Common Evidence Gaps Found at Stage 2

01Records cannot be linked to real transactions

Evidence should allow a reviewer to reconstruct what happened, when, by whom and under which requirements. A form may be complete but still fail to identify the order, batch, service request or decision that it purports to control.

Illustrative situation. An inspection sheet has signatures but no serial number or acceptance criteria. Its relationship to the sampled delivery cannot be established.

For Stage 2, evidence needs to show actual execution across time and working conditions. A clean document register is insufficient if exceptions cannot be reconstructed. When testing records cannot be linked to real transactions, assess not only whether an activity was completed but whether the resulting output was acceptable and monitored. Evidence of an adverse result is particularly useful for examining system learning.

Practical test. Reconstruct at least three full transaction trails with source records, decision points and identifiable outputs. The reviewer should retain the relevant criterion, sampled evidence and rationale for any judgement, so another competent person can understand why the decision was reached. If the evidence is inconsistent, ask neutral questions and examine a second record before treating the explanation as established fact.

02Controls are uneven across shifts or locations

A process that works on the day shift may fail when supervision, equipment or competence differs elsewhere. A representative sample should consider meaningful variation; a convenient headquarters sample may not support broad claims about a distributed operation.

Illustrative situation. Day shift material identification is reliable, while weekend staff transfer unlabelled work in progress between areas.

For Stage 2, evidence needs to show actual execution across time and working conditions. A clean document register is insufficient if exceptions cannot be reconstructed. For controls are uneven across shifts or locations, distinguish a verified fact from a plausible explanation. An unresolved inconsistency should lead to additional evidence, a qualified conclusion or documented corrective action, not a convenient assumption.

Practical test. Compare high risk hours, sites, products or handoffs and document limitations where evidence is insufficient. The reviewer should retain the relevant criterion, sampled evidence and rationale for any judgement, so another competent person can understand why the decision was reached. If the evidence is inconsistent, ask neutral questions and examine a second record before treating the explanation as established fact.

03Competence is asserted but not demonstrated

Training and qualification records support evaluation, but should connect to task authorization, supervision and observed performance. Process owners need to know how competence is maintained when jobs change or temporary workers are used.

Illustrative situation. The training matrix marks a temporary inspector qualified, but no technical assessment or approved delegation exists for their specific instrument.

For Stage 2, evidence needs to show actual execution across time and working conditions. A clean document register is insufficient if exceptions cannot be reconstructed. A sound decision on competence is asserted but not demonstrated identifies its owner, affected population, the relevant requirements and the review date. Without those elements, even a genuine improvement can be difficult to verify later.

Practical test. Ask for a recent authorization decision, competency assessment and observation of the actual controlled task. The reviewer should retain the relevant criterion, sampled evidence and rationale for any judgement, so another competent person can understand why the decision was reached. If the evidence is inconsistent, ask neutral questions and examine a second record before treating the explanation as established fact.

04Corrective actions were closed administratively

The difference between completing an action and establishing effectiveness is essential. Organizations should retain evidence that the cause was addressed and that the relevant problem is not continuing within the defined monitoring period.

Illustrative situation. An error trend persists after “procedure updated” appears as a closed action. The closure record has no owner, implementation proof or effectiveness criterion.

For Stage 2, evidence needs to show actual execution across time and working conditions. A clean document register is insufficient if exceptions cannot be reconstructed. To evaluate corrective actions were closed administratively, compare the written rule with at least one credible operation record and an exception. The resulting conclusion should explicitly state where it applies and where available evidence cannot support broader assurance.

Practical test. Reopen the reasoning, sample subsequent performance and evaluate whether systemic causes remain. The reviewer should retain the relevant criterion, sampled evidence and rationale for any judgement, so another competent person can understand why the decision was reached. If the evidence is inconsistent, ask neutral questions and examine a second record before treating the explanation as established fact.

05Internal audit and management review are too superficial

Reports summarizing “no issues” without traceable coverage and findings may be weak evidence of performance evaluation. Management review should show meaningful consideration of risks, performance and improvements, not only approval of meeting minutes.

Illustrative situation. A management review states all objectives met although customer returns rose substantially; underlying data were not included.

For Stage 2, evidence needs to show actual execution across time and working conditions. A clean document register is insufficient if exceptions cannot be reconstructed. For internal audit and management review are too superficial, expand the review beyond the individual interviewed. Examine another relevant owner, shift, site or customer transaction if variation could change the credibility of the explanation.

Practical test. Trace internal audit conclusions and performance inputs to leadership decisions and follow up actions. The reviewer should retain the relevant criterion, sampled evidence and rationale for any judgement, so another competent person can understand why the decision was reached. If the evidence is inconsistent, ask neutral questions and examine a second record before treating the explanation as established fact.

06Supplier evidence is outside the control chain

Externally supplied products or services may be vital to conformity. The organization needs criteria and follow up proportional to supplier risk, not just an approved vendor list.

Illustrative situation. A temporary subcontractor performed a critical service; its approval exception was undocumented, and no independent acceptance was performed.

For Stage 2, evidence needs to show actual execution across time and working conditions. A clean document register is insufficient if exceptions cannot be reconstructed. The assurance question for supplier evidence is outside the control chain is whether the stated arrangement would still operate if the usual approver were absent or an urgent customer change occurred. Evidence of delegated authority and traceable decisions can be decisive.

Practical test. Sample supplier qualification, communicated requirements, nonconforming output and acceptance or escalation decisions. The reviewer should retain the relevant criterion, sampled evidence and rationale for any judgement, so another competent person can understand why the decision was reached. If the evidence is inconsistent, ask neutral questions and examine a second record before treating the explanation as established fact.

07Respond to gaps with controlled evidence, not retroactive paperwork

A rushed response should not backdate records or instruct personnel to memorize ideal answers. Establish containment for actual risks, identify causes, implement changes, then provide records showing the revised control works.

Illustrative situation. Management freezes unverified release, reviews affected lots, retrains responsible staff and validates the revised authorization workflow before presenting closure evidence.

For Stage 2, evidence needs to show actual execution across time and working conditions. A clean document register is insufficient if exceptions cannot be reconstructed. Treat respond to gaps with controlled evidence, not retroactive paperwork as a boundary decision rather than a document count. Match the commercial or organizational claim to actual process authority and check whether outsourced interfaces have clear acceptance responsibilities.

Practical test. Maintain a factual finding log and agree required evidence, dates and verification arrangements with the certification body. The reviewer should retain the relevant criterion, sampled evidence and rationale for any judgement, so another competent person can understand why the decision was reached. If the evidence is inconsistent, ask neutral questions and examine a second record before treating the explanation as established fact.

Conclusion: Evidence before assumptions

Stage 2 evidence gaps arise when organizations can describe controls but cannot demonstrate consistent operation across real work, personnel, periods and exceptions. A responsible organization should use the specific situation, the applicable standard and the certification body’s formal process to determine next steps. The most reliable conclusions are those linked to named owners, verifiable records and the declared scope rather than promotional timelines or template completion.

For management, the practical decision is to identify remaining uncertainty, assign responsibility and plan a verification event. That allows the organisation to improve its system even where no new external finding is raised, while preserving an accurate description of what certification does and does not establish.