Audit findings, nonconformity classification and reporting
This domain tests how you convert evidence into a defensible finding, grade it consistently, and report conclusions the client can act on.
Core rules and concepts
- Definitions: conformity, nonconformity (a requirement not met), and observation or opportunity for improvement (not a nonconformity, but a risk worth flagging). The audit conclusion is the overall judgement; findings support it.
- Grading in the certification context. Major: the management system cannot achieve its intended outcome, a process or clause is absent or wholly ineffective, or a legal requirement is contravened with significant risk; correction and corrective action must be verified before certification. Minor: an isolated lapse that does not indicate system failure, normally verified at the next audit.
- Write a finding in three parts: the requirement (standard clause, legal provision or procedure), the evidence (what, where, when, record), and the gap. Do not write the cause, the remedy or the individual's name.
- Report content per ISO 19011: objectives, scope, criteria, dates and locations, team, findings, conclusions, limitations, and any unresolved divergence of opinion within the team.
- Consistency matters: the same evidence graded differently by two auditors is a competence problem. Calibrate in team briefings before the closing meeting.
- Use factual language: 'no evidence of', 'not implemented at', 'not maintained since'. Avoid 'poor culture' and 'careless'.
Worked example
Three extinguishers on two floors carry inspection tags expired six months, while the contractor's register records the visits as complete. That is not one isolated slip: the verification process is generating false records. Grade it major against 8.1.2 (controls not maintained) and 7.5 (documented information not reliable), quoting dates, tag numbers and the register entries.
Traps that cost marks
- Writing 'the supervisor was careless' - that is a cause and an opinion.
- Grading a legal contravention as minor because no injury occurred.
- Downgrading a failed process to an observation to keep the closing meeting calm.
- Reporting root causes you have not verified.