Findings, Nonconformities and Audit Reporting

Introduction

An audit creates value only when its conclusions are trustworthy and usable. Auditors do not merely collect documents or record deviations; they evaluate objective evidence against defined audit criteria and communicate the results in a way that enables responsible decisions. A well-written audit report should allow an independent reader to understand what was examined, what was found, why the finding matters, and what action is required.

This chapter focuses on the professional judgement required after evidence has been collected. It explains how to distinguish conformity, nonconformity and opportunities for improvement; how to formulate defensible findings; how to reach audit conclusions; and how to prepare accurate, balanced and decision-useful reports. The discussion is consistent with the principles and guidance of ISO 19011 and with the treatment of nonconformity and corrective action in ISO 9001. ISO 19011 provides audit guidance, but it does not impose one universal grading system for findings. Classification rules must therefore be defined by the applicable certification body, regulator, customer, or organization.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the relationship between audit criteria, evidence, findings and conclusions.
2. Distinguish conformity, nonconformity, observations and improvement opportunities.
3. Classify nonconformities using stated and defensible rules.
4. Write findings that are specific, objective, traceable and evidence-based.
5. Evaluate the significance and risk of audit findings.
6. Prepare an accurate, balanced and useful audit report.
7. Apply professional judgement, confidentiality and impartiality in reporting.

1. From Audit Evidence to Audit Finding

An audit compares evidence with criteria. Audit criteria are the policies, procedures, contractual requirements, standards, legal obligations, objectives or other requirements against which evidence is evaluated. Audit evidence consists of records, statements of fact or other information relevant to the criteria and capable of verification. Evidence may include observations, interviews, documents, electronic records, measurements, samples and data.

A useful conceptual chain is:

Criteria → Evidence → Evaluation → Finding → Conclusion → Action

The chain is important because a finding cannot be stronger than the evidence supporting it. If the criterion is unclear, the evaluation may be inconsistent. If the evidence is based only on an unsupported opinion, the finding is vulnerable to challenge. If the finding is poorly written, managers may not understand the required response.

1.1 Criteria, evidence and judgement

Auditors exercise judgement, but judgement must be disciplined. The auditor should ask:

• What requirement applies?
• What evidence was examined?
• Is the evidence sufficient and appropriate for the audit objective?
• Does the evidence demonstrate that the requirement is met, partly met or not met?
• Is the conclusion repeatable by another competent auditor using the same evidence?

Evidence is sufficient when there is enough of it to support a conclusion. Evidence is appropriate when it is relevant and reliable. A single interview statement may indicate an issue, but a record, observation or corroborating interview may be needed before a formal nonconformity is raised. Conversely, a small sample may be enough when the issue is direct, critical and clearly documented, although sampling always introduces a risk that the sample does not represent the whole population.

1.2 Triangulation

Triangulation means comparing different evidence sources. For example, an auditor may compare a procedure, an employee’s explanation and completed records. Agreement among these sources increases confidence. Differences do not automatically prove nonconformity, but they require investigation.

Consider a calibration process. The procedure requires instruments to be calibrated before use. The auditor examines the calibration register, observes an instrument in production and interviews the operator. If the register shows a current calibration certificate, the instrument label is current, and the operator understands the control, the evidence supports conformity. If the register is current but the observed instrument has an expired label, the auditor must determine whether the label is incorrect, whether the instrument is actually overdue, or whether the control failed.

2. Types of Audit Results

2.1 Conformity

Conformity is fulfilment of a requirement. It should be stated in relation to a criterion, not as a general compliment. “The organization is good at quality” is not an auditable conclusion. “The sampled incoming-inspection records for January to March identified acceptance criteria and were approved by authorized personnel, as required by procedure QP-07” is a more defensible conformity statement.

Positive conformity evidence is useful because it identifies effective controls and helps management understand what should be maintained. Reports should not focus exclusively on failures.

2.2 Nonconformity

Nonconformity is non-fulfilment of a requirement. The requirement may arise from an ISO standard, a documented management-system procedure, a law, a customer contract, or an internal objective that has been formally adopted as an auditable criterion.

A nonconformity should normally contain three elements:

1. Requirement – what was required.
2. Evidence – what was found.
3. Statement of non-fulfilment – how the evidence demonstrates that the requirement was not met.

Example:

Procedure PR-12 requires operators to record final inspection results before product release. In a sample of 20 release orders from February, four had no completed final-inspection record, although the orders had been released. Therefore, the organization did not consistently implement the required final-inspection control.

This formulation is stronger than “Inspection records are poor” because it identifies the requirement, sample and nature of the failure.

