8.3 Writing Nonconformity Statements: Requirement, Evidence & Nonconformity

Why the Write-Up Matters as Much as the Finding

Finding a genuine gap (Section 8.1) and grading it correctly (Section 8.2) can still be undone by a badly written nonconformity statement. If a client cannot see, from the words on the page, exactly what requirement was missed and exactly what evidence proves it, they can — and often will — challenge the finding at the closing meeting, delay corrective action, or appeal it to the certification body. A nonconformity statement is a piece of evidence in its own right: it must stand on its own, months later, in front of someone who was not in the room.

The Three-Part Model

Every nonconformity statement CQI/IRCA teaches contains exactly three components, always in this order:

1. The requirement — the specific clause of ISO 9001:2015, or the organization's own documented procedure, that was not met. Quote or closely paraphrase the actual clause number and wording — not "document control," but "ISO 9001:2015 clause 7.5.3.2 c), which requires control of changes to documented information."
2. The objective evidence — the specific, factual, verifiable evidence collected, described precisely enough that another auditor could go back and find the same record, interview the same role, or observe the same location.
3. The statement of nonconformity — the sentence (or two) that explicitly connects evidence to requirement: what did the evidence show, and how does that fail the cited requirement.

Miss any one of the three and the statement is incomplete. A requirement with no evidence is an accusation. Evidence with no requirement cited is an observation with nowhere to land. Evidence and requirement with no connecting statement leaves the reader to do the auditor's reasoning for them.

Worked Example: Bad vs. Good

Scenario: During a surveillance audit of a machine shop, the auditor finds that a precision micrometer in use on the Line 2 final-inspection bench is overdue for calibration.

BAD nonconformity statement:

"Calibration records were not properly maintained on Line 2. The inspector did not seem to fully understand the calibration procedure, and record-keeping in this area is generally poor."

This fails on every count:

• No requirement cited. Which clause? Which procedure?
• Vague, unverifiable evidence. "Not properly maintained" and "generally poor" describe an impression, not a fact anyone could check.
• An opinion about a person, stated as fact. "Did not seem to fully understand" judges an individual's competence rather than describing what was observed — and it isn't traceable to a named or even role-based source.
• Not traceable. No document reference, no date, no sample size. A reader six months later has nothing to go back and check.

GOOD nonconformity statement:

Requirement: ISO 9001:2015 clause 7.1.5.1 requires the organization to determine and provide the resources needed to ensure valid and reliable results when monitoring or measurement is used to verify conformity of products and services, and to retain appropriate documented information as evidence of fitness for purpose of the monitoring and measurement resources.

Objective evidence: The calibration log for micrometer #4471, in use at the Line 2 final-inspection bench, recorded a last calibration date of 12 August 2024 against a 12-month calibration interval defined in Calibration Procedure QP-14. Interview with the Quality Inspector (Shift 1) confirmed the instrument had remained in continuous use since that date with no record of re-calibration or verification. A further sample of 4 measuring instruments at the same bench showed all in-date.

Statement of nonconformity: Micrometer #4471 was in use beyond its due calibration date, with no documented evidence that its measurement results remained valid and reliable, contrary to the requirement of clause 7.1.5.1 to retain documented information demonstrating monitoring and measurement resources are fit for purpose.

Notice what changed: the requirement is named and quoted; the evidence is a specific instrument, a specific log, a specific date, a specific role, and an explicit sample (1 overdue out of 5 checked); the statement of nonconformity does the connecting work in one sentence, without editorializing about the inspector. Because only 1 of 5 sampled instruments was affected and the process itself clearly operates elsewhere on the bench, this example — per Section 8.2's grading criteria — would be graded minor, not major.

Wording Rules That Make or Break Defensibility

Beyond the three-part structure, a handful of wording rules separate a defensible nonconformity from one a client can successfully challenge:

• Be factual, not evaluative. Describe what was found, not what the auditor thinks it means about the person or the culture. "The record contained no signature" is fact. "The team is careless about documentation" is opinion — and opinions are not evidence.
• Never name an individual. Reference the role or job title ("the Machine Operator on Shift 2," "the Quality Manager") — never a person's name. Nonconformities are findings against the management system, not against people, and naming individuals invites a grievance rather than a corrective action.
• Quantify instead of generalizing. Replace "several," "many," "often," and "occasionally" with the actual count and sample size: "3 of 10 sampled records" is defensible; "several records" invites the question "how many, out of how many?"
• Cite the source precisely. Document titles, unique reference numbers, revision levels, dates, and locations let the finding be re-verified by anyone — the client's management, the certification body's technical reviewer, or an accreditation-body witness assessor.
• One issue, one nonconformity. Do not bundle two unrelated gaps against different clauses into a single statement; each distinct requirement failure gets its own three-part write-up so it can be individually tracked, corrected, and closed.
• Avoid absolutes the evidence doesn't support. If only one instance was sampled and found deficient, don't write "the organization does not calibrate its equipment" — that overstates evidence covering a single instrument into a claim about the whole organization, which the client can rightly reject.

Common Vague Language and Its Fix

Checking the Statement Before It's Final

Before a nonconformity statement leaves the audit team, it should pass three quick tests:

1. The clause test — can a reader identify, from the requirement line alone, exactly which ISO 9001:2015 clause or documented procedure was breached?
2. The stranger test — could someone who was not on the audit go and independently verify the evidence from the reference given (the document ID, the date, the role, the sample)?
3. The fairness test — is the statement free of opinion, free of named individuals, and scoped only to what the sampled evidence actually supports?

A statement that passes all three is ready to present at the closing meeting (Section 8.4) and to survive scrutiny long after the audit team has left the site — by the client's own corrective-action owner, by the certification body's technical reviewer, and, if the client disputes the grading, by an impartial appeals panel.