What this is
What is an audit non conformance response record?
What is an audit non conformance response record?
It is the formal written response to an external audit finding, the correction, its root cause, the corrective action and the evidence behind each, raised once per finding and tracked against BRCGS cl.3.7.
What is the difference between correction and corrective action?
Correction is what gets fixed immediately, the non-conforming product isolated, the missing record created. Corrective action is what stops the same finding recurring, and it only holds up if it addresses a root cause that goes beyond 'the operator missed a step'.
Why does 'systemic cause identified' matter more than the fix itself?
Because auditors close findings on the strength of the cause, not the correction. A response that identifies a systemic cause, a gap in training, supervision or process design that let the error happen, reads as durable. One that stops at human error reads as the same finding waiting to happen again.
Scope
When is an audit non conformance response record required?
This record is one step in a larger programme. Using it for work that belongs to a neighbouring template produces records that are hard to report on later.
Use this template when
- An external finding has landed, from a certification body, customer, regulator or scheme owner, and a formal response is due by a set deadline
- A new record is needed per finding; each one gets its own ID in the form ANR-2026-000
- You are running the Internal Audit and Certification programme and this is the response step after a finding is raised
- A linked record needs this one to exist: links external audit, findings, RCA
- The certification body or customer has rejected an earlier response and a further round of clarification has to be logged
Do not use it for
- Customer Audit Record, which records a customer or second party audit itself, its findings and the response given, rather than the response record for a single finding.
- Unannounced Audit Readiness Check, which checks whether the site would pass an audit arriving today, not the response to a finding already raised.
- Certification Body Performance Review, which reviews the certification body on auditor consistency, technical competence, scheduling and value.
- Audit Finding Record, which raises and describes the finding itself, ahead of the response this record captures.
- Anything outside KnowComply, which belongs in the workspace that owns that process
Compliance mapping
Which BRCGS cl.3.7 requirements does this satisfy?
BRCGS clause 3.7 sets the requirement this record answers to, and the same clause covers the whole lifecycle it captures, correction, cause, action and verification, rather than one step alone. The rows below anchor each section of the form to that requirement.
| Clause | Requirement | Where it lands |
|---|---|---|
| BRCGS cl.3.7 | A correction is implemented within the response deadline, addressing the immediate non-conformity and any affected product | Correction |
| BRCGS cl.3.7 | Root cause analysis is carried out using a stated method, with the cause supported by evidence rather than assumption | Root cause |
| BRCGS cl.3.7 | The cause identified goes beyond an individual's action to the system, process or supervision that allowed it | Root cause |
| BRCGS cl.3.7 | Corrective action addresses the root cause identified, at a strength proportionate to the finding, with an owner and date assigned | Corrective action |
| BRCGS cl.3.7 | Preventive action considers whether the same cause could produce a finding elsewhere in the site | Corrective action |
| BRCGS cl.3.7 | The action's effectiveness is checked after implementation, not assumed from the plan alone | Corrective action |
| BRCGS cl.3.7 | The finding is only closed once the certification body, customer or scheme owner has accepted the response | Outcome |
What it does not cover
- A root cause that stops at 'operator error' with Cause Goes Beyond Human Error marked Partly or No, which means the response answers why the incident happened today, not why it will happen again.
- Correction marked complete with Affected Product Addressed left at Partly, which means product that could carry the same non-conformity is still unaccounted for while the response claims the immediate issue is closed.
- Action Addresses The Root Cause scored Yes against a Root Cause Analysis Carried Out of Partly, which means the action is aimed at a cause that was only partly established in the first place.
- Response Submitted On Time marked Late with no Rounds Of Clarification recorded, which means the timeliness failure certification bodies weigh heavily is present but nothing shows whether the content was accepted despite it.
- Finding Closed marked Yes while Effectiveness Verified is still No, which means the record has been closed administratively before anyone checked whether the corrective action actually worked.
Global
Audit Non Conformance Response Record requirements by country
BRCGS certificates are recognised through GFSI benchmarking rather than by government regulation, so what counts as an acceptable response varies by which certification body and which customer sits behind the finding, not by which country the site is in.
BRCGS Global Standard for Food Safety
BRCGS is UK-headquartered and its Food Safety standard remains the default requirement UK retailers place on their supply base
A response record for a UK retailer's own audit finding, as opposed to the certification body's, still needs the same correction, cause and action structure even though the retailer is not the accreditor.
GFSI benchmarking via BRCGS
US retailers and foodservice buyers increasingly specify a GFSI-recognised scheme, of which BRCGS is one, as a supplier condition
A US site closing a BRCGS finding answers to the same clause 3.7 structure as a UK site, but a customer audit finding, rather than the certification body's, may carry its own deadline that sits outside the certification cycle.
GFSI Benchmarking Requirements
GFSI benchmarking is what makes a BRCGS certificate portable across markets and accepted by multinational buyers without a second audit
A weak response, correction without root cause, that a local certification body lets slide still exposes the site if a multinational customer's own technical team reviews the same finding file during a supplier audit.
