1 What a finding is
An audit finding is the result of evaluating audit evidence against audit criteria. It can show conformity, nonconformity, or an opportunity for improvement. A nonconformity is the non-fulfilment of a requirement.
2 The three parts of a nonconformity statement
- Requirement — what should happen, with the source (clause of the standard, procedure, contract or legal requirement)
- Evidence — what you actually saw or were told: objective, specific, traceable (document references, dates, sample sizes, people’s roles — not names)
- Statement — why the evidence shows the requirement is not met
3 Worked example (fictional)
| Part | Example |
|---|---|
| Requirement | ISO 9001 clause 7.2 requires the organisation to retain documented information as evidence of competence. |
| Evidence | Of five welders sampled in the fabrication shop on 2 October, two had no record of the weld qualification required by work instruction WI-14. |
| Statement | Evidence of competence was not retained for all people doing work that affects product conformity. |
4 Grading
Certification bodies and organisations commonly grade nonconformities as major or minor (definitions vary between schemes and certification bodies). A major nonconformity typically affects the ability of the management system to achieve its intended results, or shows a requirement is not addressed at all; a minor one is an isolated lapse. Use the definitions your course or organisation gives you.
5 Common mistakes
- Writing an opinion (“training is poor”) instead of evidence
- Citing no requirement, or the wrong clause
- Naming individuals
- Recommending the fix — corrective action belongs to the auditee
- Combining several unrelated problems in one finding
6 After the finding
The auditee makes a correction (fixes the immediate problem), investigates the root cause and takes corrective action to stop it happening again. The auditor verifies the action at follow-up.