Audit findings, nonconformity classification and conclusions
This domain tests whether you can distinguish evidence, finding, nonconformity and conclusion, write a nonconformity that survives challenge, and classify it defensibly.
Definitions
A finding is the result of evaluating collected audit evidence against audit criteria; it may show conformity or nonconformity. A nonconformity is non-fulfilment of a requirement (ISO 9000:2015). An audit conclusion is the outcome of an audit after considering the audit objectives and all findings.
Writing a nonconformity
State the requirement (clause, regulation or procedure and what it says), the evidence (what was seen, where, when, sample size) and the gap. Keep it factual and attributable to a process and location, not a person. "Two of ten drums in the waste yard lacked secondary containment (NC-01)" is defensible; "staff are careless" is not.
Classification
ISO 14001 does not define major and minor; certification bodies and client procedures do. A typical major: a required element is absent or systemically failed, a significant legal noncompliance, a failure that would prevent the EMS achieving intended outcomes, or a repeat of an unfixed minor. A typical minor: an isolated lapse in an otherwise implemented control with limited environmental consequence. An opportunity for improvement is not a nonconformity - do not disguise preferences as findings.
Conclusions
Conclude on conformity, effectiveness of implementation and whether the EMS is achieving intended outcomes. Conclusions may be qualified: "conforms, except for the major nonconformity in 8.2". Conclusions belong to the audit team and must be traceable to findings.
Worked example
An auditor reviews 20 hazardous waste consignment notes; two lack the carrier's signature. The site manager shows a monthly reconciliation with the carrier and no missing consignments, but an identical nonconformity was raised last month and the fix was not verified. Major is defensible: a repeat finding plus continuing control failure indicates systemic weakness in 8.1. If the two unsigned notes were the only issue and an effective fix had been verified, minor would fit. The reasoning turns on system failure and risk, not the count of documents.
Traps
- Raising a nonconformity with no requirement quoted.
- Classifying by number ("three findings equals major") instead of system failure and risk.
- Presenting observations or personal preferences as nonconformities.
- Naming individuals or attributing blame in the finding.
- Forgetting that a conclusion can be qualified.