How to complete it
How to complete an audit non conformance response record, step by step
Filling in the record is straightforward once the finding exists. The judgement is in whether the cause written down would survive a second reader, and whether the action matches the size of the cause rather than the size of the finding.
Cause Goes Beyond Human Error and Systemic Cause Identified are asking the same question twice from different angles on purpose. A root cause narrative can be detailed and articulate and still stop at 'the operator did not follow the step'; the test is whether it explains why the system let that happen, not how thoroughly the mistake is described.
Other Areas Checked carries real weight, a systemic cause implies the same gap could exist elsewhere, and marking Yes without a description of what was actually looked at just shifts the risk to whoever verifies effectiveness later.
Action Strength Adequate has to be read against Finding Grade. A proportionate action for an Observation is not proportionate for a Major, and reusing the same class of action, retraining, a reminder memo, regardless of grade is the single most common reason certification bodies ask for a resubmission.
Response Accepted with clarification, versus outright acceptance, is worth tracking over time by area and by certification body. A pattern of 'accepted with clarification' responses from the same area manager usually means the underlying root cause writing needs coaching, not that the findings themselves are getting harder.
What auditors find
Most common audit non conformance response record findings
These are the ways a non conformance response record fails to hold up under a second read, independent of which scheme raised the original finding.
| Finding | Clause | What fixes it |
|---|---|---|
| Root cause written up after the corrective action was already decided | BRCGS cl.3.7 | Sequence the form so Root cause fields are completed and reviewed before Corrective Action is drafted, not filled in afterwards to justify a decision already made. |
| Systemic Cause Identified marked Yes with no description of where else the cause could show up | BRCGS cl.3.7 | Require a one-line note on which other areas, lines or shifts share the same system before the systemic flag can be set. |
| Affected Product Addressed left at Partly with the record otherwise marked Complete | BRCGS cl.3.7 | Block Status moving to Complete while Affected Product Addressed remains Partly or No; an unresolved product question is not a closed response. |
| Effectiveness Check Planned marked Yes with no Effectiveness Check Due date set | BRCGS cl.3.7 | Make Effectiveness Check Due a required field whenever Effectiveness Check Planned is Yes, so the plan carries a date the same day it is approved. |
| Finding Closed set to Yes on the same day the response was submitted, ahead of any external acceptance | BRCGS cl.3.7 | Tie Finding Closed to Response Accepted being Yes or With clarification; a response that has not been accepted yet has not closed anything. |
| Reason If Rejected left blank after Response Accepted is marked Rejected | BRCGS cl.3.7 | Require Reason If Rejected whenever Response Accepted is Rejected, so the next round of clarification starts from a documented gap rather than a guess. |
Case in point
Case in point: the response that came back twice for the same reason
A site received a Major finding from its certification body auditor after packaging line staff were found running a changeover without the documented allergen check. The first response corrected the immediate batch, retrained the two operators involved, and described the cause as 'operators did not follow the changeover procedure'.
The certification body rejected the response and asked for a resubmission, noting the cause did not explain why the check had been skippable in the first place. The second response found that the changeover procedure required a second signature that supervisors routinely did not have time to give during a shift changeover, and reworked the corrective action around supervisory cover rather than operator retraining, the same root cause the field 'Cause Goes Beyond Human Error' exists to force out on the first attempt.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
6 sections
- Reference
- CMP-046
- Archetype
- Record
- Record ID
- ANR-2026-000
- Scoring
- Accepted first time
- Direction
- High is good
- Singleton
- Yes
- Basis
- BRCGS cl.3.7
- Links
- Links External audit, Findings, RCA
- Tags
- Audits, Response
- Sections
- 6
- Fields
- 47
- Follow up fields
- 3
- Repeating sections
- 0
- Links out
- 4
Header
13 fieldsRecord ID*
Auto sequence. Format ANR-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date and Time*
Completed By*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Finding Reference*
Finding Source*
Finding Grade*
- Critical0 pts
- Major1 pt
- Minor2 pts
- Observation3 pts
Owner*
Response Deadline*
Response Submitted On Time*
- Yes3 pts
- Late0 pts
Response Quality Decides Whether It Closes
Most rejected responses fail on root cause rather than on the fix. Auditors accept a modest action with a convincing cause more readily than the reverse.
