documentation

ISO 13485 Audit Guide

references/iso13485-audit-guide.md contains:

• Clause-by-clause audit methodology
• Sample audit questions for each clause
• Evidence collection requirements
• Common nonconformities by clause
• Finding severity classification

Nonconformity Classification

references/nonconformity-classification.md contains:

• Severity classification criteria and decision tree
• Impact vs. occurrence matrix
• CAPA integration requirements
• Finding documentation templates
• Closure requirements by severity

---

Tools

Audit Schedule Optimizer

# Generate optimized audit schedule
python scripts/audit_schedule_optimizer.py --processes processes.json

# Interactive mode
python scripts/audit_schedule_optimizer.py --interactive

# JSON output for integration
python scripts/audit_schedule_optimizer.py --processes processes.json --output json

Generates risk-based audit schedule considering:

• Process risk level
• Previous findings
• Days since last audit
• Criticality scores

Output includes:

• Prioritized audit schedule
• Quarterly distribution
• Overdue audit alerts
• Resource recommendations

Sample Process Input

{
  "processes": [
    {
      "name": "Design Control",
      "iso_clause": "7.3",
      "risk_level": "HIGH",
      "last_audit_date": "2024-06-15",
      "previous_findings": 2
    },
    {
      "name": "Document Control",
      "iso_clause": "4.2",
      "risk_level": "MEDIUM",
      "last_audit_date": "2024-09-01",
      "previous_findings": 0
    }
  ]
}

---

Audit Program Metrics

Track audit program effectiveness:

ISO 13485:2016 Internal Audit Playbook

This reference answers exactly one decision: how do we conduct an ISO 13485 QMS internal audit (Clause 8.2.4) that satisfies certification body expectations and supports MDR / FDA QSR alignment?

Pair with scripts/audit_schedule_optimizer.py (this skill) for cadence and with compliance-os/scripts/audit_simulator.py for mock-audit preparation.

When to Use This Playbook

• Annual Clause 8.2.4 internal audit programme
• Pre-stage-1 ISO 13485 certification readiness
• Surveillance audit preparation (year 2 / year 3)
• New medical device introduction (DHF closure audit)
• Post-CAPA closure verification audit
• Bridge audit for FDA QSR / EU MDR alignment

Key Difference from ISO 27001 Audits

ISO 13485 audits emphasize:

1. Design controls (Clause 7.3) — DHF/DMR completeness, design verification + validation evidence, traceability matrix 2. Process validation (Clause 7.5.6) — IQ/OQ/PQ for manufacturing + sterilization + cleaning processes 3. Document control (Clause 4.2) — strict version control + change control for all controlled documents 4. CAPA (Clause 8.5.2) — closed-loop with root cause analysis; "containment / correction / corrective action" distinction 5. Post-market surveillance (Clause 8.2.1) — vigilance reporting, customer feedback loop, trend analysis 6. Risk management (Clause 7.1 + ISO 14971) — risk file maintained across product lifecycle

ISO 13485 audits are more prescriptive than 27001 — auditors expect specific record formats, sign-offs, and traceability that 27001's risk-based approach does not require.

The 7-Phase Audit Workflow

Same 7-phase structure as ISO 27001 (Plan → Prepare → Open → Field → Close → Report → Track), with these QMS-specific differences:

Phase 1 Plan — Scope Selection

ISO 13485 organizes clauses by lifecycle activity. Audit fieldwork organizes by:

• Design controls (Clause 7.3) — DHF audit per product
• Production & service provision (Clause 7.5) — process validation evidence
• Management responsibility (Clause 5) — management review records
• Resource management (Clause 6) — competence + infrastructure + work environment
• Measurement, analysis, improvement (Clause 8) — internal audit programme + CAPA + nonconformity + statistical techniques

3-year rolling coverage: every clause audited at least once, with design + CAPA + post-market in higher rotation due to risk weight.

