Findings, reporting and follow-up
From evidence to finding
A finding results from evaluating audit evidence against the audit criteria. Findings are conformity or nonconformity; many schemes also record opportunities for improvement and strengths. A nonconformity is a failure to meet a requirement - stated, generally implied, or obligatory.
Grading convention: a major nonconformity is a system breakdown, absence of a required process or arrangement, or a failure likely to cause significant risk or product/service failure. A minor is an isolated lapse or single deviation that the system would normally detect and correct. Grading rules are scheme-specific, so check the criteria before labelling.
Report and follow-up
The report states objectives, scope, criteria, dates and sites, the audit team, the process summary, findings with objective evidence and clause references, conclusions, and the sampling caveat. Issue it within the agreed timescale.
Corrective action has three parts: correction (fix the instance), root-cause analysis (why it occurred), and action to eliminate the cause so it does not recur, followed by verification of implementation and effectiveness before closure.
Trap: closing a nonconformity on the promise of action rather than evidence.
Trap: confusing correction with corrective action.
Trap: prescribing the solution - in third-party audits that becomes consultancy.
Trap: assuming a minor nonconformity needs no response; it still requires corrective action.
Rule of thumb
Ask 'why' until the answer is a process rather than a person, then ask what evidence would convince you the cause is truly gone.