During an actual audit, we will evaluate your products, processes, services, or management system for compliance with the requirements specified in the applicable standard. During this assessment, we may request documentation, invoices, and records, interview personnel, and inspect your production area. We may also inspect your equipment for maintenance, your food processing lines for leaks or wear, your buildings for proper flooring, and so on. During this assessment, the auditor may encounter issues that do not comply with requirements.
If so, the next question is: to what extent does the issue not comply? Generally, if the issue under review is a violation of a legal requirement or a violation that affects the ability of the entity being assessed to fulfill its intended purpose, or raises serious doubts about the organization's ability to provide compliant products or processes, we call it a major nonconformity. Observations received during the audit are categorized as observations and nonconformities. Nonconformities, in turn, are categorized as major or minor.
Please remember that if the auditor identifies a number of minor nonconformities, it may be concluded that the company is still unable to properly manage its products or processes, and in this case, the auditor will raise a major nonconformity. The auditor will explain why and for which regulation point the nonconformity was identified. The auditor will also indicate the deviation from the standard, its severity (major/minor), and the deadline for resolving the issue. The deadline for closing the nonconformity begins at the conclusion of the audit.
If you fail to close the nonconformity on time, the system will also notify you of the suspension process, which Control Union will initiate in accordance with the accreditation rules.
When resolving (working on nonconformities), we expect you to resolve the issue and provide us with evidence of this within the agreed-upon timeframe. Your organization is expected to conduct a root cause analysis of the nonconformity and determine the scope of the problem. In general, you need to solve an immediate problem (e.g., "fix a hole in the wall") and ensure it doesn't recur (e.g., "prevent a shopping cart from hitting the wall and making a hole"). This requires the concepts of scope and root cause analysis. Root cause analysis means asking yourself what the actual root problem is. One way to do this is to ask yourself why the problem occurred. For example, "Why are these tiles falling off the wall?" The answer is "Because the door slams loudly from time to time." Then you ask the same question again: "Why does the door slam?" The answer is "Because the wind can easily play with it." In general, you need to ask yourself "why" five times, although you may reach your conclusion sooner. To determine the scope of the problem, you need to ask yourself: "I have this problem here. Could I have the same or similar problem elsewhere, or is it likely that this problem is also affecting other areas of my business?" If the answer is "yes," you need to solve even more. Our client portal will guide you through these steps and remind you when a non-compliance is approaching its deadline.
The organization must then implement corrective actions—directly resolving the non-compliance.
The final stage is the implementation of preventive measures aimed at preventing the recurrence of the non-compliance.
If you fail to provide CU with evidence that you have resolved the non-compliance within the agreed-upon timeframe, we will reassess the non-compliance status. This means that a minor non-compliance will become a major non-compliance, and a significant non-compliance will become a critical non-compliance, potentially leading to suspension. You will be given the time period established for this level of non-compliance to resolve the issue. Otherwise, your certificate may be (temporarily) suspended and ultimately even revoked.
However, if you provide the required evidence, we will assess whether we consider your resolution sufficient. In many cases, a document review may be sufficient, but we may also need to assess the situation at your company level to determine whether everything has been resolved.
Once we determine that all non-compliances have been properly addressed and resolved, we will either issue you a certificate confirming your compliance or determine that there is no need to suspend your existing certificate.