Although I know of no requirement that either must be defined as a process in itself, each is required to have a specific documented procedure. Both of these procedures may be part of a larger "process" and IMO could certainly be audited as part of that process. As long as the internal audit determines that the procedures are effectively implemented and maintained, I see no problem in not defining them as a specific process. You must remember that not all records are required to be documented just as all documents need not be controlled. Only those documents required by the QMS are required to be controlled and it is up to the company to define how they are controlled. If they are following their documented procedure and it is effectively implemented and maintained, they are most likely meeting the requirements.
As for the CAR, who wrote the C/A? Is it possible that the company considered the finding yet determined no control was necessary for those identified records? I have seen any number of corrective actions written by internal auditors that quite possibly should never have been written in the first place. Obviously, a judgment can't be made with as little information as we have here but based on the information given, I see nothing wrong with the company's approach. There is certainly a potential for a N/C and it is begging for a closer look but this may be a case of "One size does not fit all". When I audit, I try to determine conformance. The non-conformance will show up by itself.
Dave