Where: the internal-audit surface for the organisation, then its tasks/CAPA register

Internal audit (9.2)

Establish that audits are planned, performed, and that findings are classified. Look for a completed audit with a follow-up on record — a programme, not a single event.

Corrective action (10.2)

Follow a finding through to closure and check four things: owner, due date, recorded root cause, and who closed it. The platform enforces that the closer is never the owner.

Where this model is thin, and we would rather you found it from us

The product records that an action was completed. It is weaker on recording the effectiveness review — whether the action actually resolved the nonconformity, assessed afterwards. Test it and tell us how far short it falls.