11.3 Drafting Auditable Nonconformity Reports (NCRs)

11.3 Drafting Auditable Nonconformity Reports (NCRs)

Lead Auditor Core Concept: The Nonconformity Report (NCR) is the ultimate tangible deliverable of an audit team. Under ISO 19011:2018 Clause 6.4.8, nonconformities must be recorded clearly, concisely, and unequivocally. A poorly drafted NCR creates organizational confusion, leads to misdirected root cause analysis, invites contentious appeals, and undermines the credibility of the certification body. A master lead auditor drafts NCRs that are factually unassailable, legally defensible, and completely self-contained.

---

1. The Criticality of Professional NCR Drafting

A Nonconformity Report is a formal technical and legal document. It is scrutinized not only by the auditee's management, but also by certification body technical review committees, national accreditation bodies (e.g., ANAB, UKAS, DAkkS), regulatory authorities, and potentially civil or criminal courts following catastrophic industrial workplace fatalities.

If an NCR is vaguely worded, auditee leadership will waste valuable time and capital addressing superficial symptoms rather than systemic root causes. Conversely, when an NCR is drafted with clinical precision, the auditee can immediately pinpoint the breakdown in the PDCA cycle, identify systemic vulnerabilities, and implement lasting corrective actions.

---

2. The Three-Part Anatomy of an Auditable Nonconformity Report

Every professional Nonconformity Report must be constructed upon three mandatory structural pillars. If any pillar is omitted or poorly constructed, the entire finding collapses.

                      ┌──────────────────────────────────────────────┐
                      │       THE THREE PILLARS OF AN AUDITABLE      │
                      │          NONCONFORMITY REPORT (NCR)          │
                      └──────────────────────┬───────────────────────┘
                                             │
             ┌───────────────────────────────┼───────────────────────────────┐
             ▼                               ▼                               ▼
┌─────────────────────────┐     ┌─────────────────────────┐     ┌─────────────────────────┐
│        PILLAR I         │     │        PILLAR II        │     │       PILLAR III        │
│      STATEMENT OF       │     │     EXACT STANDARD      │     │   OBJECTIVE EVIDENCE    │
│     NONCONFORMITY       │     │       REQUIREMENT       │     │                         │
│ What went wrong with    │     │ What normative criteria │     │ What factual, verifiable│
│ the management system?  │     │ was violated?           │     │ proof was observed?     │
│ Depersonalized, systemic│     │ Exact clause, title,    │     │ Who, what, where, when, │
│ breakdown statement.    │     │ and normative 'shall'.  │     │ equipment IDs, samples. │
└─────────────────────────┘     └─────────────────────────┘     └─────────────────────────┘

Pillar I: The Statement of Nonconformity (The System Breakdown)

• Core Definition: A clear, concise, and complete statement describing the non-fulfillment of a specified requirement.
• Systemic Focus: The statement must address the breakdown in the management system, not the personal error of an individual worker.
• Grammatical Formula: A professional Statement of Nonconformity follows a proven grammatical architecture:

  "The organization's [Process / System Mechanism] has not been [established / implemented / maintained] to ensure that [Intended Result / Control Objective]..."

• Example: "The organization's operational planning and control process has not been implemented to ensure that hazardous energy control (lockout/tagout) procedures are applied prior to maintenance activities on production machinery."

Pillar II: The Exact Standard Requirement (The Audit Criteria)

• Core Definition: The specific normative benchmark against which the finding is evaluated.
• Precision Mandate: The lead auditor must cite the exact standard publication, clause number, sub-clause letter, and clause title:

  "ISO 45001:2018, Clause 8.1.2 (Eliminating hazards and reducing OH&S risks), sub-clause (c), which states: 'The organization shall establish, implement and maintain a process(es) for the elimination of hazards and reduction of OH&S risks using the following hierarchy of controls: ... c) use engineering controls and reorganization of work...'"

• Auditing Internal Procedures: If the finding breaches the organization's own documented operating rule, cite both the internal procedure and the overarching ISO standard requirement:

  "Standard Operating Procedure SOP-MN-004 (LOTO Safety), Rev 3, Section 4.2, in conjunction with ISO 45001:2018 Clause 8.1.1 (Operational planning and control)."