Phase 4 Field — QMS-Specific Sampling

For design controls (Clause 7.3) — sample DHFs:

• Stratified by product class (Class I, IIa, IIb, III per MDR; Class I/II/III per FDA)
• For each sampled DHF, verify:
• Design + development plan with stages + reviews defined
• Design inputs traceability to user needs / clinical requirements
• Design outputs verification evidence
• Design validation evidence (clinical evaluation per MDR Annex XIV / 510(k) summary per FDA)
• Design transfer evidence
• Design changes controlled per Clause 7.3.9
• DHF complete and archived

For CAPA (Clause 8.5.2) — sample CAPA records:

• Stratified by source (customer complaint, internal audit, management review, nonconformity)
• For each sampled CAPA, verify:
• Problem statement clear + measurable
• Root cause analysis evidence (5 Why, fishbone, Pareto, FMEA — pick the method)
• Containment + correction + corrective action distinction documented
• Effectiveness verification with evidence (re-test or sample post-implementation)
• Closure approved by appropriate authority

For post-market surveillance (Clause 8.2.1) — sample:

• Customer complaint log + investigation closure
• Vigilance reports (serious incident / FSCA) submitted per applicable regulation
• Trend analysis evidence + management review input
• Post-market clinical follow-up evidence (per MDR for high-risk devices)

Common Stage 1 / Stage 2 Findings (the patterns)

Based on practitioner reports of common ISO 13485:2016 findings:

1. Design changes not always controlled per Clause 7.3.9 — emergency changes bypass review 2. DHF incomplete — design history files missing one or more required elements 3. Process validation incomplete or stale — IQ/OQ/PQ done at original setup, never re-validated 4. CAPA effectiveness verification missing — corrective action closed without evidence of effectiveness 5. Risk management file not updated post-launch — ISO 14971 risk file frozen at release 6. Supplier evaluations exist but selection criteria not documented 7. Internal audit programme misses some clauses over 3-year cycle 8. Management review missing required inputs (audit results, nonconformity status, customer feedback, etc.) 9. Training records lack evidence of effectiveness verification 10. Document control: obsolete documents accessible in shared drives 11. Validation of software used in QMS (per Clause 4.1.6) not performed 12. Post-market surveillance plan exists but not executed quarterly

MDR 2017/745 + FDA QSR Overlap

ISO 13485 is the foundation for both EU MDR and FDA QSR compliance.

EU MDR cross-walk

FDA legacy QSR (21 CFR 820, historical) cross-walk

⚠️ STATUS — QMSR transition (effective 2026-02-02): FDA's QMSR final rule (89 FR 7496) amended 21 CFR Part 820 to incorporate ISO 13485:2016 by reference and removed the legacy QSR subsection structure. The 820.x numbers below no longer exist in the CFR — they are retained only as a familiar index for auditors mapping pre-2026 documentation. Cite the ISO 13485 clauses in current audits.

FDA finalized the QMSR rule in February 2024 (89 FR 7496) incorporating ISO 13485:2016 into 21 CFR 820, substantially harmonizing US and international requirements; it took effect 2026-02-02. An ISO 13485-certified QMS now substantially satisfies 21 CFR 820, with FDA-specific overlays in retained 820.10/820.35/820.45 (labeling, complaint records) and unchanged 21 CFR 803 MDR reporting.

Risk Management Audit (ISO 14971 Crosswalk)

Per Clause 7.1 + ISO 14971:2019, the risk management file (RMF) must be maintained for the device lifecycle. Audit should sample:

• Risk management plan exists per product
• Hazard identification covers reasonable foreseeable misuse
• Risk analysis applies probability × severity per ISO 14971
• Risk control measures applied per inherent safety → protective measures → information for safety hierarchy
• Residual risk evaluated + accepted (with rationale)
• Post-production information feeds back into RMF (concept drift equivalent for medical devices)

CAPA Discipline — The Highest-Stakes Audit Area

CAPA is the #1 cited area in 13485 + QSR audits. Auditors look for:

1. Containment vs correction vs corrective action distinction

• Containment: stop the bleeding (short-term)
• Correction: fix the symptom (medium-term)
• Corrective action: prevent recurrence by addressing root cause (long-term)

2. Root cause analysis depth — 5 Why minimum; ideally fishbone + Pareto for repeat issues 3. Effectiveness verification — measurable evidence the root cause is addressed; not "we updated the procedure" 4. Time to close — tracked + reported; aging CAPAs > 90 days are a smell 5. Trend analysis — repeat CAPAs across products signal systemic issue

Cross-Framework Reuse

This ISO 13485 audit playbook supports:

• EU MDR 745 — design dossier + technical documentation audits (see mdr-745-specialist)
• FDA QSR (21 CFR 820) — substantially harmonized post Feb 2026
• ISO 14971 — risk management file audit integrated with 7.1
• ISO 42001 for AI-enabled medical devices — A.6 lifecycle controls layer on top of 7.3 design controls

Pair with compliance-os/references/multi_framework_audit_playbook.md for medical-device multi-framework programs.

