7. Conducting Internal, Supplier, and Second-Party Audits

Introduction and Context

An audit is a systematic, independent, and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which specified criteria are fulfilled. In quality management, auditing is not merely an inspection for errors or a compliance exercise. It is a disciplined method for understanding how work is performed, whether intended controls are effective, and where risks to customers, processes, and organizational objectives may arise.

Internal audits are conducted by, or on behalf of, the organization itself. They provide assurance to management and support improvement. Supplier audits, often called second-party audits, are conducted by a customer or another party with a contractual or business interest in the supplier. They may be used for supplier selection, qualification, development, surveillance, or investigation of performance problems. Although both forms examine processes and evidence, they differ in purpose, authority, independence, and the relationship between auditor and auditee.

A mature audit does not begin with a checklist. It begins with a clear purpose, an understanding of the process and its risks, suitable criteria, competent auditors, and an agreed plan. During execution, auditors combine interviews, observation, document review, sampling, traceability, and analysis of process performance. The final value of the audit depends not only on accurate findings but also on the quality of communication, the fairness of conclusions, and the effectiveness of follow-up.

This chapter focuses on practical audit execution across system, process, product, remote, and supplier contexts. It connects the requirements-oriented perspective of ISO 19011 with the process approach and risk-based thinking associated with ISO 9001 and related management-system standards.

Learning Objectives

After studying this chapter, students should be able to:

1. Distinguish internal, supplier, and second-party audits by purpose, authority, and use.

2. Plan an audit programme and individual audit using risk, process importance, performance history, and contractual requirements.

3. Develop useful audit criteria, objectives, scope, schedules, and sampling approaches.

4. Apply interviews, observation, document review, traceability, sampling, and data analysis to obtain objective evidence.

5. Audit processes, systems, products, and remote operations without confusing activities with evidence of effectiveness.

6. Formulate clear, evidence-based findings and communicate them professionally.

7. Evaluate supplier capability and manage audit follow-up, corrective action, escalation, and improvement.

8. Recognize ethical, technological, confidentiality, and independence issues in auditing.

The Audit as an Evidence-Based Management Activity

The central logic of an audit is simple: criteria are compared with objective evidence, and the comparison produces conclusions. Audit criteria may include ISO requirements, internal procedures, customer specifications, drawings, legal requirements, purchase contracts, control plans, or defined performance targets. Objective evidence consists of records, statements of fact, observations, measurements, data, and other verifiable information relevant to the criteria.

The distinction between evidence and opinion is fundamental. “The operator appears careless” is an opinion. “The operator’s training record does not show authorization for the operation required by the procedure” is an evidence-based observation. The second statement can be verified, discussed, and acted upon. Auditors should therefore describe what was examined, what was found, and which requirement or expectation was not fulfilled.

Audits can be classified in several ways. A system audit examines the interaction of management-system elements and their conformity with specified requirements. A process audit follows a particular process from inputs through activities and controls to outputs and results. A product audit examines whether a product or service conforms to specified requirements, often using inspection, testing, identification, and records. A compliance audit emphasizes conformity with legal, regulatory, contractual, or other mandatory obligations. In practice, a single audit may combine these forms, but the auditor should know which question is being answered.

An internal audit is a first-party audit. It may be performed by employees or external personnel working under the organization’s direction. Its purpose may include certification readiness, process improvement, management review input, risk control, or verification of corrective action. A supplier audit is normally a second-party audit because the customer evaluates an external provider. It can examine the supplier’s management system, manufacturing process, product controls, capacity, traceability, and ability to meet contractual requirements.

Certification audits conducted by an independent certification body are third-party audits. They are not the principal focus of this chapter, but understanding the distinction matters: an internal auditor supports the organization, while a second-party auditor protects the customer’s interests and evaluates supply-chain risk. Neither role permits the auditor to abandon objectivity or use the audit as a means of intimidation.

Planning from Risk, Purpose, and Process Relationships

Effective planning begins with the audit programme. An audit programme is a set of one or more audits planned for a specific time frame and directed toward a particular purpose. Programme management involves establishing objectives, assigning responsibility, determining resources, selecting audit methods, monitoring results, and improving the programme.

