Section 5.4: Generating Audit Findings and Evaluating Evidence
Key Takeaways
- Audit findings compare objective evidence against criteria to identify conformity or nonconformity.
- Major nonconformities represent systemic failures or product/service risks, halting certification.
- Minor nonconformities are isolated compliance lapses that do not compromise the overall QMS.
- A defensible nonconformity statement must follow a three-part structure: Requirement, Evidence, and Mismatch.
Section 5.4: Generating Audit Findings and Evaluating Evidence
Evaluation of Evidence Against Audit Criteria
Collected audit evidence must be evaluated against audit criteria to determine findings. Criteria represent the standard of comparison and include the clauses of ISO 9001:2015, internal procedures, customer contract requirements, and statutory or regulatory rules.
According to ISO 19011:2018 Clause 6.4.8, findings indicate conformity or nonconformity. Conformity is established when evidence matches criteria; a nonconformity (NC) exists when there is a gap. Evaluating evidence requires objectivity, free from personal bias, and focused strictly on verifiable facts.
Grading Audit Findings
For certification audits, findings are graded to support the recommendation regarding the organization's ISO 9001:2015 certificate. The classifications are:
Major Nonconformity
A Major Nonconformity is a significant breakdown in the quality management system. It is defined as:
- The total breakdown or absence of a process or clause of the standard (e.g., no internal audits).
- A group of minor nonconformities indicating a systemic failure in a specific area (e.g., multiple minor NCs in calibration).
- A nonconformity that directly threatens product or service integrity, risking shipment of nonconforming goods.
- A severe breach of statutory or regulatory compliance. Certification Impact: A Major Nonconformity prevents the certification body from issuing or renewing a certificate. The organization must implement corrective actions, and the auditor must physically verify their effectiveness (often through a follow-up onsite audit) before the certificate can be recommended.
Minor Nonconformity
A Minor Nonconformity is an isolated lapse in compliance that does not compromise the QMS's overall integrity or product quality (e.g., one operator failing to follow a work instruction). Certification Impact: These do not prevent certification. The organization must submit a corrective action plan (CAP) showing the root cause and proposed actions. Corrective actions are verified during the next surveillance audit.
Opportunity for Improvement (OFI)
An OFI is a finding where the organization is in compliance with the standard, but the auditor identifies a potential weakness or an opportunity to optimize a process. The organization is under no obligation to take corrective action on an OFI, but they should review it during management reviews.
The Three-Part Nonconformity Statement
Writing a clear, defensible Nonconformity Report (NCR) is a critical lead auditor skill. Poorly written NCRs lead to confusion, disputes, and ineffective actions. To ensure clarity, every NCR should be structured as a three-part statement:
- The Requirement: The specific source of the criteria that has been violated. This must reference the exact ISO 9001:2015 clause, internal procedure name, or contract clause.
- The Evidence: The objective facts observed or reviewed during the audit. This must be traceable, citing specific sample sizes, document names, dates, serial numbers, or job titles. It should never use vague language like "some files" or "many operators."
- The Mismatch (Nature of Finding): A clear statement explaining exactly how the evidence failed to meet the requirement.
Practical Scenario: Auditing Calibration (Clause 7.1.5)
An auditor is evaluating monitoring and measuring resources (Clause 7.1.5) in the assembly area.
- Evidence: Out of 15 digital calipers sampled, three (Serial Numbers C-102, C-104, C-115) had calibration stickers expired by three months. No records existed of impact assessment on product quality since expiration.
- Requirement: ISO 9001:2015 Clause 7.1.5.2 requires measuring equipment to be calibrated at specified intervals, and organizations to assess the validity of previous measurements if equipment is unfit.
Draft Comparison: Poor vs. Professional NCR
- Poorly Written NCR: "Calipers in the assembly area are not calibrated. This violates Clause 7.1.5 because the organization is not controlling its measuring tools properly. Operators are using expired tools."
- Professionally Written NCR (Three-Part Structure):
- Requirement: ISO 9001:2015 Clause 7.1.5.2 and Quality Procedure QP-12 (Calibration Control, Rev. 3, Section 4.2) require that all measuring equipment used for product verification be calibrated at defined 12-month intervals and that previous measurement results be evaluated if equipment is found out of calibration.
- Evidence: During the audit of the assembly line on July 20, 2026, three digital calipers out of fifteen sampled (Model Mitutoyo, Serial Numbers C-102, C-104, and C-115) were observed in active use with calibration expiry dates of April 15, 2026. No records of impact assessment for parts verified with these calipers were available.
- Mismatch: The organization failed to ensure that these measuring instruments were calibrated at the specified interval and did not evaluate the validity of previous measurements taken with the expired equipment.
Comparison Table of Finding Types
The table below contrasts the characteristics and outcomes of the three finding categories:
| Parameter | Major Nonconformity | Minor Nonconformity | Opportunity for Improvement |
|---|---|---|---|
| Severity | High (Systemic breakdown or quality risk). | Low (Isolated lapse, no immediate quality risk). | N/A (Compliant, but could be optimized). |
| Root Cause Required? | Yes, mandatory. | Yes, mandatory. | No. |
| Certification Impact | Certificate held/denied until verified. | Certificate recommended; verified at next audit. | No impact on certification. |
| Verification Method | Onsite follow-up audit or extensive documentation review. | Desk review of corrective action plan. | Reviewed at the next audit to see if actions were taken. |
An auditor finds that a company has not conducted any internal quality audits (ISO 9001:2015 Clause 9.2) during the past 12 months, despite their procedure requiring them semi-annually. How should this finding be graded in a certification audit?
An auditor is writing a nonconformity report. Which of the following represents the most complete and professional 'Evidence' statement in the three-part NCR structure?
Which of the following findings would be classified as a Minor Nonconformity rather than a Major Nonconformity?