Audit Reporting, Nonconformity Classification and Follow-up
Report content
A report covers the audit objectives, scope, identification of client and auditee, audit team, dates and locations, criteria, findings, and conclusions - including a statement on the extent of conformity and any caveats about sampling and coverage. An audit is a sample; the report must not imply total assurance. Reports are dated, reviewed for consistency and issued within the agreed timescale; confidentiality rules govern distribution and retention.
Classifying nonconformities
Certification schemes, not ISO 14001, define the grading, so state the definition you are applying:
- Major: the absence of, or total failure to implement and maintain, a required system element; a nonconformity that raises significant doubt about the capability of the EMS to achieve intended results; a significant legal or permit breach; or a cluster of related minor nonconformities showing systemic failure in one requirement.
- Minor: an isolated lapse or single observed departure that does not indicate systemic breakdown and is unlikely to compromise the EMS.
The judgement is about effect on the system, not about how annoyed the auditor is. A single missing signature in an otherwise controlled record of thirty is minor; thirty uncontrolled records with no control process at all is major.
Corrective action and verification
Closure is not the acceptance of a corrective action plan. The auditor or certification body verifies that the correction, the root-cause analysis, the corrective action and its effectiveness have been demonstrated - by record review or follow-up audit. Many schemes allow around 90 days for major nonconformity corrective action, with certification withheld until it is verified; minor nonconformities are normally verified at the next scheduled audit. Check the scheme rule rather than quoting a figure.
Traps
Accepting “we will retrain the operator” as root cause; closing a nonconformity on the strength of a procedure revision with no evidence of implementation; failing to escalate when a nonconformity is repeated across audits.
Rule of thumb: if removing one person's error would make the problem vanish, suspect a minor; if removing one person would not change the outcome, you are looking at a system failure - major.