A risk-based programme does not audit every area with identical frequency or depth. Factors that may increase audit priority include:

• safety, regulatory, or customer-critical characteristics;
• high process complexity or frequent change;
• poor historical performance or repeated nonconformity;
• dependence on a single supplier or limited capacity;
• new technology, new personnel, or transferred operations;
• weak measurement systems or unreliable records; and
• significant impact on product conformity or customer satisfaction.

Low-risk processes should not be ignored, but audit effort should be proportionate. A stable administrative process may require a shorter periodic audit, whereas a special-process supplier or a process producing safety-critical components may require technical specialists, greater sampling, and more frequent surveillance.

An individual audit plan should state the audit objective, scope, criteria, dates, locations, methods, audit team, responsibilities, required resources, confidentiality expectations, and reporting arrangements. The objective explains why the audit is being conducted. The scope defines boundaries such as sites, departments, products, shifts, processes, and time periods. Criteria define what will be compared with evidence. Ambiguous objectives produce unfocused audits; excessively broad scopes produce superficial coverage.

The auditor should review relevant information before the audit. This may include the process map, previous reports, complaints, corrective actions, performance dashboards, risk registers, control plans, specifications, supplier scorecards, organizational changes, and applicable legal requirements. Pre-audit review is not a substitute for verification during the audit, but it helps the auditor identify critical questions and avoid wasting time on irrelevant detail.

A useful plan follows the process rather than merely the organization chart. For example, an audit of incoming material control may begin with purchasing requirements, continue through supplier approval and receipt inspection, and end with material identification, release, storage, and use in production. This approach exposes interfaces, where quality failures frequently occur.

Audit Criteria, Checklists, and Questions

Checklists can improve consistency, especially when an audit involves many requirements or auditors. However, a checklist should be treated as a memory aid and sampling guide, not as the audit itself. A checklist that merely reproduces clauses may encourage auditors to ask, “Do you comply?” and accept an unsupported “yes.” A process-oriented checklist instead asks how the process is controlled, what evidence demonstrates control, what happens when performance deviates, and whether results are achieving intended outcomes.

Questions should be open enough to reveal the process but focused enough to produce verifiable evidence. Useful questions include: “How do you know that the current drawing is the approved revision?” “What happens when the inspection result is outside the acceptance limit?” “Show me the record for the last completed batch.” “Which performance measure indicates that this control is effective?” The auditor should pursue statements with follow-up questions and evidence requests.

Audit criteria should be translated into observable expectations. A requirement for competent personnel may lead to examination of competence criteria, training records, authorization, observed performance, and evaluation of effectiveness. A requirement for monitoring equipment may lead to review of equipment identification, calibration status, traceability, handling, and action taken when equipment is found unsuitable.

Executing the Audit: From Opening Meeting to Evidence Trail

The opening meeting establishes a professional working relationship. The lead auditor confirms objectives, scope, criteria, timetable, communication channels, safety and confidentiality rules, and the method for reporting findings. The meeting should clarify that the audit is based on samples and that the absence of a finding does not prove that every activity is perfect. In supplier audits, the customer should also explain how findings will influence approval, development, or commercial decisions.

Auditors then collect evidence through several complementary methods. Interviews reveal knowledge, responsibilities, decisions, and responses to abnormal conditions. Interviews should be conducted with people who perform or control the work, not only with managers. The auditor should compare answers with records and observation because people may describe intended practice rather than actual practice.

Observation allows the auditor to see work as it occurs. It may reveal uncontrolled documents, incorrect identification, unsuitable storage, unsafe handling, bypassed controls, or differences between shifts. Observation must be respectful and should not unnecessarily disrupt operations. When a risk of immediate harm exists, the auditor should communicate it promptly rather than waiting for the closing meeting.

Document and record review establishes whether planned arrangements exist and whether they are being followed. Documents describe intended methods; records provide evidence that an activity occurred and, where relevant, that its result was acceptable. The auditor should check revision status, authorization, completeness, legibility, retention, and linkage to the product or process concerned.

Traceability is the practice of following the history, application, location, or status of an item. In manufacturing, an auditor may select a finished product and trace it backward to batch records, raw materials, equipment, operators, inspection results, and supplier certificates. The auditor may then trace forward from a raw-material lot to products, customers, and dispatch records. Traceability tests whether information is connected across process boundaries and whether containment would be possible during a failure.

