Findings, Reporting, and CAPA Follow-up
Classifying findings
A nonconformity is a failure to fulfil a requirement - nothing more and nothing less. Programme rules then grade it: a major typically reflects a systemic breakdown, a regulatory or safety impact, or a failure of a required process; a minor is an isolated lapse that the system should have caught. Some programmes add critical grades. An observation or opportunity for improvement notes risk without a demonstrable requirement breach and must never be dressed up as a nonconformity to look thorough.
Writing the finding
Use a three-part structure: requirement (cite the clause, regulation, or SOP), evidence (what you saw, where, when, which record), gap (why the evidence fails the requirement). Keep opinion, root cause, and recommended fixes out of the statement - those belong to the auditee's CAPA process.
The report
ISO 19011 expects objectives, scope, identification of client, auditee and audit team, dates and locations, criteria, findings, conclusions on conformity, and any statement about the extent to which criteria were met, plus limitations encountered.
CAPA discipline
Separate correction (fix this instance, for example rework or retrain) from corrective action (remove the cause so it does not recur) and from preventive action (act on risk before it happens). Require root cause analysis that goes beyond “human error” or “retraining needed.” Then verify two distinct things: that the action was implemented, and later that it was effective - an effectiveness check scheduled long enough for the action to have had a chance to work.
Traps
- Accepting retraining as a root cause.
- Closing a CAPA on an implementation record with no effectiveness evidence.
- Grading a documentation typo as major, or a systemic failure as minor.
Rule of thumb
Correction fixes the instance; corrective action fixes the system; effectiveness verification proves the system stayed fixed.