or is the CB allowed to wait months to upgrade an OFI as long as this is still before the certification decision is made?
As Howste indicated, ISO 17021-1 does not really have much granularity on this aspect of the audit report review process.
The reality is: many technical reviewers don't have much time to perform a thorough review of all audit reports they "process". In the overwhelming majority of the times, they would not pay much attention to softgraded NC's. In a small percentage of the cases, they would identify the softgrading, slap the auditors' wrist and tell them to never do it again. In some cases, they would send a memo to their auditors reminding them of no softgrading allowance.
For a CB to escalate an OFI to a NC,
months later, is extremely rare, because it creates problems for them and the registrant (their client). That's why the only plausible explanation I can think of is what I offered in my previous post. This CB is under external pressure to ensure they have stopped all softgrading in their audits, at the risk of having their accreditation suspended, if this is deemed a repeat offense by the AB. Even further, the audit report has already been read by the AB; otherwise, the CB would have told the auditor in question to revise the report and delete the OFI. Very likely this is part of a corrective action the CB has to implement to stop softgrading within their ranks.