2.3 Observation

An observation is a factual note that may require attention but does not, on the available evidence, justify a nonconformity. Some organizations use “observation” for a potential weakness, an unusual condition or an issue requiring monitoring. Because the term is interpreted differently, the audit protocol should define it.

An observation must not be used to avoid raising a genuine nonconformity. Nor should it be used to introduce personal preferences that are unrelated to the criteria.

2.4 Opportunity for improvement

An opportunity for improvement identifies a possible enhancement where conformity has been demonstrated. For example, a supplier-performance report may meet all requirements but require considerable manual effort. Suggesting automated trend analysis may be useful, but it is not a nonconformity unless automation is required by the criteria.

Auditors should distinguish improvement advice from consultancy. An auditor can identify a risk or improvement opportunity, but should avoid designing the solution, selecting a supplier or assuming management responsibility for implementation.

2.5 Positive practice

A positive practice is an effective or innovative method supported by evidence. Examples include effective use of risk-based supplier segmentation, rapid containment of customer complaints, or clear visual controls that reduce error. Positive practices can support organizational learning, provided they are reported objectively rather than exaggerated.

3. Nonconformity Classification

There is no single classification system universally required by ISO 19011. Many certification and internal-audit schemes use categories such as major and minor nonconformity. The organization must define the rules before the audit or apply the rules of the relevant external scheme.

A common professional interpretation is:

Classification should consider the requirement, extent, recurrence, risk, effect on conformity of outputs, and effectiveness of existing controls. A small number of errors can still be major if the affected activity is safety-critical or legally significant. Conversely, several clerical errors may remain minor if they are isolated, promptly detected and do not compromise results—although repeated “minor” findings may collectively indicate a systemic issue.

Auditors should never classify findings merely by counting defects. Severity is not the same as frequency. The classification rationale should be recorded, especially where the scheme permits professional judgement.

4. Writing a Defensible Finding

A finding should be clear to the process owner, audit program manager and an independent reviewer. The following structure is effective:

Requirement + objective evidence + gap + significance or scope

4.1 State the requirement precisely

Cite the relevant clause, procedure, work instruction, contract, law or objective. Avoid vague references such as “quality policy” when the actual requirement is in a specific procedure. If a standard clause contains several requirements, identify the relevant part.

4.2 Describe evidence, not assumptions

Use observable facts: document identifiers, dates, sample sizes, locations, equipment numbers, transaction references and interview statements where appropriate. Avoid unsupported words such as “careless,” “unprofessional,” “always,” or “never.”

Weak wording:

The warehouse does not control stock properly.

Stronger wording:

Work instruction WI-04 requires all quarantined material to be physically identified and recorded in the quarantine register. During the visit on 14 May, three of eight sampled quarantined pallets had no quarantine identification, and two were not listed in the register. The required identification and registration control was therefore not consistently implemented.

4.3 Make the gap explicit

The reader should not have to infer why the evidence is a problem. State the relationship between evidence and requirement. A finding is not a list of observations; it is an evaluation.

4.4 Preserve traceability

A finding should allow the evidence to be retrieved. Useful references include record numbers, dates, sample descriptions and interview roles. Personal data should be minimized and protected. Names are rarely necessary in a general report.

4.5 Avoid overstatement

If the auditor sampled eight pallets, the report should not claim that all pallets were uncontrolled unless additional evidence supports that conclusion. Use terms such as “in the sample examined” and explain the basis for any wider conclusion.

4.6 Separate correction from corrective action

A correction removes a detected nonconformity, such as updating a missing record or relabelling material. Corrective action eliminates the cause of the nonconformity to prevent recurrence, such as revising training, improving system prompts or changing verification responsibilities. An audit report should identify the nonconformity; management is responsible for determining and implementing appropriate corrections and corrective actions, subject to the applicable follow-up process.

5. Evaluating Significance and Risk

Risk-based evaluation helps auditors distinguish an isolated administrative lapse from a failure that threatens intended results. Relevant questions include:

• Could the failure affect product or service conformity?
• Could it breach legal, regulatory or contractual requirements?
• Is the process safety-, health- or environmentally critical?
• Is the failure repeated across departments, shifts or sites?
• Was the failure detected before reaching the customer?
• Are controls capable of detecting the problem?
• Does the issue indicate that the management system is not achieving its intended outcome?

Risk should inform judgement, not replace evidence. An auditor should not label a finding major solely because a hypothetical risk can be imagined. The report should explain the evidence and, where relevant, the credible consequence.

