Organizations often don’t know how to track or respond properly to upgraded or downgraded findings.

API reports are reviewed by a committee, which may request changes after the auditor submits the report. Updates can be communicated weeks later, creating additional workload for internal teams.

Understanding that API updates are part of their review process, ensures audit integrity and keeps auditors accountable.

Handling Nonconformities Upgraded from Concerns

When a Concern is upgraded to a Nonconformity after closure, it can complicate internal tracking.

Recommendations:

• Close the old Concern, no matter the stage. Provide reason for closing it (i.e. API upgraded it to a Nonconformity)
• Create a new Nonconformity referencing the original Concern.
• Respond to the Nonconformity in full, which should include root cause analysis, corrective action, and review of effectiveness at a minimum.
• Keep your internal system organized and traceable.

Properly Closing a Nonconformity

Nonconformities should ultimately be closed by the registrar, while your internal team ensures corrective actions are completed effectively.

Some organizations try to close all findings from previous internal and external (Registrar) audits before the registrar’s next audit -to present a “clean” audit report. While this is understandable, this can backfire if the registrar does not consider the last audit’s finding suitable for closure, or furthermore, if the finding type is changed.

Recommendations:

• Verify corrective actions internally.
• Allow the registrar or API to do the review of effectiveness, or confirm final closure, which should really be after ensuring issues have not reocurred.
• Close findings properly if API later upgrades or downgrades a finding.
• Reference old records in new entries for clarity.

Handling Findings Downgraded to Concerns

Concerns require minimal information and fewer corrective actions, making them easier to manage than Nonconformities. If a Nonconformity was downgraded to a Concern, it means you already did more work than necessary, which hopefully should prevent the Concern from ever becoming a true nonconformity.

Recommendations:

• Close the original Nonconformity regardless of the stage. If possible, cite the reason why (i.e. API downgraded it to a Concern) 
• Create a new Concern referencing the old Nonconformity and copy as much information as possible from the old Nonconformity if you already did the work. For example actions already taken should be moved to the new Concern.
• Maintain clean and organized internal tracking.

Key Takeaways

API may continuously change findings, which can feel disruptive. Clear reporting and well-organized systems help manage these changes efficiently. Remember:

• Close old entries and create new ones to avoid confusion.
• Reference previous records for full traceability.
• Allow API or registrars to verify effectiveness before final closure.
• Maintain clear documentation to minimize confusion and improve audit readiness.

Expect upgrades or downgrades to happen, so be ready to manage your internal systems accordingly.