The NC statement was in my post. Thing is, there is no "solution" because there was no evidence that roles, responsibilities and authorities hadn't been assigned, communicated and understood. She just didn't "like" our org chart because it wasn't what she had seen before. She used the "lazy auditor" standard. Had she dug deeper, she would have reviewed our procedures and flowcharts, where the actual detailed assignment, etc. is laid out. Now the issue I have with such lazy auditing is that it triggers a required response -- root cause and all that. Pretty much worthless.