A useful qualitative model is a risk matrix based on likelihood and consequence. Such matrices are organizational tools rather than universal ISO requirements. Their categories and thresholds must be defined consistently. Auditors should not disguise personal judgement as a numerical risk score when the underlying data are uncertain.

6. Reaching Audit Conclusions

An audit conclusion is the overall result of evaluating the audit objectives and all findings. It is broader than an individual finding. Conclusions may address:

• the extent to which criteria were fulfilled;
• the effectiveness and implementation of processes;
• the capability of the management system to achieve intended results;
• significant risks and recurring issues;
• the need for corrective action or further audit activity.

A conclusion should be supported by the scope, sampling approach and findings. It should not imply certainty beyond those boundaries. For example:

Within the sampled production, purchasing and complaint-handling processes, the management system was generally implemented and capable of meeting specified requirements. Two minor nonconformities were identified in record control and supplier evaluation. No evidence in the sampled areas indicated a systemic failure; corrective action should nevertheless address the recurrence of incomplete supplier reviews.

This is more useful than “Audit passed,” because it states the basis and limitations of the conclusion.

6.1 Closing meeting and factual accuracy

Findings should be discussed with relevant process owners before the report is finalized. The purpose is to confirm that evidence has been understood, not to negotiate away valid findings. If the auditee provides new evidence, the auditor should evaluate it objectively and amend the finding where justified. Disagreement should be documented rather than concealed.

7. The Audit Report

An audit report is a controlled communication. Its format varies, but a professional report normally includes:

1. audit title, report identifier and date;
2. audit objectives, scope and criteria;
3. locations, processes and time period examined;
4. audit team and participants, where appropriate;
5. methodology, sampling and significant limitations;
6. overall conclusion;
7. detailed findings with classification and evidence;
8. positive practices and improvement opportunities;
9. unresolved disagreements or constraints;
10. required response, responsible authority and due dates;
11. distribution, confidentiality and approval information.

7.1 Balanced reporting

Balanced reporting does not mean giving equal space to positive and negative statements. It means representing the evidence fairly. A report should acknowledge effective controls while giving clear prominence to significant risks and nonconformities. Excessively positive language can conceal problems; excessively negative language can damage credibility and discourage cooperation.

7.2 Executive summary

Senior managers often read the executive summary first. It should state the audit purpose, scope, overall conclusion, significant findings, immediate risks and required decisions. It should not introduce a conclusion that is absent from the detailed evidence.

7.3 Finding register

A finding register may contain the following fields:

The report should distinguish auditor findings from management responses. A response is not evidence that the original condition did or did not exist.

8. Follow-up and Closure

An audit is not complete merely because a report has been issued. Follow-up determines whether the organization has analysed the cause, implemented action and verified effectiveness. The depth of follow-up should reflect the significance of the finding.

A closure decision should consider:

• whether correction addressed the immediate condition;
• whether the cause was analysed adequately;
• whether corrective action was implemented;
• whether objective evidence demonstrates effectiveness;
• whether similar risks exist elsewhere.

“Action completed” is not equivalent to “finding effectively closed.” For example, retraining an employee may correct an immediate issue, but it may not address unclear instructions, excessive workload or inadequate system controls. Auditors should verify outcomes rather than accept promises or documents without evidence of implementation.

9. Professional, Ethical and Governance Considerations

Audit reporting involves authority and sensitive information. Auditors should maintain integrity, impartiality, confidentiality and evidence-based judgement. Conflicts of interest must be disclosed. An auditor should not report confidential personal information unnecessarily, manipulate classification to satisfy management, or suppress an adverse finding because it is inconvenient.

Reports should be controlled to prevent unauthorized alteration. Electronic audit systems should preserve version history, access rights and approval records. Artificial intelligence may assist with searching records, identifying repeated wording or generating a draft structure, but it must not replace auditor judgement. Sensitive audit evidence should not be entered into an unapproved external AI service. Every AI-assisted output requires human verification for accuracy, confidentiality, bias and traceability.

Auditors should also recognize power differences. Employees may hesitate to speak openly when supervisors are present. Private interviews, clear explanations of confidentiality and non-retaliation expectations can improve evidence quality, subject to organizational policy and legal requirements.

10. Illustrative Case: Supplier Evaluation at Meridian Components

This is a fictional illustrative case.

Background

Meridian Components manufactures electrical assemblies. Its purchasing procedure requires critical suppliers to be evaluated annually using delivery, quality and responsiveness data. Suppliers rated below the approved threshold require a documented improvement plan or management review.

