Skip to content

IA202614 — Corrective Actions

Audit Record

Field Value
Audit reference IA202614
Area audited Nonconformity and corrective action
Audit criteria ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018 clause 10.2 · SOP 7.1 · SOP 6.2 · FORM_CAR001
Audit date 07/05/2026
Auditor Sean Ashton, HSQE Consultant, Onyx Operations Ltd
Auditees Aaron Mason (Director), Leanne Mason (Director)
Result Conforms. 0 non-conformities, 0 observations
Previous audit of this area IA202514, 2025 cycle
Form FORM_INTAR001 Rev 1 ID 01/09/2025

1. Scope, criteria and independence

1.1 Scope

How a nonconformity is raised, investigated, actioned, closed and verified, across every route by which one can arise — customer complaint, internal observation, audit finding, inspection, incident or regulatory contact.

Clauses examined: 10.2.1 a) to g) and 10.2.2 in all three standards. ISO 45001 10.2 carries additional requirements on worker participation in investigation and on reviewing existing risk assessments after an incident; those are examined here. Clause 10.3 continual improvement is audited at IA202606.

1.2 Independence

The auditor is an external HSQE consultant engaged through Onyx Operations Ltd. He is not an employee of AMWS and holds no line responsibility for the work audited. SOP 6.2 requires that an auditor does not audit work for which they are also responsible; AMWS has no second competent auditor, and the consultant drafted much of the documented system. The mitigation applied is that no document is tested against its own wording. Each clause is tested against records, against what the people responsible describe doing, and against what can be produced on request. Findings are reviewed and countersigned by a Director, who holds the authority to accept or reject them.

The auditor is the named owner of several of the corrective actions sampled. Those records were tested on the same basis as the rest: whether the record contains what the clause requires, not whether the action is a good one.

2. Method and sample

Method What was covered
Document review SOP 7.1 Customer Complaints, Control of NCR & Corrective Action Issue 3 (01/05/2026) · SOP 6.2 Internal HSQE Audits Issue 3 · MAN_01 Rev 3 (30/04/2026) section 9.1 · FORM_CAR001 Rev 1 ID 01/09/2025
Registers examined APP_21 Nonconformity & Corrective Action Register at Issue 3, approved 04/05/2026
Records sampled All seven corrective action reports raised in the current cycle to the audit date — CAR-2026-001 to CAR-2026-007 — read in full against the clause. All twenty-three reports from the 2025 cycle read for structure and for the presence of root cause, owner and target
Interview Both Directors, on how an operational problem reaches a record, who allocates the number, and what happens when a target date passes
Walkthrough One corrective action traced end to end from the audit observation that raised it, through the report, to the register entry

3. Result against each clause

3.1 Clause 10.2.1 — Reacting to nonconformity

Clause What the standard requires Objective evidence examined Result
10.2.1 a) React to the nonconformity — take action to control and correct it, and deal with the consequences SOP 7.1 Issue 3 opens with the single route: "A M Water Services treats every non-conformance — whether raised by a customer complaint, an internal observation, an audit finding, an inspection, an incident or a regulatory contact — through one consistent procedure that allocates a unique NCR number, investigates root cause, agrees corrective action with a named owner and target date, tracks completion to closure, verifies effectiveness, and feeds analysis into the wider improvement cycle." MAN_01 Rev 3 section 9.1 states the same sequence. Containment is a distinct field on FORM_CAR001 and was completed on each of the seven reports sampled Conforms
10.2.1 b) Evaluate the need for action to eliminate the causes so that it does not recur, by reviewing and analysing the nonconformity, determining its causes, and determining whether similar ones exist or could occur FORM_CAR001 carries Root Cause as a required section, split into a primary cause and contributing factors. All seven current-cycle reports and all twenty-three from 2025 carry a completed root cause. The reports go past the immediate fact to the mechanism — for example CAR-2026-001 locates the cause in a forum that operates without a written capture rather than in the absence of the forum Conforms
10.2.1 c) Implement any action needed Each report carries a Proposed Corrective Action section with numbered actions. Each action has a named owner and a target date. Across the seven current-cycle reports, every action carries both Conforms
10.2.1 d) Review the effectiveness of any corrective action taken FORM_CAR001 carries a Verification section separate from completion, and a close-out block requiring a named verifier and a date. SOP 7.1 requires the sequence explicitly, verifying effectiveness before close rather than at completion. SOP 6.2 Issue 3 sets the same gate for audit-derived actions: "Corrective action complete and effective? ... Close out NCR; record effectiveness on the NCR Log." Conforms
10.2.1 e) Update risks and opportunities determined during planning, if necessary Corrective actions arising from risk are traced back to the assessment that carried them; the current-cycle reports each cite the register or assessment their finding bears on. Tested on the reports whose findings touch the risk registers Conforms
10.2.1 f) Make changes to the management system if necessary Reports that require a documented change name the document to be changed and the owner of that change. Tested against SOP 7.1's complaint route: "Customer complaints route to the Directors for substantiation; substantiated complaints become NCRs and follow the same flow as any internally-raised non-conformance." Conforms
10.2.1 g) (ISO 45001) Corrective actions are appropriate to the effects of the nonconformity, and workers are involved SOP 7.1 requires severity-based handling, with the shortest route reserved for safety: "Safety-critical (RIDDOR-reportable, near-miss with potential for serious harm, regulator finding) — immediate containment, full close-out target 7 working days, MD-monitored." Quality and customer complaints carry a three-working-day acknowledgement and a thirty-day close; process and minor findings carry thirty days with extension permitted only against a documented rationale Conforms

