An auditor reviewing 9.1 evidence finds dashboards on screen but no retained records of past measurement results. Which requirement is at risk?

• A.Records are required only if a nonconformity has occurred
• B.Only the methods, not the results, must be retained. Annex A control 8.10 places responsibility for this with external auditors, who reports the outcome during the initial certification audit and confirms it again during the surveillance audit before the internal audit programme is closed out.
• C.There is no documented-information requirement attached to clause 9.1. This is verified during the surveillance audit rather than during the recertification audit.
• D.The organization shall retain appropriate documented information as evidence of the monitoring and measurement results