When This Reference Doesn't Help

• Specific medical device classification. See mdr-745-specialist + fda-consultant-specialist.
• Specific clinical evaluation. Per MDR Annex XIV; see mdr-745-specialist references.
• Software as medical device (SaMD). IEC 62304 specific; see risk-management-specialist + applicable references.
• External notified body audit. This is the internal audit playbook; external surveillance audits follow ISO 17021.

---

Source authorities (non-exhaustive):

• ISO 13485:2016 — Medical devices — Quality management systems (the standard)
• ISO 14971:2019 — Application of risk management to medical devices
• ISO/IEC 19011:2018 — Guidelines for auditing management systems
• ISO 17021-1:2015 — Conformity assessment requirements
• Regulation (EU) 2017/745 — Medical Device Regulation
• 21 CFR 820 — FDA Quality System Regulation (QSR / QMSR post-Feb 2026)
• FDA Final Rule (Feb 2024) — Quality Management System Regulation (incorporating ISO 13485 by reference)
• AAMI TIR45:2012 — Guidance on use of agile practices in development of medical device software
• IEC 62304:2006/A1:2015 — Medical device software lifecycle
• GHTF / IMDRF guidance documents — international harmonization context

ISO 13485 Audit Guide

Clause-by-clause audit methodology with sample questions and common findings.

---

Table of Contents

• Audit Approach
• Clause 4: Quality Management System
• Clause 5: Management Responsibility
• Clause 6: Resource Management
• Clause 7: Product Realization
• Clause 8: Measurement and Improvement
• Common Nonconformities

---

Audit Approach

Risk-Based Audit Planning

Prioritize audit focus based on:

Evidence Collection Methods

---

Clause 4: Quality Management System

4.1 General Requirements

Audit Questions:

• Show me documentation of your QMS scope and exclusions
• How do you identify processes needed for the QMS?
• Show me evidence of outsourced process control

Evidence to Review:

• [ ] Quality Manual or QMS description
• [ ] Process interaction diagram
• [ ] Outsourced process agreements

Common Findings:

• Scope exclusions not justified
• Outsourced processes not controlled
• Process interactions not defined

4.2 Documentation Requirements

4.2.1-4.2.2 Quality Manual and Documents

Audit Questions:

• Where is your documented quality policy?
• Show me the procedure for document control
• How do you ensure documents are current at point of use?

Evidence to Review:

• [ ] Quality Manual
• [ ] Document master list
• [ ] Sample of controlled documents

4.2.4 Control of Records

Audit Questions:

• What is your record retention policy?
• Show me the procedure for record storage and protection
• How do you ensure record legibility and retrievability?

Evidence to Review:

• [ ] Record control procedure
• [ ] Retention schedule
• [ ] Sample record retrieval test

Common Findings:

• Obsolete documents in use
• Records not legible or retrievable
• Retention periods not defined for all record types

---

Clause 5: Management Responsibility

5.1-5.2 Management Commitment and Customer Focus

Audit Questions:

• How does top management demonstrate commitment to QMS?
• Show me evidence of customer requirement determination
• How are regulatory requirements communicated?

Evidence to Review:

• [ ] Quality policy communication
• [ ] Management review minutes
• [ ] Customer feedback records

5.4 Planning

Audit Questions:

• Where are your quality objectives documented?
• Show me the plan for achieving quality objectives
• How do you maintain QMS integrity during changes?

Evidence to Review:

• [ ] Quality objectives (measurable, time-bound)
• [ ] Quality planning documentation
• [ ] Change management records

5.5 Responsibility and Authority

Audit Questions:

• Where are responsibilities and authorities defined?
• Who is the management representative?
• How is QMS performance communicated to top management?

Evidence to Review:

• [ ] Organization chart
• [ ] Job descriptions with QMS responsibilities
• [ ] Management representative appointment

5.6 Management Review

Audit Questions:

• Show me management review records from last 12 months
• What inputs are included in management review?
• What decisions and actions resulted?