Sampling is unavoidable because auditors normally cannot examine every transaction, product, or record. A sample should be selected deliberately, not merely because it is convenient. The auditor may use risk-based, judgmental, stratified, systematic, or random sampling. Samples should, where relevant, cover different shifts, operators, products, suppliers, dates, lots, and performance conditions. A single compliant record does not establish universal conformity, while a single failure may indicate the need for expanded sampling. Sampling conclusions must therefore be expressed cautiously.

A process audit follows the sequence of inputs, activities, controls, outputs, customers, and measures. The auditor asks whether inputs are suitable, responsibilities are clear, risks are controlled, process parameters are maintained, outputs meet requirements, and performance results are used for improvement. Process performance should be evaluated with relevant indicators such as defect rate, first-pass yield, on-time delivery, cycle time, complaint rate, process capability, corrective-action closure, or supplier delivery reliability. A process can be documented and compliant yet ineffective if it consistently fails to achieve its intended results.

A product audit concentrates on the item itself. It may involve checking dimensions, material, labeling, packaging, function, cleanliness, software version, certificates, or test results. Product auditing is particularly useful when customer requirements are critical, but it should not replace process auditing. Product inspection can identify a defect without explaining why the defect occurred or whether the control system can prevent recurrence.

A remote audit uses information and communication technologies to interview personnel, review electronic records, observe activities through video, and examine data or images. It may be appropriate for geographically distant suppliers, distributed offices, or preliminary assessments. Its limitations include restricted access to physical conditions, weak connectivity, inability to authenticate some evidence, time-zone difficulties, and the risk that the auditee stages the activity. Remote plans should specify secure platforms, evidence-sharing protocols, privacy controls, recording rules, contingency arrangements, and methods for verifying that the correct location and records are being viewed.

Evaluating Evidence and Writing Findings

A finding is the result of evaluating collected evidence against audit criteria. It may indicate conformity, nonconformity, an opportunity for improvement, or a positive practice, depending on the organization’s reporting system. Nonconformity should not be confused with a recommendation. A nonconformity exists when a requirement is not fulfilled. A recommendation suggests a possible improvement where a requirement is currently met.

A strong nonconformity statement normally contains three elements: the requirement, the objective evidence, and the nature of the gap. For example: “The approved work instruction requires verification of torque equipment before each production shift. For work order 4821 on 14 May, the shift-start verification record was blank, and the operator confirmed that the check had not been performed.” This statement is specific, verifiable, and connected to a criterion. It avoids speculation about the root cause.

Auditors should distinguish correction from corrective action. Correction addresses the detected problem, such as reinspecting affected products. Corrective action addresses the cause or causes so that recurrence is prevented, such as revising the verification method, clarifying responsibility, and evaluating implementation. Auditors should not prescribe a solution unless their role explicitly includes consulting; they should evaluate whether the proposed action is appropriate and effective.

The closing meeting communicates conclusions, explains findings, confirms factual accuracy, and describes the follow-up process. The auditor should present findings in a balanced manner, acknowledge limitations of sampling, and avoid surprises by discussing significant issues as they arise. Disagreement should be handled through evidence and criteria, not authority or personality. If factual errors are identified, the report should be corrected; if the auditee merely disagrees with a valid finding, the disagreement should be documented and managed through the established appeal or response process.

Supplier and Second-Party Audits in Supply-Chain Governance

Supplier auditing is one element of supplier management, not a replacement for supplier selection, specification control, incoming verification, performance monitoring, or relationship management. The audit objective should determine its depth. A prospective supplier audit may examine capability, capacity, process validation, competence, subcontractor control, and financial or operational resilience. A surveillance audit may focus on changes, performance trends, and closure of earlier findings. A problem-solving audit may examine a specific failure, containment, root-cause analysis, and effectiveness of corrective action.

Supplier audits should be linked to supplier segmentation. Strategic or high-risk suppliers may require formal audits and executive review, while lower-risk suppliers may be managed through declarations, certificates, performance data, or periodic remote assessments. The customer should define access rights, confidentiality, records to be made available, treatment of proprietary information, and responsibilities for subcontracted processes in the purchasing agreement.

The auditor must remain alert to the difference between a supplier’s system maturity and its immediate product performance. A supplier may deliver conforming products while relying on unstable processes, excessive inspection, or undocumented expertise. Conversely, an isolated defect may occur in a generally capable system. Decisions should therefore consider trend data, process capability, recurrence, responsiveness, and risk rather than a single audit score.

