12.3 Types of Audit Findings

12.3 Types of Audit Findings

Quick Answer: Audit findings express evaluation results against criteria. Common categories are conformity, minor nonconformity, major nonconformity, plus related terms such as observation (or opportunity for improvement) and, in some schemes, anomaly. Classification depends on extent, systemic nature, and impact on the EMS's ability to achieve intended outcomes — not on whether the auditor was surprised.

Lead Auditor exams love classification traps: calling every paperwork lapse major, treating legal noncompliance as a mere observation, or inventing findings without criteria. Master the definitions, then practice on EMS scenarios.

---

1. Conformity

Conformity means fulfillment of a requirement. When sampled evidence shows that a process meets the cited criterion within the audit's confidence limits, record conformity (often summarized rather than written as lengthy praise). Conformity statements should still be evidence-based: "For the waste streams sampled in Building B, manifests and storage time controls met Procedure ENV-07 and ISO 14001 operational control expectations."

Do not invent "partial conformity" as a soft nonconformity. If a requirement is not fulfilled, classify the nonconformity appropriately; if it is fulfilled within the sample, say so without burying unresolved gaps.

---

2. Nonconformity — The Core Definition

A nonconformity is non-fulfillment of a requirement. The requirement may come from:

• ISO 14001:2015
• The organization's EMS (procedures, criteria, policies it established)
• Applicable compliance obligations the organization must meet as part of its EMS commitments

Every nonconformity needs a clear requirement + evidence of non-fulfillment link. Without both, you have a complaint, not a finding.

---

3. Minor vs Major Nonconformity

Certification and many CB procedures distinguish severity. Exact wording varies by scheme, but exam-ready concepts are stable:

Aggregation rule: Several related minor nonconformities against the same requirement or process can demonstrate a systemic issue and support major classification. Conversely, one serious failure (complete absence of internal audit) can be major even if "only one" finding is written.

Certification impact (awareness): Majors typically must be satisfactorily addressed before initial certification is granted; minors also require correction/corrective action on defined timelines. Know your CB/scheme rules in practice; for the exam, focus on classification logic.

---

4. Observation / Opportunity for Improvement (OFI)

An observation or OFI is generally not a nonconformity. It highlights a risk, weakness, or improvement chance where requirements are still met (or where evidence does not support an NC). Examples:

• Procedure works, but wording is ambiguous and could cause future errors
• Monitoring meets legal frequency, but trending is manual and error-prone
• Good conformity now, but competence depth is thin if the only expert leaves

Trap: Using "observation" to avoid writing a real nonconformity when a requirement is clearly unmet — especially for legal noncompliance. If a compliance obligation is not fulfilled and the EMS requires fulfillment/evaluation/action, that is typically an NC, not a polite observation.

---

5. Anomaly

Some audit methodologies and training schemes use anomaly for information that appears inconsistent, unexpected, or not yet explained — a signal to investigate further rather than a final classification. Example: sudden unexplained drop in hazardous waste quantities while production rose. An anomaly is a prompt for corroboration, not a substitute for a nonconformity statement.

Once investigated:

• Explained and conforming → close as clarified
• Reveals unmet requirement → raise NC (minor/major as appropriate)
• Remains unclear with risk → expand sample or escalate within team rules; do not leave material issues hanging without a documented path

---

6. EMS-Specific Classification Traps

Trap A — "It's only paperwork"

Missing compliance evaluation records, absent aspects updates after a process change, or unsigned legal-register reviews can be majors when they show the system element is not functioning. Paperwork can be evidence of system failure.

Trap B — "No spill happened, so no NC"

ISO 14001 is not only outcome-based in the moment. Missing operational controls, competence, or emergency preparedness for a significant aspect can be nonconformities even without an incident during the audit.

Trap C — Downranking legal issues

Failure to meet a compliance obligation, or failure of the EMS processes that identify/evaluate/act on obligations, is rarely a casual OFI. Classify against the actual requirement. Note: auditors do not act as prosecutors, but they do evaluate EMS conformity related to compliance obligations.

Trap D — One bad number = automatic major

A single exceedance with immediate correction, root-cause analysis underway, and effective escalation may be a minor (or even handled within a conforming response process) depending on criteria and pattern. A single exceedance ignored for months with continued discharge is far more serious. Judge system response and extent, not panic at the first red cell in a spreadsheet.

Trap E — Positive findings without evidence

"Great culture" is not a conformity finding unless tied to criteria and evidence.

---

7. Decision Aids

Ask:

1. What exact requirement is in play?
2. What objective evidence shows non-fulfillment?
3. Is the issue isolated or systemic / multi-area?
4. Does it create significant doubt about EMS effectiveness or intended outcomes?
5. Is there actual or likely serious environmental impact linked to the failure?
6. Have related minors already shown the same breakdown?

If (3)–(5) trend yes, major is more likely. If a clear requirement is unmet but localized and the system element otherwise functions, minor is more likely. If no requirement is unmet, consider observation/OFI or no finding.

---

8. Recording Classification Consistently

Use the scheme's terms consistently across the team. Do not mix "major CAR," "category 1," and "critical" in one report unless the CB procedure defines those synonyms. Align classification in the audit team meeting before the closing meeting to avoid contradictory messages to the auditee.

---

9. Exam Focus

Expect scenarios that mix a tidy EMS manual with weak implementation, or a real legal breach soft-pedaled as an observation. Your scoring edge is precise requirement linkage plus severity logic — conformity when earned, minor when isolated, major when systemic or critically undermining, observation only when requirements are still met.