7.1 Evaluating Evidence & Categorizing Findings (Major, Minor, OFI)

7.1 Evaluating Evidence & Categorizing Findings (Major, Minor, OFI)

Quick Answer: Under ISO 19011:2018 Clause 6.4.8 and ISO/IEC 17021-1 Clause 9.4.5, audit findings are generated by evaluating verified objective evidence against audit criteria (ISO 14001 clauses, legal permits, and organizational procedures). Findings fall into three principal grades: Conformity, Nonconformity (subdivided into Major and Minor), and Opportunity for Improvement (OFI). A Major Nonconformity represents a systemic failure, direct environmental damage, a severe legal breach, or a total breakdown that threatens the EMS's intended outcomes. A Minor Nonconformity is an isolated operational lapse. An OFI highlights an area where conformity is achieved but resilience could be enhanced—provided the auditor never crosses into prescriptive consultancy.

---

The Finding Generation Process (ISO 19011:2018 Clause 6.4.8)

Audit findings do not represent personal auditor opinions; they are the output of a structured analytical comparison between two distinct inputs:

1. Audit Criteria: The baseline standard, legal statute, permit condition, or internal operating procedure against which performance is compared.
2. Audit Evidence: Verifiable qualitative or quantitative records, physical observations, and corroborated interview statements collected during the audit.

                     THE AUDIT FINDING EVALUATION PROCESS
                     
     +--------------------+              +--------------------+
     |   AUDIT CRITERIA   |              |   AUDIT EVIDENCE   |
     | • ISO 14001:2015   |              | • Physical records |
     | • Legal Permits    |              | • Observations     |
     | • Site SOPs        |              | • Corroboration    |
     +---------+----------+              +---------+----------+
               \                                  /
                \                                /
                 v                              v
              +------------------------------------+
              |   EVALUATION & TRIANGULATION       |
              |   (ISO 19011:2018 Clause 6.4.8)    |
              +-----------------+------------------+
                                |
                                v
             +------------------+------------------+
             |            AUDIT FINDINGS           |
             +------------------+------------------+
                                |
      +-------------------------+-------------------------+
      |                         |                         |
      v                         v                         v
+------------+         +-----------------+         +-------------+
| CONFORMITY |         | NONCONFORMITY   |         | OPPORTUNITY |
| (Standard  |         | (Failure to     |         | FOR IMPROVE-|
| fulfilled) |         | meet criteria)  |         | MENT (OFI)  |
+------------+         +--------+--------+         +-------------+
                                |
                +---------------+---------------+
                |                               |
                v                               v
       +-----------------+             +-----------------+
       |    MAJOR NC     |             |    MINOR NC     |
       | (System failure,|             | (Isolated lapse,|
       |  legal breach)  |             |  system sound)  |
       +-----------------+             +-----------------+

When evaluating evidence, the audit team must reach consensus on whether the evidence demonstrates fulfillment of criteria (Conformity) or non-fulfillment (Nonconformity). If the criteria are met but the auditor identifies potential risks or suboptimal practices, an Opportunity for Improvement (OFI) may be recorded.

---

Formal Categorization of Audit Findings

In accredited third-party certification audits, the grading of a finding directly dictates whether a certificate can be issued, maintained, or suspended under ISO/IEC 17021-1 Clause 9.4.5.

1. Conformity

• Definition: Fulfillment of an audit criterion or requirement (ISO 14001:2015 Clause 3.4.2).
• Context: The auditor gathers objective evidence confirming that planned operational controls, monitoring activities, and documentation satisfy both standard clauses and the organization's own documented policies.

2. Major Nonconformity (ISO/IEC 17021-1 Clause 3.12)

A nonconformity is graded as Major if it meets any of the following four critical thresholds:

1. Total Absence or Systemic Breakdown: The complete absence of an entire clause of ISO 14001:2015, or a complete failure of a core process (e.g., no procedure or mechanism for identifying compliance obligations under Clause 6.1.3, or an internal audit program has never been executed under Clause 9.2).
2. Doubt Regarding Intended Outcomes: Any situation that raises significant doubt about the ability of the environmental management system to achieve its intended outcomes (enhancing environmental performance, fulfilling compliance obligations, and achieving environmental objectives).
3. Active Environmental Damage or Severe Legal Breach: Any condition that has resulted, or presents an imminent risk of resulting, in severe environmental pollution, significant ecological damage, or an unaddressed breach of statutory legal limits.
4. Failure to Close Out Prior Findings: A minor nonconformity identified in a previous surveillance or certification audit that has not received effective root cause analysis and corrective action within the agreed timeframe.

3. Minor Nonconformity (ISO/IEC 17021-1 Clause 3.13)

A nonconformity is graded as Minor when:

• It represents an isolated lapse, single administrative omission, or localized breakdown in operational discipline.
• The overall management system is structurally sound and operating effectively.
• It does not undermine the organization's capacity to achieve its environmental objectives or control its significant environmental aspects.
• Example: Out of 40 hazardous waste transfer notes reviewed across the plant, one transfer note from three months ago is missing the registered carrier waste code, while all other 39 notes are complete, valid, and fully traceable.