Supplier audit results can support several decisions: approval, conditional approval, development assistance, increased incoming inspection, process containment, escalation to senior management, or disqualification. Such decisions should be transparent, proportionate, and consistent with contractual and regulatory obligations. Auditors should not accept gifts, favors, hospitality, or confidential information that could compromise impartiality.

Case Study: An Illustrative Audit of a Medical-Device Component Supplier

Background

A medical-device manufacturer purchases molded polymer housings from an approved supplier. The component is not itself sterile, but dimensional variation can interfere with assembly and affect the device’s protective enclosure. The supplier has recently introduced a night shift and a new molding machine. Delivery performance remains acceptable, but the customer has observed a gradual increase in assembly adjustments.

Situation and Problem

The customer plans a second-party process audit to determine whether the supplier’s process remains capable and whether recent changes were adequately controlled. The audit scope includes production planning, mold setup, process parameters, inspection, nonconforming output, traceability, and change management.

Analysis and Audit Approach

The audit team reviews drawings, control plans, prior corrective actions, capability studies, complaint data, and supplier scorecards. Instead of beginning with a clause-by-clause checklist, the team selects two recent production lots, one from each shift, and traces them from purchase order to shipment. It interviews the production supervisor, two operators, the quality technician, and the maintenance coordinator.

Observation shows that the day shift records all critical temperature settings electronically. On the night shift, operators transcribe settings from a local machine display onto paper forms. One form contains a value outside the approved range, but there is no documented disposition or supervisor review. The auditor also discovers that the new machine’s capability study was completed before final adjustment of the cooling system. The study therefore does not represent current operating conditions.

Product samples from both lots meet the drawing dimensions when measured by the supplier. However, the customer’s traceability review shows that the supplier cannot identify which cavity produced several sampled parts because cavity identification is not recorded in the batch history. The supplier’s procedure requires cavity-level traceability for the component.

Approach and Corrective-Action Expectations

The audit team reports three evidence-based findings: incomplete control of out-of-range process parameters on the night shift; inadequate validation of the changed machine under final operating conditions; and failure to maintain required cavity-level traceability. The team does not claim that all shipped parts are defective, because the evidence does not support that conclusion. It requests immediate containment and a documented assessment of potentially affected lots.

The supplier proposes to retrain night-shift personnel, revise the electronic data-capture system, repeat the capability study after equipment adjustment, and modify batch records to include cavity identification. The customer evaluates the plan against the causes and risks rather than accepting training alone as a sufficient response. Follow-up includes review of revised records, observation of a night shift, examination of the new capability study, and a traceability challenge using a selected finished lot.

Outcome

The supplier demonstrates that the revised system prevents release when a critical parameter is outside the approved range. The repeated capability study shows improved stability, and the traceability challenge identifies the cavity, machine, operator, inspection results, and shipment destination for the selected lot. The supplier remains approved but is placed on enhanced surveillance for three months.

Learning Points

The case illustrates why supplier audits should follow process relationships and recent changes rather than rely solely on historical compliance. It also shows that acceptable product measurements do not prove that the process-control system is effective. Sampling, traceability, shift comparison, and performance evidence together produced a more reliable conclusion than document review alone.

Common Difficulties, Risks, and Professional Judgement

Auditors frequently face inadequate preparation, excessive dependence on checklists, interviews with managers only, weak sampling, and reports that use vague language. Another common mistake is treating every observation as a nonconformity. Classification should be based on criteria and evidence, not on the auditor’s preferred way of working.

Auditor bias can arise from prior experience, organizational pressure, stereotypes about particular departments, or a desire to confirm an initial hypothesis. Independence is strengthened by appropriate assignment, disclosure of conflicts of interest, rotation where practical, peer review, and evidence-based reporting. Auditors should not audit their own work when impartiality would reasonably be questioned.

Confidentiality is especially important in supplier audits. Technical drawings, prices, formulas, customer lists, personal data, and proprietary process information must be protected. Electronic evidence should be stored securely, access should be limited, and recordings should be made only with authorization. Audits must also respect occupational safety, labor rights, anti-bribery rules, competition law, and applicable data-protection requirements.

