Corrective action (CAPA) and closing out a finding
A corrective action is the fix you commit to after an auditor raises a non-conformance, together with the evidence that the fix actually happened. In a food audit it is the mechanism by which a finding is closed out, and when the finding is an expired supplier certificate, the evidence is usually the slowest part to assemble.
What a corrective action is in a food audit
A corrective action is the action you take to remove the cause of a non-conformance an auditor has raised, recorded with a responsible person, a completion date and objective evidence that it was done. It is not the same as the quick fix, and auditors read the difference carefully.
Three words get used together and mean different things:
- Correction, sometimes called immediate action, deals with the specific item in front of the auditor. You obtain the missing document, quarantine the affected stock, relabel the pallet.
- Corrective action deals with why that item was wrong in the first place, so the same failure does not recur. It follows a root cause, not a symptom.
- Preventive action extends the thinking to places the failure has not happened yet but could.
A worked example. An auditor opens your approved supplier file and finds a nut-handling supplier's allergen declaration expired eleven weeks ago. The correction is to request and file the current declaration. The root cause is that renewal dates lived in one spreadsheet column that nobody was scheduled to read. The corrective action is a tracked renewal date per certificate with a named owner and a reminder that fires before expiry, not after. The preventive action applies the same tracking to every certificate type you require, including Certificates of Analysis and third-party audit certificates, rather than only to allergen declarations.
How a finding gets closed out
- Read the finding as written
Close out against the auditor's exact wording and the clause cited, not against your summary of it. A response that answers a different question is the most common reason a submission comes back.
- Correct the specific item
Get the current document on file, with its issue and expiry dates recorded. This alone does not close the finding, but nothing closes without it.
- Establish the root cause
Say plainly why the gap existed. "Human error" is rarely accepted on its own, because it names a person rather than a process that had no scheduled trigger.
- Change the system and name the owner
Write the corrective action as a change someone owns on a date: who checks what, when the reminder fires, who chases the supplier, what happens when a supplier does not reply.
- Submit evidence inside the window
Your audit report and certification body set the deadline and the acceptable evidence format. Send the document, plus proof that the new process ran, not a promise that it will.
- Expect verification next time
A closed-out finding is usually revisited at the following audit. If the only evidence was a one-off tidy-up, the same clause tends to reappear, often at a higher severity.
What counts as evidence for a certificate finding
For document-control findings the evidence pack is usually three things: the current certificate itself, the record showing when it was obtained, and the mechanism that will catch the next renewal before it lapses.
The third is the one plants under-supply. A screenshot of a cleaned-up spreadsheet shows a tidy moment, not a system. What reads as a system is a date held per certificate, a reminder that fires on a schedule you can state, a record of the request actually sent to the supplier, and a status view a second person could read without you narrating it.
Timing matters too. If a renewal is requested the week the auditor leaves, the corrective action is indistinguishable from the correction. Reminders that fire months ahead of expiry produce a trail that looks like routine supplier management, which is what the clause is asking for.
Related terms
Non-conformance (major and minor) is the finding that triggers a corrective action. Severity drives the deadline and, in some schemes, the grade. Our page on non-conformance covers how major and minor are distinguished.
Root cause analysis is the step between the correction and the corrective action. Five whys and fishbone diagrams are the usual tools; what the auditor wants is a cause that a process change can actually remove.
Document control is the clause family most certificate findings sit under: the right version, in the right place, with the right date, retrievable.
Approved supplier list is the register the certificates belong to. A supplier approved on an expired document is approved on paper only.
Unannounced audit removes the preparation window entirely, which is why standing corrective actions matter more than seasonal clean-ups. See the unannounced audit entry for what changes.
Close-out is the certification body's acceptance of your evidence. Until that acceptance lands, the finding is open, whatever your internal log says.
Questions
Is a corrective action the same as a correction?
No. The correction fixes the item the auditor found, for example obtaining the expired certificate. The corrective action removes the cause so the same gap does not recur, for example a tracked renewal date with a named owner and a reminder that fires before expiry. Most rejected submissions supply only the correction.
How long do I have to close out a non-conformance?
The deadline comes from your audit report and your certification body, and it varies by scheme and by the severity of the finding. Read the report rather than relying on what happened last year, and if the evidence will take longer than the window to gather, say so early rather than late.
What evidence do auditors accept for an expired supplier certificate?
Typically the current certificate with its issue and expiry dates, a record of when and how you obtained it, and evidence of the mechanism that will catch the next renewal. The last part is what separates a corrective action from a one-off tidy-up.
What is the difference between corrective and preventive action?
Corrective action addresses a failure that has already happened. Preventive action addresses the same failure mode in places it has not happened yet, for instance applying a tracked expiry date to every required certificate type rather than only the one the auditor opened.
Can a corrective action be rejected?
Yes. Common reasons are a root cause stated as human error with no process change behind it, evidence that only proves the specific item was fixed, or a response that does not address the clause as the auditor wrote it. A rejection consumes part of your close-out window, so answer the wording precisely the first time.
Does certificate tracking software close out a finding for me?
No. Software can hold the dates, send the reminders and produce a status record an auditor can read, which is part of the evidence. The root cause, the process change and the submission to your certification body remain yours.
Where should corrective actions be recorded?
In a log your team and an auditor can both follow: the finding and clause, the correction, the root cause, the corrective action with an owner and a due date, the evidence attached, and the date the certification body accepted it. Keeping that log current is cheaper than reconstructing it at the next audit.