What action should an auditor take if an auditee responds to a procedural noncompliance by stating that the procedure conflicts with a written company policy?

The auditor's primary function is to identify and report nonconformities based on objective evidence against the audit criteria (in this case, the procedure). The finding of noncompliance is valid. However, the auditee's response indicates a potential systemic issue: a conflict within their own documentation hierarchy (policy vs. procedure). It is the auditee's responsibility, not the auditor's, to correct their management system. Therefore, the appropriate action is for the auditor to uphold the finding and request that the auditee investigate and resolve the internal conflict as part of their corrective action process. This ensures the root cause of the noncompliance is properly addressed by the responsible party.

A. Closing the corrective action request is improper because a valid noncompliance and a systemic documentation conflict exist and require resolution.
B. The auditor should not dictate solutions; instructing the auditee to comply with a procedure that may violate policy is inappropriate and oversteps the auditor's role.
C. Voiding the noncompliance is incorrect. The objective evidence shows the procedure was not followed, which is a factual finding that must be reported.

1. The ASQ Certified Quality Auditor Handbook, 5th ed., ASQ Quality Press. Chapter 15, "Audit Reporting and Follow-Up," Section: "Nonconformity Statement," pp. 218-219. The handbook emphasizes that the nonconformity statement must be clear and concise, enabling the auditee to understand the problem and take appropriate corrective action. The responsibility for determining the cause and corrective action rests with the auditee.

2. ISO 19011:2018, Guidelines for auditing management systems. Clause 6.4.8, "Generating audit findings." This standard states that nonconformities shall be recorded. Clause 6.6, "Completing the audit," implies that the output is a report that enables the auditee to take action. A conflict between documents is a significant finding about the management system's effectiveness that the auditee must resolve.

3. Russell, J. P. (Ed.). (2013). The ASQ Auditing Handbook, 4th ed. ASQ Quality Press. Chapter 20, "Corrective and Preventive Action," p. 316. This text clarifies that the auditee organization is responsible for investigating the cause of nonconformities and taking action to prevent recurrence. The auditor's role is to identify the issue, not to prescribe the solution or resolve internal conflicts.