Conducting an ISO 9001 audit
Evidence, verification and findings
The opening meeting confirms objectives, scope, criteria, schedule, methods, confidentiality and safety, and how findings will be reported. Then the auditor gathers evidence by interview, observation and document/record review, using a 'three-source' habit: what people say, what they do, and what the records show. Triangulated evidence survives challenge; single-source evidence invites dispute.
Evidence becomes a finding only after verification against the criterion. Record it precisely - what was seen, where, when, who was involved, and against which requirement. Then classify: nonconformity (requirement not fulfilled), conformity, or opportunity for improvement. Where grading is used, a major nonconformity typically indicates a systemic breakdown or an unaddressed requirement affecting the QMS's ability to meet requirements; a minor is an isolated lapse. Grading rules come from the audit programme or certification scheme, not the auditor's mood.
Traps: calling a one-off observation a system failure (or vice versa) without sampling rationale; issuing a nonconformity without a citation to a requirement; accepting a policy statement as evidence of practice; drifting outside the agreed scope without informing the audit client; debating instead of verifying. If a serious issue appears outside scope, note it and report it - but do not unilaterally extend the audit.
Rule of thumb: before you write a finding, ask 'could the auditee reasonably disagree because my evidence is thin?' If yes, sample further or drop it. Close each interview by summarising findings so there are no surprises at the closing meeting.