Pillar III: The Objective Evidence (The Factual Proof)

• Core Definition: Qualitative or quantitative information, records, or statements of fact pertaining to the safety criteria, which are verifiable.
• The "Five-Year Test": A properly drafted objective evidence block must be so specific that an independent auditor reading the report five years later could walk into the facility and locate the exact machine, document, shift, and location evaluated without asking anyone for clarification.
• Essential Specifics Required:
  • What: Exact physical condition, component, or parameter observed.
  • Where: Exact facility location, plant number, production line, or bay.
  • When: Exact date, time, and operating shift.
  • Identifiers: Equipment serial numbers, permit numbers, calibration certificate IDs, and document revision dates.
  • Sample Ratios: Exact quantitative sample size (e.g., "In 4 out of 12 hot work permits sampled..." rather than "some permits were missing signatures").
  • Depersonalized Roles: Job roles or functional titles (e.g., "Maintenance Technician," "Shift Supervisor")—never personal employee names.

---

3. Professional NCR Writing Rules

Adhering to strict drafting rules separates elite lead auditors from amateurs:

Rule 1: Eliminate Ambiguity and Subjective Language

Vague qualifiers destroy the audibility of an NCR. Auditors must never use imprecise language:

• Banned Words: Some, many, several, a few, often, frequently, occasionally, poor, inadequate, careless, dirty, bad.
• Replacement: Use exact quantitative counts and verifiable thresholds (e.g., replace "Several fire doors were blocked" with "In Warehouse 3, 3 of the 8 emergency exit fire doors (Doors #E-3, #E-4, and #E-7) were obstructed by wooden pallets stacked 2.5 meters high").

Rule 2: Depersonalize the Finding (Protection of Workers)

Under ISO 45001 Clause 5.1(k) and Clause 5.4, the management system must protect workers from reprisals when reporting incidents, hazards, and risks. An audit evaluates the system, not individual blame.

• Never include personal names: Writing "John Doe failed to wear safety glasses" turns the audit into a disciplinary weapon and causes workers to hide hazards.
• Focus on the system breakdown: "On Line 2, two extrusion operators were observed packing finished goods without mandatory eye protection, and supervisory oversight failed to enforce PPE requirements specified in Hazard Assessment HRA-2025-09."

Rule 3: The Strict "No-Consultancy" Rule (Do Not Advise)

An NCR must identify what is wrong, never how to fix it. Prescribing solutions violates ISO/IEC 17021-1 impartiality rules.

• Incorrect (Consulting): "The company must install an automated interlock sensor on Machine #4 to prevent operators from opening the cage while energized."
• Correct (Audit Finding): "The operational controls established for Machine #4 fail to prevent access to energized rotating cutter heads while in operation."

Rule 4: Self-Containment

The NCR must be 100% self-contained. Any stakeholder reading the document must understand the finding without needing an oral explanation from the auditor.

---

4. Before-and-After Analysis: Flawed vs. Auditable NCRs

---

5. Reviewing and Agreeing Findings with the Auditee (ISO 19011 Clauses 6.4.8 & 6.4.9)

Audit findings must not be unveiled as dramatic surprises during the formal closing meeting. ISO 19011 Clause 6.4.8 establishes a formal protocol for reviewing draft findings with auditee leadership prior to the closing meeting:

The Pre-Closing Meeting Protocol

Prior to the closing meeting, the Audit Team Leader convenes an informal briefing with the auditee's designated management representative and safety directors to:

1. Present Draft Findings: Review the statements of nonconformity, standard clauses, and objective evidence.
2. Verify Factual Accuracy: Ensure the evidence is factually correct. The auditee must have the opportunity to confirm whether numbers, dates, equipment IDs, and observations are true, or provide immediate clarification if evidence was misinterpreted.
3. Clarify Misunderstandings: If an auditor mistakenly recorded that a calibration certificate was missing, and the auditee produces the valid certificate filed under a sister asset ID, the auditor investigates and withdraws the draft finding if fully satisfied.