Required Review Inputs:

• [ ] Audit results
• [ ] Customer feedback (including complaints)
• [ ] Process performance and product conformity
• [ ] CAPA status
• [ ] Changes affecting QMS
• [ ] Recommendations for improvement
• [ ] New/revised regulatory requirements

Common Findings:

• Management review not conducted at planned intervals
• Required inputs missing
• Action items not tracked to completion

---

Clause 6: Resource Management

6.1-6.2 Human Resources

Audit Questions:

• How do you determine competency requirements?
• Show me training records for personnel affecting quality
• How do you evaluate training effectiveness?

Evidence to Review:

• [ ] Competency requirements by role
• [ ] Training records
• [ ] Effectiveness evaluations

6.3-6.4 Infrastructure and Work Environment

Audit Questions:

• How do you determine infrastructure requirements?
• Show me maintenance records for critical equipment
• How is work environment controlled for product conformity?

Evidence to Review:

• [ ] Equipment list with maintenance schedules
• [ ] Environmental monitoring records
• [ ] Contamination control procedures (if applicable)

Common Findings:

• Training effectiveness not evaluated
• Preventive maintenance not performed on schedule
• Environmental conditions not monitored

---

Clause 7: Product Realization

7.1 Planning of Product Realization

Audit Questions:

• Show me the quality plan for a recent product
• How do you determine verification and validation activities?
• What records are required to demonstrate conformity?

Evidence to Review:

• [ ] Quality plan or project plan
• [ ] Risk management integration
• [ ] Required records defined

7.2 Customer-Related Processes

Audit Questions:

• How do you determine customer requirements?
• Show me the contract review process
• How do you handle customer communications?

Evidence to Review:

• [ ] Contract/order review records
• [ ] Customer requirement documentation
• [ ] Communication records

7.3 Design and Development

Audit Questions (per phase):

Evidence to Review:

• [ ] Design History File (DHF)
• [ ] Design review records with participants
• [ ] Verification/validation protocols and reports
• [ ] Design change requests

7.4 Purchasing

Audit Questions:

• How do you evaluate and select suppliers?
• Show me approved supplier list with evaluation criteria
• How do you verify purchased product?

Evidence to Review:

• [ ] Supplier evaluation procedure
• [ ] Approved supplier list
• [ ] Incoming inspection records
• [ ] Supplier audit records

7.5 Production and Service Provision

Audit Questions:

• Show me work instructions for production
• How are special processes validated?
• Show me traceability records for a product lot

Evidence to Review:

• [ ] Production work instructions
• [ ] Process validation records
• [ ] Device history records (DHR)
• [ ] Traceability records

7.6 Control of Monitoring and Measuring Equipment

Audit Questions:

• Show me calibration records for measuring equipment
• How do you handle out-of-tolerance conditions?
• How is software used for monitoring validated?

Evidence to Review:

• [ ] Equipment calibration records
• [ ] Calibration procedure
• [ ] Out-of-tolerance investigation records

Common Findings:

• Design inputs not completely addressed in outputs
• Supplier evaluations not performed or documented
• Process validation not maintained after changes
• Calibration overdue

---

Clause 8: Measurement and Improvement

8.2.1 Feedback

Audit Questions:

• How do you collect customer feedback?
• Show me complaint handling records
• How is feedback data used for improvement?

Evidence to Review:

• [ ] Complaint procedure
• [ ] Complaint log with trending
• [ ] Feedback to design/production

8.2.2 Internal Audit

Audit Questions:

• Show me the internal audit schedule
• How do you ensure auditor independence?
• Show me audit records and follow-up actions

Evidence to Review:

• [ ] Audit program/schedule
• [ ] Auditor qualification records
• [ ] Audit reports and findings
• [ ] CAPA records from audits

8.2.3-8.2.4 Monitoring and Measurement

Audit Questions:

• How do you monitor process performance?
• Show me product acceptance records
• What happens when acceptance criteria not met?

Evidence to Review:

• [ ] Process monitoring data
• [ ] Inspection records
• [ ] Nonconforming product records

8.3 Control of Nonconforming Product

Audit Questions:

• Show me the procedure for nonconforming product
• How do you prevent unintended use of nonconforming product?
• Who authorizes concessions/deviations?