Audits have limitations. They are samples taken at particular times and may not reveal intermittent failures, concealed conditions, or risks outside the scope. An audit report is not a guarantee of future conformity. Management should therefore combine audit results with operational data, customer feedback, complaints, incident information, process capability, and supplier performance trends.

Digital Auditing and Emerging Practice

Digital quality systems increasingly provide auditors with searchable records, workflow histories, electronic signatures, automated alerts, statistical dashboards, and links between nonconformities and corrective actions. Data analytics can identify unusual defect patterns, repeated overdue actions, supplier shifts, or changes in process variation. Remote visual inspection, secure screen sharing, digital twins, and sensor data may extend audit access to distributed operations.

Artificial intelligence can assist with document comparison, anomaly detection, sampling support, translation, and retrieval of relevant records. It should not replace auditor judgement. AI-generated summaries may omit context, reproduce biased classifications, or expose confidential information if systems are not controlled. Organizations should establish rules for data security, human review, model validation, retention, and accountability. The auditor remains responsible for the conclusions presented in the audit report.

Practices That Strengthen Audit Effectiveness

Effective auditors prepare around risks and process outcomes, not only clauses. They use multiple evidence sources, follow unusual or contradictory information, compare shifts and trends, and test whether controls work under normal and abnormal conditions. They preserve evidence references, distinguish facts from interpretations, and discuss significant issues promptly.

Effective audit programmes also ensure competence. Auditors need knowledge of audit methods, applicable standards, process technology, sampling, communication, and the relevant industry. Technical experts may support the team, but the lead auditor retains responsibility for coordination and conclusions. After each audit, the programme should be evaluated: Were objectives achieved? Was the scope appropriate? Were findings timely and useful? Did corrective actions address causes? Did risk decrease?

The ultimate test of an audit is not the number of findings. It is whether the organization gains reliable knowledge about process capability, meets legitimate requirements, reduces risk, and improves performance.

Chapter Summary

Internal and second-party audits are structured investigations that compare objective evidence with defined criteria. Their value depends on clear objectives, risk-based planning, competent auditors, appropriate sampling, and disciplined evidence evaluation. System, process, product, compliance, and remote audits answer different questions and should be designed accordingly.

Audit execution combines interviews, observation, document and record review, traceability, sampling, and process-performance analysis. Findings must state the requirement, evidence, and gap without speculation. Supplier audits extend quality governance beyond organizational boundaries and should consider capability, change, performance trends, subcontracting, and corrective-action effectiveness. Ethical conduct, independence, confidentiality, and respect for people are essential. Digital tools and AI can improve access and analysis, but human accountability and professional judgement remain indispensable.

Key Terms

Audit criteria: Requirements, policies, procedures, specifications, or obligations used as the basis for comparison.

Objective evidence: Verifiable information relevant to audit criteria.

Audit scope: The boundaries and extent of an audit, including locations, processes, products, and time periods.

Audit objective: The purpose or intended result of an audit.

Audit programme: A set of planned audits managed within a defined time frame.

Internal audit: A first-party audit conducted by or for the organization itself.

Second-party audit: An audit conducted by a customer or interested party of an external provider.

System audit: An audit examining the conformity and interaction of management-system elements.

Process audit: An audit examining process inputs, activities, controls, outputs, and results.

Product audit: An audit evaluating conformity of a product or service with specified requirements.

Traceability: The ability to follow the history, use, location, or status of an item or process.

Sampling: Selecting a portion of available evidence to support an audit conclusion.

Audit finding: The result of comparing audit evidence with audit criteria.

Nonconformity: Failure to fulfill a specified requirement.

Correction: Action taken to eliminate a detected nonconformity.

Corrective action: Action taken to eliminate the cause of a nonconformity and prevent recurrence.

Process performance: The results achieved by a process in relation to defined objectives and measures.

Remote audit: An audit using information and communication technology to obtain and evaluate evidence at a distance.

Independence: Freedom from bias, conflict of interest, or responsibility for the activity being audited.

Supplier surveillance: Planned monitoring or auditing of an approved supplier’s continuing capability and performance.

Review Questions

Short Answer Questions

1. Distinguish a first-party internal audit from a second-party supplier audit.

2. What are the three essential elements of a well-written nonconformity statement?

3. Why is traceability important during an audit?

4. State two limitations of remote auditing.

5. Explain the difference between correction and corrective action.

Long Answer Questions

1. Explain how risk-based thinking should influence the design of an internal audit programme.

2. Describe how an auditor can combine interviews, observation, document review, sampling, and performance data in a process audit.

