Which Audit Findings Stop a Programme and Which Can Be Monitored?

The most common failure in audit governance is not a missed finding. It is treating every finding as equally serious, which produces either a programme that stops for trivial reasons or a programme that never stops for real ones. Both outcomes are expensive, and both come from the same missing document: a written threshold that says, in advance, which findings mean what.

This piece sets out three tiers, the difference between a document gap and a practice gap, what open and closed actually mean, and how a threshold is written into the buyer side governance file so that the decision is made once rather than re-litigated at every audit. Social findings appear in this framework only as assessed by a qualified third party against the law of the production country and against the buyer code of conduct.

Why Are Audit Findings Not Equal?

Because they differ in two independent ways that a single severity label collapses: how likely the finding is to reach the buyer as a product or a claim problem, and how quickly it can be corrected. Cross those two and four categories appear, and only one of them needs the programme to stop.

A finding that is likely to reach the buyer and slow to correct is a stop. A finding that is likely to reach the buyer and quick to correct is a plan with a date. A finding that is unlikely to reach the buyer and slow to correct is a monitoring item with a note. A finding that is unlikely to reach the buyer and quick to correct is housekeeping. Writing those four sentences down is most of the work.

What Goes in the Tier That Stops the Programme?

Four categories, and they are narrow on purpose. Findings about identity: no legal entity behind the name on the document, or an entity that does not match the bank account. Findings about integrity: a record that has been produced rather than maintained, or a document that does not match the underlying data. Findings about access: an area, a record or a process withheld from the auditor. And findings about a claim the buyer will publish that cannot be evidenced at all.

What those four have in common is that they remove the basis of the relationship rather than damage a part of it. A defective stitch affects a lot. A record produced for the audit affects whether anything else in the report can be believed. That is why the tier is narrow: widening it to include serious product findings makes it useless, because every audit then produces a stop and the stop loses its meaning.

Social findings are handled differently and deliberately. They are not tiered by the buyer on the report alone; they are recorded as assessed by a qualified third party against the law of the production country and against the buyer code of conduct, and the assessment and the corrective action plan that follows it are the governing documents. Where that assessment records a finding, the buyer response follows the plan agreed with the assessor rather than this page.

What Goes in the Tier That Needs a Dated Plan?

Findings that will reach the buyer as a product or a claim problem and that can be corrected within a cycle. An expired test report behind a regulated claim. A material substituted without written notice. No record of incoming material checks. A process step that is performed but not controlled, with a measurable drift in its output. A corrective action from the previous audit still open past its own close date.

The requirement is a plan with four fields: the finding, the corrective action, the owner by name, and a close date before the next order is placed. A plan without a date is a note of intent and should be treated as one. A plan whose date passes is no longer a plan, and the finding then moves up a tier on the strength of the missed date alone rather than on any new evidence.

What Goes in the Tier That Is Tolerable With Monitoring?

Findings that are real, that do not reach the buyer as a product or a claim problem, and that are not on a worsening trend. A training record missing one session where the remaining sessions are complete and current. A document filed under two systems with no conflict between them. A non-critical piece of equipment without a maintenance tag where its output is still inspected. A finding closed by the auditor that the buyer would have written differently.

The requirement is not that nothing is done. It is that the finding is written into the file with a monitoring action and a review date, so that it is checked rather than forgotten. Monitoring with a date is a decision; ignoring is not. The distinction matters at the next audit, when a tier-three finding that has worsened becomes a tier-two finding on the strength of the trend, and the file shows that the trend was there to be seen.

What Is the Difference Between a Document Gap and a Practice Gap?

A document gap is a floor that does the right thing and does not record it. A practice gap is a floor that records the right thing and does something else. The first is an administrative failure with a low ceiling on harm. The second is a control failure with no ceiling at all, and the two look identical in a report that only lists missing documents.

Telling them apart takes one question per finding: is the recorded thing actually happening. Where a check is recorded and not performed, the record is worse than no record, because it will be relied on later. Where a check is performed and not recorded, the buyer has a real control with an evidential problem. The first belongs in tier two at minimum; the second usually belongs in tier three.

What Does Open Mean, and What Does Closed Mean?