Problem

During an internal audit, the auditor examined 12 critical suppliers. The purchasing manager stated that all suppliers had been reviewed. The supplier register showed evaluation dates for 11 suppliers, but one supplier had no completed evaluation. For two other suppliers, delivery performance was recorded, but quality-performance data were blank. Both suppliers had supplied components used in products shipped to customers.

Analysis

The criterion was the annual supplier-evaluation procedure. Evidence consisted of the register, evaluation forms, delivery data, quality records and an interview. The evidence demonstrated more than a missing signature: the required evaluation process had not been consistently implemented, and the organization could not demonstrate that quality performance had been considered for two suppliers.

The auditor checked whether production inspection records showed defective components from these suppliers. No customer escapes were identified in the audit sample, but one supplier had a higher internal rejection rate than the approved target. This increased the significance of the finding, although it did not by itself prove customer impact.

Finding and classification

Procedure PUR-08 requires annual evaluation of critical suppliers using delivery and quality-performance data. In the sample of 12 critical suppliers, one had no annual evaluation, and two evaluation forms contained no quality-performance data. One of the two suppliers exceeded the internal component-rejection target during the review period. The organization could not demonstrate consistent implementation of the required supplier-evaluation and escalation process.

Under Meridian’s audit protocol, the finding was classified as a major nonconformity because the failure affected multiple suppliers and weakened a control intended to manage quality risk in purchased components.

Approach and outcome

Management performed immediate correction by completing the missing evaluations and reviewing affected supplier lots. Corrective-action analysis identified that the purchasing system required delivery data but did not prompt users for quality data or escalation decisions. The organization revised the electronic form, assigned quality responsibility for data verification and introduced a quarterly review of critical suppliers. A follow-up audit verified completed evaluations, system prompts and improved rejection-rate monitoring. The finding was closed only after objective evidence demonstrated that the revised process operated effectively over a defined period.

Learning points

1. A complete-looking register may conceal missing evaluation content.
2. The finding should identify the failed requirement, not merely the missing document.
3. Risk significance depends on the process purpose and affected outputs.
4. Correction and corrective action are different.
5. Closure requires evidence of effectiveness, not only a revised procedure.

11. Common Reporting Failures and Best Practices

Common failures include vague language, unsupported generalization, failure to cite criteria, mixing several unrelated issues into one finding, confusing suggestions with requirements, and accepting corrective action without effectiveness evidence. Another failure is “audit by checklist,” in which the auditor records yes/no answers without understanding process performance or risk.

Best practices are to:

• agree criteria and classification rules before auditing;
• maintain clear working papers and evidence references;
• use representative sampling and disclose its limits;
• write findings promptly while evidence is fresh;
• have another competent person review wording for clarity;
• distinguish facts, interpretations and recommendations;
• use consistent severity rules;
• confirm factual accuracy with process owners;
• protect confidential information;
• track corrective action to verified effectiveness;
• review recurring findings across audits for systemic patterns.

Chapter Summary

Audit findings are produced by evaluating objective evidence against defined criteria. Conformity demonstrates fulfilment of a requirement; nonconformity demonstrates non-fulfilment; observations and improvement opportunities identify concerns or possible enhancements that do not necessarily constitute failures. A defensible nonconformity states the requirement, presents traceable evidence and explains the gap without exaggeration.

Classification should follow the applicable audit scheme and should consider extent, recurrence, risk, legal significance and effect on intended results. Audit conclusions must remain within the boundaries of the scope, sampling and evidence. Effective reports are accurate, balanced, confidential, traceable and useful for decision-making. Follow-up must verify not only correction but also root-cause treatment and effectiveness. Ethical conduct, impartiality and controlled use of technology are essential to the credibility of the audit function.

Key Terms

Audit criteria: Requirements, policies, procedures or other standards used for comparison.

Audit evidence: Verifiable information relevant to audit criteria.

Audit finding: Result of evaluating evidence against criteria.

Audit conclusion: Overall result reached after considering audit objectives and findings.

Conformity: Fulfilment of a requirement.

Nonconformity: Non-fulfilment of a requirement.

Objective evidence: Verifiable facts supporting an audit conclusion.

Sufficient evidence: Evidence adequate in amount to support a conclusion.

Appropriate evidence: Relevant and reliable evidence.

Triangulation: Comparison of evidence from different sources.

Major nonconformity: Significant or systemic failure under an applicable classification scheme.

Minor nonconformity: Limited failure that does not indicate complete system breakdown.

Observation: Factual concern not necessarily meeting the threshold for nonconformity.

Opportunity for improvement: Suggested enhancement where conformity exists.