3.2 Clause 10.2.2 — Documented information

Requirement Objective evidence examined Result
Retain documented information as evidence of the nature of the nonconformities and any subsequent actions taken, and of the results of any corrective action Every nonconformity is a numbered report on FORM_CAR001 carrying a dated Statement of Nonconformity, the requirement or clause breached, containment, root cause, corrective action with owner and target, verification, and a close-out block. Thirty reports were available at the audit date — twenty-three from 2025 and seven from the current cycle — and all thirty carry the full structure. The register at APP_21 Issue 3 is generated from those reports rather than maintained separately, so the register cannot drift from the record it reports Conforms
The source of record is unambiguous APP_21 Issue 3 was approved on 04/05/2026 and states the split it operates: audit-derived corrective actions are held on the portal as the canonical record and generated from the individual reports, while operational and equipment nonconformities are held on the live on-site register maintained by Leanne Mason, which is the master record for that work. Both controllers are named. SOP 7.1 assigns the log: "The HSQE Consultant maintains the Non Conformance Log as the single source of truth." Confirmed with both Directors at interview Conforms
Escalation when an action is not completed on time SOP 7.1 Issue 3: "Any NCR open beyond target without recorded extension is escalated to the Directors at the next weekly compliance call." No current-cycle action was past its target date at the audit date. Tested by interview on what happens when one is Conforms

4. Findings

4.1 Non-conformities

None.

4.2 Observations

None.

4.3 Status of the previous audit of this area

IA202514 raised one observation asking for a quarterly written analysis of nonconformity trends. It is closed. At AMWS's volumes the weekly compliance call reviews every open action by name, which is a shorter loop than a quarterly written report and produces the same escalation. The clause requires analysis, not a particular reporting artefact.

5. Conclusion

The handling of nonconformity and corrective action conforms to clause 10.2 of all three standards. There is one procedure, one numbering scheme and one form, and every route by which a problem can arise feeds into it. Root cause is a required field and is completed. Every action has a named owner and a target date. Effectiveness verification is a separate gate from completion, and close-out requires a named verifier.

The register is generated from the individual reports rather than maintained alongside them, which removes the most common failure in a corrective action system — a register that disagrees with the records behind it. The deliberate separation of management-system findings from operational nonconformities, each with a named master record, was described consistently by both Directors.

No findings were raised.

6. Recommendations

  1. Keep effectiveness verification as a gate distinct from completion. It is the control that decides whether a corrective action system works, and it is the one most often collapsed into a single sign-off.
  2. Where a corrective action is closed on evidence that carries its own expiry date, record that expiry on the closure note, so the closure can be re-tested before the evidence lapses.
  3. Continue generating the register from the reports rather than maintaining it in parallel.

7. Sign-off

Role Name Position Signature Date
Auditor Sean Ashton HSQE Consultant, Onyx Operations Ltd S. Ashton 07/05/2026
Reviewed and accepted Aaron Mason Director A. Mason 07/05/2026