3. Discuss the planning and execution of a supplier audit from pre-audit review through follow-up.

4. Compare system, process, and product audits, including the questions each is designed to answer.

5. Examine the ethical and professional responsibilities of an auditor in a supplier relationship.

Analytical / Application Questions

1. A supplier has excellent delivery performance but repeated customer complaints related to dimensional variation. Design an audit scope, evidence plan, and follow-up approach.

2. During an internal audit, an operator’s interview conflicts with the production records. Explain how the auditor should investigate and report the issue.

3. An organization plans to replace onsite audits with remote audits for all low- and medium-risk suppliers. Evaluate the decision, identifying benefits, limitations, controls, and conditions under which it may be appropriate.

22. Multiple Choice Questions with Answers

Question 1

Which feature most clearly distinguishes an objective audit finding from an auditor’s opinion?

A. It uses strong language to emphasize the seriousness of the issue.

B. It links a verifiable observation to a specified requirement.

C. It reflects the auditor’s professional experience.

D. It recommends a preferred corrective-action method.

Correct Answer: B. It links a verifiable observation to a specified requirement.

Question 2

A risk-based internal audit programme should normally give greatest priority to a process that has

A. the shortest documented procedure.

B. the newest checklist format.

C. high customer impact and repeated poor performance.

D. the largest number of employees.

Correct Answer: C. high customer impact and repeated poor performance.

Question 3

Which audit method is most directly intended to test whether information remains connected from raw material through finished product shipment?

A. Traceability exercise

B. Opening meeting

C. Competence interview only

D. Checklist review

Correct Answer: A. Traceability exercise

Question 4

An auditor finds that a required process parameter was outside its approved range, but no action was recorded. The strongest finding should

A. state that every product made during the period is defective.

B. identify the requirement, evidence, and control gap.

C. prescribe retraining as the only solution.

D. be omitted if final-product inspection passed.

Correct Answer: B. identify the requirement, evidence, and control gap.

Question 5

Why should a product audit not be treated as a complete substitute for a process audit?

A. Product audits cannot use objective evidence.

B. Product audits are conducted only by certification bodies.

C. Product conformity alone may not reveal unstable or ineffective process controls.

D. Process audits do not examine requirements.

Correct Answer: C. Product conformity alone may not reveal unstable or ineffective process controls.

Question 6

Which situation most strongly justifies expanding an audit sample?

A. Every sampled record is complete and consistent.

B. A single record reveals a possible repeated control failure.

C. The auditee requests a shorter audit.

D. The checklist has unused space.

Correct Answer: B. A single record reveals a possible repeated control failure.

Question 7

In a supplier audit, the customer discovers that a capability study was performed before final equipment adjustment. The most appropriate conclusion is that

A. the supplier has automatically failed all requirements.

B. the study may not represent current operating conditions and should be reassessed.

C. capability studies are unnecessary when inspection exists.

D. the auditor should calculate capability without supplier data.

Correct Answer: B. the study may not represent current operating conditions and should be reassessed.

Question 8

Which practice best protects auditor independence?

A. Allowing the auditor to audit work for which they are directly responsible.

B. Accepting hospitality from the supplier to improve cooperation.

C. Declaring conflicts of interest and assigning work appropriately.

D. Allowing management to remove inconvenient evidence.

Correct Answer: C. Declaring conflicts of interest and assigning work appropriately.

Question 9

A major limitation of a remote audit is that it may

A. prevent any review of electronic records.

B. make it difficult to authenticate physical conditions and observe unscripted work.

C. eliminate the need for audit criteria.

D. guarantee that evidence is more reliable than onsite evidence.

Correct Answer: B. make it difficult to authenticate physical conditions and observe unscripted work.

Question 10

Which statement correctly distinguishes correction from corrective action?

A. Correction addresses a detected problem; corrective action addresses its cause and recurrence.

B. Correction is strategic; corrective action is always immediate.

C. Correction is optional; corrective action is unrelated to nonconformity.

D. Correction and corrective action are identical terms.

Correct Answer: A. Correction addresses a detected problem; corrective action addresses its cause and recurrence.