I just finished auditing the HR dept (one person). I found she was using job descriptions that weren't stored in our files (she sometimes operates independently as a consultant to other companies) and her descriptions were not approved for use (even though she knows best what the descriptions should be, they should still be reviewed/approved by someone on the management team). Technically, it's probably a document control NC, but she was trained and for 6 months was part of the management review team, so she should have known what was at stake, so I wrote the NC (CAPA) on 6.2.2 (2008) under records maintenance.