Chapter 44: Questions About Audits, Timelines, and Effectiveness

How long can a CAR stay open before an auditor writes a finding against it?

There's no magic number in the standard—but auditors typically expect CARs to close within 90 days unless there's a documented, justified reason. If you're awaiting supplier data or long-lead equipment, document that in the CAR and set a specific date.

A CAR open for six months without updated evidence of progress will likely trigger an audit observation or non-conformance. Canadian manufacturers in high-risk sectors (food safety, medical devices, aerospace) often face tighter timelines—60 days is common.

The rule: set a closure target in your CAR when you open it, communicate it to the responsible person, and escalate at 80 percent of that timeline if you're behind. Auditors respect transparent timelines; they penalize CARs that drift without explanation.

What exactly do auditors look for when they review a corrective action file?

Auditors follow a standard audit trail. They verify:

1. Proper nonconformance identification – Was the problem clearly documented with evidence (photos, test data, customer email)?
2. Appropriate scope – Is the CAR addressing the right thing, or just the symptom?
3. Credible root cause – Does the 5-Why or RCA method make sense? Could an auditor replicate your logic?
4. Proportionate corrective action – Is the action scaled to the risk? A minor defect shouldn't spawn a facility-wide process redesign, nor should a critical failure be fixed with a one-time adjustment.
5. Evidence of implementation – Do you have proof the action was actually taken (purchase orders, training records, procedure updates)?
6. Effectiveness verification – After the action, do you have evidence the problem stopped recurring? (Data, inspection results, follow-up audits.)

A weak file has vague root causes, unclear actions, and no post-implementation data. A strong file has specifics, responsibility, deadlines, and measurable results.

How do I prove effectiveness to an auditor? What evidence do they want to see?

Corrective action effectiveness verification requires data collected *after* implementation. Here are the evidence types auditors accept:

• Inspection or test data from units produced after the corrective action, showing no repeat defects
• Statistical trend analysis showing the defect rate dropped after implementation
• Audit results (internal or external) showing the process now meets requirements
• Customer feedback or returned goods tracking showing no repeat issues from that root cause
• Training records confirming the operator or team was trained on the new procedure
• Procedure revision dates and attendance records if process updates were the action

Don't close a CAR on hope or promise. Require the responsible person to gather 20–30 days of post-implementation data before sign-off. For high-risk CARs (safety, regulatory, repeat issues), require 60–90 days of clean data. The auditor will ask, "When did you implement this action, and when did you verify it worked?" If the answers are three days apart, they'll be skeptical.

Did You Know? Many manufacturers think closing a CAR means filing it. Auditors view closure as the *start* of ongoing monitoring. Your procedure should require that the responsible area continue tracking that metric or process for at least two full production cycles or quarters, flagging any rebound to management. Effectiveness isn't a snapshot—it's a pattern.

How do I close a supplier SCAR (SCAR), and when is it actually considered closed on my end?

A supplier SCAR is closed when you, the customer, have verified that the supplier's corrective action worked. You don't close it based on the supplier's letter saying "fixed."

Your procedure should require:

1. Review of supplier's CAR submission – Is their root cause credible? Is their action adequate?
2. Follow-up audit or inspection – Did you audit the supplier's updated process, or did you inspect incoming material from them post-implementation?
3. Verification period – You receive material or parts from them for 30–60 days with zero defects.
4. Sign-off – You formally notify them the SCAR is closed.

Until step 4, the SCAR remains open on your audit trail. This is critical: if you close a supplier SCAR and then find the same defect two weeks later, you've failed the effectiveness verification clause. Automotive OEMs are particularly strict about this. If your customer is an OEM, match their SCAR closure timelines (often 60–90 days post-verification) and document your verification method in writing.

Can an auditor look at CARs from the previous year, or only current ones?

Auditors can and will review prior-year CARs. They typically examine:

• CARs that were closed in the last 12 months (to verify effectiveness)
• Any CARs older than 12 months still open (to understand delays and priority)
• A statistical sample of closed CARs from two to three years back (to check for repeat issues or systemic blind spots)

If you see the same root cause appearing in CARs from different years—e.g., training gaps in 2024, 2025, and again in 2026—that's a sign your training system isn't working. Auditors will flag this as a systemic issue. Use your CAR trend analysis (which you should do quarterly) to spot these patterns before the auditor does.

What's the link between CARs and management review? Do I have to report them?

Yes. ISO 9001 clause 9.3.2 (management review inputs) requires you to include information on nonconformities and corrective actions. At minimum, your monthly or quarterly management review should cover:

• Number of CARs opened and closed
• Average time to close
• Top root causes
• Repeat issues
• Effectiveness of recent CARs

This ties your quality data to business performance. Management review is not a rubber-stamp meeting—it's where you escalate systemic issues, request resources, and set priorities. If CARs are piling up or effectiveness is slipping, that's a management decision point.

For more guidance on integrating quality data into management systems, explore our blog for articles on ISO 9001 implementation in Canadian contexts.

These questions represent the friction points we see across Canadian manufacturing every year. The pattern is consistent: clarity on *when* to open a CAR, rigor in *how* to analyze root cause, and evidence in *how* to close it well. The next chapter brings this all together with a final implementation roadmap tailored to your sector and timeline.