Identifying findings, grading nonconformities and evaluating objective evidence
From evidence to finding
A finding is the result of evaluating objective evidence against audit criteria. It may show conformity, nonconformity or an opportunity for improvement/good practice. A nonconformity is non-fulfilment of a requirement (ISO 9000). Write it in three parts: the requirement (quoted or precisely referenced), the evidence (what was seen, where, when, by whom, which record), and the gap. No opinions, no blame, no solution.
Grading
ISO 9001 and ISO 19011 do not themselves require grading; certification bodies and scheme rules commonly classify as major or minor.
- Major: a systemic failure, the absence of an effective required process, or a nonconformity likely to result in the management system failing to achieve its intended results or in nonconforming output; a legal breach is typically major.
- Minor: an isolated lapse that does not indicate a systemic failure.
Traps
- The myth that "one example means minor" - a single instance can be major where the requirement is entirely unaddressed.
- Reporting an opportunity for improvement as a nonconformity, or a minor as an observation to keep the peace.
- Grading on the auditee's reaction or seniority rather than on evidence and risk.
- Vague findings ("document control is weak") that cannot be verified or closed out.
Rule of thumb: ask two questions - "is the requirement addressed at all?" (no = major) and "if this were repeated, would conforming output still be delivered?" (no = major).