Agreeing on Facts vs. Agreeing on Grading

• Agreement on Facts: The auditee is asked to acknowledge and agree on the factual evidence (e.g., "Yes, that emergency stop button was disconnected during the audit").
• Agreement on Grading: The auditee does not have the authority to negotiate or dictate the grading of a finding. While the lead auditor listens to management's context, the audit team retains ultimate authority for determining whether a nonconformity is Major or Minor.

Managing Divergent Opinions (ISO 19011 Clause 6.4.9)

If the auditee strongly disputes a finding or its classification (e.g., management insists an unventilated confined space entry should be an OFI rather than a Major NC):

1. The lead auditor explains the normative rationale and evidence base objectively.
2. If unresolved, the lead auditor does not argue or engage in emotional debate.
3. Under ISO 19011 Clause 6.4.9, the lead auditor must record the divergent opinion in the formal audit report, documenting both the audit team's finding and the auditee's dissenting position. The certification body's technical committee resolves formal appeals.

---

6. Real-World Audit Scenario: Drafting an Auditable NCR

Audit Context: During an initial ISO 45001 certification audit of an industrial coating facility, the lead auditor inspects the paint preparation kitchen where flammable solvents (xylene, MEK) are dispensed from 200-liter storage drums into pressure pots.

The Observed Evidence:

• On 2026-09-04 at 11:15 in Paint Kitchen #2, three dispensing drums (Drums #D-14, #D-15, #D-16) were actively discharging solvent into open stainless steel buckets.
• None of the three drums or receiving buckets were connected to static bonding or grounding clamps.
• An electrostatic potential measurement conducted by the accompanying facility maintenance technician indicated a 4,200-volt charge accumulation on Drum #D-15.
• Operating Procedure SOP-FLAM-03 (Static Hazard Control), Rev 4, Section 3.1 states: "All flammable liquid containers exceeding 20 liters must be bonded and grounded prior to dispensing."
• When interviewed, the dispensing operator (Job Role: Paint Mixer) stated: "The grounding cables broke last month, so we just pour carefully without them."

The Resulting Complete Auditable Nonconformity Report:

NONCONFORMITY REPORT (NCR #03)

Grading: MAJOR NONCONFORMITY

Pillar I: Statement of Nonconformity The organization's operational planning and control process has not been implemented to ensure that mandatory static grounding and bonding controls are applied during the transfer of flammable solvents, creating an uncontrolled explosion and fire hazard in operating areas.

Pillar II: Standard Requirement ISO 45001:2018, Clause 8.1.1 (Operational planning and control), which states: 'The organization shall plan, implement, control and maintain the processes needed to meet requirements of the OH&S management system, and to implement the actions determined in Clause 6, by: a) establishing operating criteria for the processes; b) implementing control of the processes in accordance with the operating criteria...' in conjunction with internal procedure SOP-FLAM-03 (Static Hazard Control), Rev 4, Section 3.1.

Pillar III: Objective Evidence On 2026-09-04 at 11:15 in Paint Kitchen #2, three 200-liter flammable solvent dispensing drums (Drums #D-14, #D-15, and #D-16 containing xylene and methyl ethyl ketone) were observed actively dispensing liquids into open metal containers without static bonding or grounding clamps attached. Electrostatic charge measurement on Drum #D-15 revealed a 4,200V potential. The Paint Mixer confirmed grounding cables had been broken and unmaintained for approximately four weeks, contrary to SOP-FLAM-03.

---

7. Common Exam Traps & Candidate Errors

• Trap 1: Naming Individual Workers in the Finding. Writing names of operators or supervisors in an NCR is a severe violation of ISO 45001 principles. It destroys worker trust and violates Clause 5.1(k). Always use job roles, badge numbers, or titles.
• Trap 2: Vague Quantifiers. Writing that "many records were missing" or "some equipment was uninspected." Any NCR lacking exact numbers, sample sizes, and equipment identifiers fails certification body quality audits.
• Trap 3: Blurring the Line Between Evidence and Statement. Placing the specific evidence inside the statement of nonconformity (e.g., "Nonconformity: Drum #D-14 was not grounded"). The Statement must describe the system failure; the Evidence details the specific instance.
• Trap 4: Concealing Findings Until the Closing Meeting. Presenting nonconformities for the first time in front of executive leadership during the formal closing meeting without prior review with the auditee violates ISO 19011 Clause 6.4.8.