Open means a corrective action has been agreed, with an owner and a date, and has not yet been verified. Closed means the change has been evidenced, by a document, a photograph or a record showing the new practice running, and that the evidence has been seen by the auditor or by the buyer. Those are the only two states that are useful; everything else is a status label with no definition behind it.

A third state is worth naming explicitly, because it is the one that causes the confusion: effective. A closed action is one that was done. An effective action is one that has held for a period afterwards, evidenced by a later record or a later inspection result. A finding closed the week before an audit has been closed. Whether it has been effective is not yet knowable, and the file should say so.

How Do You Write a Threshold Into the Governance File?

One page, six columns, reviewed annually: the recurring finding, its tier, the required action, the decision owner, a review date and the escalation route. Fifteen to twenty rows covers everything that recurs in this category, and the page is then the whole of the framework. A finding not on the page is tiered at the review and added to it, so the page grows rather than being rewritten.

Two sentences at the top of the page do most of the work. The first: a finding is tiered on the day of the report and is not revisited unless new evidence appears. The second: the tier of a finding on this page is not negotiable at the point of an order. Those two sentences are what stop the decision being re-litigated, and they work because they were agreed before anybody knew what the next report would say.

The escalation route completes it. A tier-one finding goes to the buyer programme owner the same day, in writing, and stops the order and the payment. A tier-two finding goes to the same owner before the next order is placed. A tier-three finding is noted and reviewed at the next quarterly review. One paragraph, and nobody has to decide at the moment of discovery what to do.

1. Finding

Named in the words it appears in an audit report, not paraphrased

2. Tier

One, two or three, with the reasoning in one line

3. Required action

Stop, plan with a date, or monitoring with a review date

4. Decision owner

A named role on the buyer side, not a department

5. Review date

When the tier itself is reconsidered, normally annually

6. Escalation route

Who is told, in what form, and within how long

Where Does an Inspection Result Sit in This Ranking?

As input rather than as a tier. An inspection result at AQL 2.5 under ISO 2859-1 General Inspection Level II produces a defect count by class, and that count is evidence about a lot rather than a finding about a system. A lot that fails once is a lot problem: the goods are dealt with, and the result goes into the scorecard.

What moves it into tier two is repetition or class. The same major defect appearing across three consecutive lots is a system finding, because three lots means the process ran the same way each time and nobody caught it. A critical defect in any lot is a tier-two finding immediately, because a critical defect by definition reaches the buyer. Single, isolated, non-critical failures stay as scorecard input.

Who Decides the Tier, and When?

One named role on the buyer side, on the day the report arrives, against the threshold page. Not a committee, and not a discussion at the next order, because both produce a decision that has been influenced by whether the goods are needed. The decision is easier to make on the day and much harder to make three weeks later with a launch date in front of it.

Where a finding does not appear on the page, the same person tiers it and adds it to the page, with one line of reasoning. That single rule is what makes the framework durable: it does not need to be complete in order to be used, and it becomes more complete every time it is used.

How Is a Threshold Reviewed Without Re-litigating It?

Annually, at a fixed date, in one meeting, with two questions: has any tier changed because the buyer exposure changed, and has any finding on the page stopped recurring. That is the whole agenda. A tier is reconsidered because the programme changed, with a new market carrying new regulated claims or a new customer carrying different requirements, not because somebody disagreed with a decision.

The second question is the useful one and it is rarely asked. A finding that has not appeared in two years can be removed from the page rather than carried forever, and a page that only ever grows becomes a burden nobody reads. Removing a row is a decision that should be recorded with a date, in the same way that adding one is.

The commercial frame sits underneath all of it: MOQ 500 pcs per style and colourway, sampling 6-10 working days from a signed-off tech pack, bulk production 35-50 days from written sample approval, inspection at AQL 2.5 under ISO 2859-1 General Inspection Level II, T/T 30/70, quoted FOB Xiamen with CIF and DDP available. A stop decision taken inside that frame is a schedule decision as well, and the threshold page should say who tells the production side, and how quickly.

One last point, and it is the reason the page is worth writing. The argument a threshold prevents is not an argument about a finding. It is an argument about whether the buyer meant what they said last time. A written tier, agreed before anybody knew what the next report would contain, ends that argument before it starts, and it lets the conversation at the next audit begin at the corrective action rather than at the severity.

Frequently Asked Questions

People Also Ask