Correction
6 fieldsImmediate Correction Described*
- Yes3 pts
- Partly1 pt
- No0 pts
Correction Completed*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Affected Product Addressed*
- Yes3 pts
- Partly1 pt
- No0 pts
Scope Of The Problem Bounded*
- Yes3 pts
- Partly1 pt
- No0 pts
Other Areas Checked*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Evidence Of Correction Provided*
- Yes3 pts
- Partly1 pt
- No0 pts
Root cause
6 fieldsRoot Cause Analysis Carried Out*
- Yes3 pts
- Partly1 pt
- No0 pts
Cause Goes Beyond Human Error*
- Yes3 pts
- Partly1 pt
- No0 pts
Systemic Cause Identified*
- No0 pts
- Yes2 pts
Why Existing Controls Failed Explained*
- Yes3 pts
- Partly1 pt
- No0 pts
Analysis Method Stated*
- Yes3 pts
- Partly1 pt
- No0 pts
Cause Supported By Evidence*
- Yes3 pts
- Partly1 pt
- No0 pts
Corrective action
6 fieldsAction Addresses The Root Cause*
- Yes3 pts
- Partly1 pt
- No0 pts
Action Strength Adequate*
- Yes3 pts
- Partly1 pt
- No0 pts
Owner And Date Assigned*
- Yes3 pts
- Partly1 pt
- No0 pts
Preventive Action For Other Areas*
- Yes3 pts
- Partly1 pt
- No0 pts
Effectiveness Check Planned*
- Yes3 pts
- Partly1 pt
- No0 pts
Evidence Attached*
- Yes3 pts
- Partly1 pt
- No0 pts
Related records
2 fieldsCustomer Audit ID
Where the finding came from a customer audit.
Links to CMP-044 Record ID
Finding ID
The finding this response answers.
Links to FDN-015 Finding ID
Outcome
14 fieldsResponse Accepted*
- Yes3 pts
- With clarification2 pts
- Rejected0 pts
Rounds Of Clarification*
Reason If Rejected
Finding Closed*
- Yes3 pts
- Open0 pts
Effectiveness Verified*
- Yes3 pts
- Scheduled1 pt
- No0 pts
Effectiveness Check Due
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Owner*
Signature*
Compliance Lead*
Second Signature*
CMP-046 · record IDs look like ANR-2026-000 · Links External audit, Findings, RCA
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The response itself is a document. What decides whether it is accepted is whether the root cause holds up, and whether the deadline and evidence trail behind it stay visible to whoever has to answer for it.
Holds the non conformance response library against the finding and audit registers it links to, and keeps deadline, root cause and evidence together on one record.
Ties the corrective action back to the site's nonconformance and CAPA history, so a repeat root cause across findings shows up before the same corrective action gets written a third time.
Surfaces the same finding pattern across storage and distribution sites when a systemic cause behind a scheme finding is not confined to one location.
Coordinates the crew, rolls open responses and approaching deadlines into one view, and holds every write for your approval before it touches a record.
This template lives in KnowComply — audit and governance. Audit programmes, legal register, management review, risk and certification.
Meet KnowComply→Glossary
Audit Non Conformance Response Record definitions and key terms
- Correction
- The immediate fix to the specific instance of the finding, isolating affected product, completing a missing record, as distinct from stopping it happening again.
- Corrective action
- The change made to the process, system or control that caused the finding, aimed at preventing recurrence rather than just fixing the one instance.
- Root cause analysis
- A structured method for tracing a finding back past the immediate action to the underlying reason the control failed or did not exist.
- Systemic cause
- A cause that sits in how a process, training or supervision system is designed, rather than in one person's action on one occasion.
- Effectiveness verification
- A later check, after a corrective action has had time to operate, confirming the finding has not recurred and the fix is actually working.
FAQ
Frequently asked questions about audit non conformance response record
Who is responsible for the response record?+
The area manager whose area produced the finding owns it, though the compliance lead typically holds the sign-off and the tracking against the deadline.
What happens if the response is rejected?+
Response Accepted is set to Rejected, Reason If Rejected is completed, and Rounds Of Clarification increments as the response is reworked and resubmitted.
Does every finding need its own response record?+
Yes, the record is raised per finding, linked back to the finding ID and, where relevant, the customer or certification body audit it came from.
Is a corrective action always required?+
Only where the finding warrants one, but Action Addresses The Root Cause and Action Strength Adequate are both required fields once the root cause section is complete, so the form does not let a serious finding close on correction alone.
How is 'accepted first time' measured?+
It is the proportion of responses where Response Accepted is Yes with Rounds Of Clarification at zero, a direct measure of whether the correction, cause and action held up without needing a rework.
What is the difference between this and the finding itself?+
The finding record captures what the auditor observed; this record captures what the site did about it. The two are linked but owned and scored separately.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Internal Audit and Certification
Internal Audit Programme
Sets out what will be audited, when, by whom and against which standard, across the year
Internal Audit Report
Records an internal audit against a standard or process, with findings and evidence
Audit Plan
Sets out the scope, criteria, schedule and people involved for a single audit
Audit Finding Record
Records a single audit finding with its evidence, clause reference and classification
Audit Follow Up Record
Checks whether audit findings have actually been closed and the fixes work
Auditor Competency Record
Records an internal auditor's training, experience and audits performed
More in Customer and Scheme Audits
Customer Audit Record
Records a customer or second party audit, its findings and the response given
Unannounced Audit Readiness Check
Checks whether the site would pass an audit arriving today, covering records, standards and area condition
Certification Body Performance Review
Reviews the certification body on auditor consistency, technical competence, scheduling and value
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- BRCGS — Brand Reputation Compliance Global Standards, cl.3.7
- BRC — BRCGS Global Standard for Food Safety, earlier name, same clause numbering
- GFSI Benchmarking Requirements — recognition framework behind BRCGS certification
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.