Correction: Action to eliminate a detected nonconformity.

Corrective action: Action to eliminate the cause of a nonconformity and prevent recurrence.

Audit scope: Boundaries and extent of an audit.

Sampling: Examination of a selected portion of available evidence.

Finding register: Controlled list of findings and related follow-up information.

Review Questions

Short Answer Questions

1. What is the relationship between audit criteria, evidence and findings?
2. State the three essential elements of a well-written nonconformity.
3. Distinguish correction from corrective action.
4. Why should audit reports disclose sampling limitations?
5. What is meant by triangulation of evidence?

Long Answer Questions

1. Explain how an auditor should evaluate evidence before classifying a result as a nonconformity.
2. Discuss the difference between major and minor nonconformities and explain why classification rules must be defined by the applicable audit scheme.
3. Describe the structure and content of a professional audit report.
4. Explain how risk, recurrence and process significance influence audit judgement.
5. Discuss the ethical responsibilities of auditors when preparing and distributing reports.

Analytical / Application Questions

1. An auditor finds two incomplete records in a sample of 30, but the records concern legally required safety inspections. Explain what additional evidence should be examined and how the finding might be classified.
2. A department has met every documented requirement, but its manual reporting process causes delays and duplicated work. Should this be reported as a nonconformity, observation or improvement opportunity? Justify your answer.
3. Draft a complete evidence-based nonconformity for a process in which a required approval was missing from three of ten sampled transactions. State the criterion, evidence, gap and likely follow-up needs.

Multiple Choice Questions with Answers

Question 1

Which sequence best represents the movement from audit work to management action?

A. Opinion → checklist → interview → conclusion → evidence

B. Criteria → evidence → evaluation → finding → conclusion → action

C. Action → finding → criteria → evidence → sampling

D. Conclusion → criteria → action → evidence → finding

Correct Answer: B. Criteria → evidence → evaluation → finding → conclusion → action

Question 2

Which statement best defines conformity?

A. A general belief that the process is effective

B. Fulfilment of an applicable requirement

C. A recommendation made by an auditor

D. Completion of every possible improvement

Correct Answer: B. Fulfilment of an applicable requirement

Question 3

Which item is essential in a defensible nonconformity?

A. The auditor’s personal opinion of the process owner

B. A prediction that failure will certainly occur

C. The requirement, objective evidence and explanation of the gap

D. A recommendation to purchase new software

Correct Answer: C. The requirement, objective evidence and explanation of the gap

Question 4

What is triangulation in auditing?

A. Assigning three auditors to every process

B. Comparing evidence from different sources

C. Using only numerical evidence

D. Repeating the same interview three times

Correct Answer: B. Comparing evidence from different sources

Question 5

Which statement about ISO 19011 and finding classification is most accurate?

A. It requires every audit to use exactly three severity levels

B. It prohibits classification of findings

C. It provides audit guidance but does not impose one universal grading system

D. It requires every observation to be classified as major

Correct Answer: C. It provides audit guidance but does not impose one universal grading system

Question 6

What is the main difference between correction and corrective action?

A. Correction removes a detected issue; corrective action addresses its cause and recurrence

B. Correction is always strategic; corrective action is always administrative

C. Correction is performed by auditors; corrective action is performed by customers

D. There is no meaningful difference

Correct Answer: A. Correction removes a detected issue; corrective action addresses its cause and recurrence

Question 7

Which wording is most evidence-based?

A. The warehouse is careless and disorganized

B. The staff clearly do not understand quality

C. Three of eight sampled quarantined pallets lacked identification required by WI-04

D. The warehouse needs a completely new system

Correct Answer: C. Three of eight sampled quarantined pallets lacked identification required by WI-04

Question 8

Why should an audit conclusion acknowledge scope and sampling?

A. To avoid recording any findings

B. To ensure the conclusion does not imply evidence beyond what was examined

C. To replace the need for objective evidence

D. To make the report longer

Correct Answer: B. To ensure the conclusion does not imply evidence beyond what was examined

Question 9

Which condition most strongly supports a systemic or major classification, subject to the applicable scheme?

A. A typographical error with no process effect

B. A single corrected spelling mistake

C. Repeated failure of a required control across several areas

D. A suggestion to improve report formatting

Correct Answer: C. Repeated failure of a required control across several areas

Question 10

What should be verified before closing a corrective-action finding?

A. Only that a new procedure was written

B. Only that the process owner promises completion

C. Implementation and objective evidence of effectiveness

D. That the original finding has been deleted

Correct Answer: C. Implementation and objective evidence of effectiveness