4. Opportunity for Improvement (OFI) / Observation

• Definition: A recorded observation where the current operational practice meets the minimum requirements of the standard, but where the auditor identifies an area of potential vulnerability, inefficiency, or process enhancement.
• The Consultancy Boundary (ISO/IEC 17021-1 Clause 5.2): Auditors must exercise extreme caution when formulating OFIs. Under strict accreditation impartiality rules, an auditor must never provide consultancy, recommend specific commercial software, suggest exact engineering designs, or prescribe organizational changes. An OFI must state what area warrants management consideration, never how to solve it.

---

The Cumulative Effect: Aggregating Minor Findings into a Major

A critical competency tested on the CQI/IRCA Lead Auditor exam is identifying the Cumulative Effect. While a single operational lapse is a Minor Nonconformity, several similar minor nonconformities across different operational areas demonstrate that top management has failed to establish adequate control across the enterprise.

                       THE CUMULATIVE AGGREGATION EFFECT
                       
  Paint Shop: Obsolete SOP rev 2 in use (Clause 7.5) ------+
  Plating Line: Uncontrolled chemical log sheet ---------+ |
  Boiler House: Missing emission check sheet ------------+-+---> MAJOR NONCONFORMITY
  HazWaste Store: Outdated spill response poster --------+ |     Systemic breakdown in
  Effluent Plant: Superseded lab testing protocol -------+       Documented Information
                                                                 Control (Clause 7.5.3)

When evaluating findings, the Lead Auditor must step back from individual details and evaluate systemic health:

• If 1 out of 5 audited departments displays an uncalibrated measuring device, it is an isolated Minor Nonconformity against Clause 9.1.1.
• If 4 out of 5 audited departments are utilizing uncalibrated monitoring instruments (e.g., effluent pH meters, baghouse pressure gauges, stack flow meters, and noise decibel meters), this is no longer an isolated lapse. It represents a systemic breakdown in monitoring and measurement calibration, and must be aggregated and issued as a single Major Nonconformity against Clause 9.1.1.

---

Comprehensive Comparison: Major NC vs. Minor NC vs. OFI

---

Realistic CQI/IRCA Exam Grading Scenarios

Scenario 1: The Out-of-Date Calibration Certificate

• Audit Evidence: During an inspection of the wastewater treatment plant, the digital pH probe monitoring continuous sewer discharge possesses a calibration sticker that expired 18 days ago. Maintenance logs indicate weekly buffer checks were completed successfully, and historical discharge records show pH levels remained strictly between 7.2 and 7.8 (permitted limits: 6.0–9.0).
• Grading: Minor Nonconformity (Clause 9.1.1).
• Rationale: While calibration management lapsed, the organization performed routine buffer verifications, and evidence shows no environmental pollution or breach of legal limits occurred. It is an isolated lapse that does not represent a systemic monitoring collapse.

Scenario 2: Chronic Failure of Compliance Evaluation

• Audit Evidence: During the Stage 2 certification audit, the auditor requests the documented evaluation of compliance records for the site's air emissions permit and municipal industrial wastewater agreement. The EHS Coordinator admits that due to a staff shortage, no formal compliance evaluation has been performed for the past 16 months. Continuous monitoring data reveals three separate exceedances of the sulfur dioxide (SO2) stack limit during the prior quarter that were never investigated or reported to the environmental regulator.
• Grading: Major Nonconformity (Clause 9.1.2 & Clause 10.2).
• Rationale: This represents a total breakdown of a fundamental ISO 14001 requirement (evaluating compliance), combined with actual unaddressed legal violations and failure to notify authorities, directly undermining the intended outcomes of the EMS.

Scenario 3: Secondary Containment Drainage Protocol

• Audit Evidence: Chemical Storage Bay 2 features a concrete secondary containment bund housing twelve 1,000-liter IBCs of hydraulic oil. The bund is structurally intact, calculations verify it exceeds 110% capacity, and a manual drainage valve is installed. The valve is closed and padlocked, and the key is held by the bay supervisor. However, the company's spill response SOP does not specify how accumulated rainwater in the bund should be tested for hydrocarbons prior to discharge to stormwater.
• Grading: Opportunity for Improvement (OFI) (Clause 8.1).
• Rationale: The physical bunding, operational security, and capacity strictly conform to ISO 14001 and environmental regulations. However, formalizing rainwater testing criteria would enhance operational resilience and prevent accidental oil discharge.

Scenario 4: Cross-Departmental Document Control Failure

• Audit Evidence: In the machine shop, operators are working from revision 1 of the coolant recycling procedure (revision 3 is the active controlled version). In the paint shop, chemical mixing ratios are recorded on an informal, unstamped paper notebook. In the boiler house, the fuel tank inspection checklist is an outdated draft. In the hazardous waste yard, the emergency evacuation map displays an old layout with decommissioned exit gates.
• Grading: Major Nonconformity (Clause 7.5.3).
• Rationale: The Cumulative Effect. Four separate operating departments are utilizing uncontrolled, obsolete, or unauthorized documentation. This demonstrates a systemic failure of document control governance across the site.