Evidence to Review:

• [ ] NC product procedure
• [ ] NC product records
• [ ] Concession authorizations

8.4 Analysis of Data

Audit Questions:

• What data do you analyze for QMS effectiveness?
• Show me trend analysis for complaints, NC, CAPA
• How does data drive improvement?

Evidence to Review:

• [ ] Data analysis reports
• [ ] Trend charts
• [ ] Management review inputs

8.5 CAPA

Audit Questions:

• Show me the CAPA procedure
• How do you determine root cause?
• Show me CAPA effectiveness verification

Evidence to Review:

• [ ] CAPA procedure
• [ ] Open/closed CAPA log
• [ ] Root cause analysis records
• [ ] Effectiveness verification records

Common Findings:

• Complaint trending not performed
• CAPA not initiated for recurring issues
• Root cause analysis superficial
• Effectiveness verification not documented

---

Common Nonconformities

Top 10 ISO 13485 Audit Findings

Finding Severity Classification

Nonconformity Classification

Severity classification, CAPA integration, and finding documentation guidance.

---

Table of Contents

• Classification Criteria
• Severity Matrix
• CAPA Integration
• Finding Documentation
• Closure Requirements

---

Classification Criteria

Nonconformity Definitions

Classification Decision Tree

Is required element absent or failed?
├── Yes → Is failure systematic (multiple instances)?
│   ├── Yes → MAJOR NONCONFORMITY
│   └── No → Could it cause product safety issue?
│       ├── Yes → MAJOR NONCONFORMITY
│       └── No → MINOR NONCONFORMITY
└── No → Is there deviation from procedure?
    ├── Yes → Isolated or recurring?
    │   ├── Isolated → MINOR NONCONFORMITY
    │   └── Recurring → MAJOR NONCONFORMITY
    └── No → Is there improvement opportunity?
        ├── Yes → OBSERVATION
        └── No → NO FINDING

---

Severity Matrix

Impact vs. Occurrence Matrix

Clause-Specific Severity Guidance

---

CAPA Integration

Finding-to-CAPA Workflow

1. Classify finding (Major/Minor/Observation) 2. Document finding with objective evidence 3. Determine CAPA requirement (see table below) 4. Initiate CAPA with finding as source 5. Track resolution through closure 6. Verify effectiveness at follow-up audit 7. Validation: Finding closed only after CAPA effective

CAPA Requirement by Severity

Root Cause Depth by Severity

---

Finding Documentation

Finding Statement Structure

FINDING STATEMENT TEMPLATE:

Requirement: [Specific clause or procedure requirement]
Evidence: [What was observed, reviewed, or heard]
Gap: [How the evidence fails to meet the requirement]

Example:
Requirement: ISO 13485:2016 Clause 8.2.2 requires internal audits
at planned intervals to determine QMS conformity.

Evidence: Audit schedule shows Design Control audit planned for
Q2 2024. No audit records exist. Interview with QA Manager
confirmed audit was not conducted.

Gap: Internal audit for Design Control process not conducted as
planned, representing a gap in audit program execution.

Evidence Types and Requirements

Finding Writing Guidelines

Do:

• State objective evidence clearly
• Reference specific requirements
• Use factual, neutral language
• Include document/record identifiers

Don't:

• Use judgmental language ("poor", "inadequate")
• Generalize without evidence ("always", "never")
• Combine multiple findings
• Include corrective action suggestions

---

Closure Requirements

Closure Criteria by Severity

Major Nonconformity:

• [ ] Root cause analysis completed
• [ ] Corrective action implemented
• [ ] Effectiveness verified (objective evidence)
• [ ] No recurrence observed
• [ ] QA Manager sign-off
• [ ] Auditor verification

Minor Nonconformity:

• [ ] Immediate correction completed
• [ ] Root cause addressed (if applicable)
• [ ] Evidence of correction reviewed
• [ ] QA Manager sign-off

Observation:

• [ ] Action taken (if any) documented
• [ ] Noted for future reference

Verification Methods

Closure Documentation

CLOSURE RECORD TEMPLATE:

Finding ID: [NC-YYYY-XXX]
Original Finding: [Brief description]
Severity: [Major/Minor/Observation]

Corrective Action Taken:
[Description of action implemented]

Evidence of Implementation:
[Document numbers, dates, observations]

Effectiveness Verification:
[Method used, results, date]

Closure Approved By: [Name, Role, Date]

---

Audit Finding Log

Log Template

Status Definitions