Findings, nonconformity reporting, conclusions and corrective-action follow-up
Classifying findings
A nonconformity is a failure to fulfil a requirement of the audit criteria. 'Major' typically means a required element of the ISMS is absent, a systemic breakdown exists, or the failure would prevent the ISMS achieving its intended results or leaves significant risk unmanaged. 'Minor' typically means an isolated lapse that does not undermine the system. Other outputs include observations, opportunities for improvement and good practice - clearly distinguish these from nonconformities.
Writing a nonconformity
Use a three-part structure: Requirement (quote or cite the criterion, e.g. clause 8.1 or Annex A control), Evidence (what you saw, where, when, which sample - factual and traceable), Gap statement (how the evidence fails to meet the requirement). Do not state a root cause, and do not propose a remedy: that is consultancy and compromises impartiality. Avoid 'should', avoid vague adjectives, avoid lumping several failures into one finding or splitting one failure into many.
Conclusions
After evidence gathering, the team determines conformity and effectiveness overall, notes areas of good performance, and states whether the audit objectives were met. Audit conclusions are limited to the scope and samples audited.
Follow-up
Distinguish correction (fix the instance) from corrective action (address the cause and prevent recurrence), per clause 10.2. The organisation performs root-cause analysis and defines actions, responsibility and dates; the auditor verifies implementation and effectiveness, by desk review of evidence or at the next audit.
Rule of thumb
If you cannot point to the clause, quote the evidence and describe the gap in one sentence each, the finding is not yet ready to issue.