Section 6.1: Documenting Nonconformities and Audit Findings (Major vs. Minor, OFIs)

Section 6.1: Documenting Nonconformities and Audit Findings

In an ISO 9001:2015 audit, the collection and evaluation of audit evidence culminate in the generation of audit findings. According to ISO 19011:2018, audit findings are the results of the evaluation of the collected audit evidence against audit criteria. These findings can indicate either conformity or nonconformity with the audit criteria. A lead auditor must possess the clinical precision required to classify, document, and report these findings. Accurate documentation ensures that the auditee receives clear, actionable feedback to drive corrective actions, and provides the certification body (CB) with a solid evidentiary basis for registration decisions.

Understanding and Categorizing Findings

Under the guidelines of ISO 19011:2018 and the requirements of ISO/IEC 17021-1 (which governs certification bodies), audit findings must be clearly categorized. The primary categories used during a QMS audit are:

1. Conformity: The fulfillment of a requirement. When audit evidence demonstrates that a process complies with ISO 9001 requirements and the organization's own documented procedures, it is documented as a conformity.
2. Nonconformity (NC): The non-fulfillment of a requirement. This represents a gap between what the standard or the QMS requires and what the organization actually does.
3. Opportunity for Improvement (OFI): A finding that identifies a potential area for optimization. While the current process is compliant, the auditor identifies a risk or inefficiency that could lead to a future nonconformity or sub-optimal performance.

Major vs. Minor Nonconformities

Nonconformities are graded based on their severity and their impact on the integrity of the Quality Management System.

Major Nonconformity

A major nonconformity is defined as the absence of, or a systemic failure to implement, a required clause of the ISO 9001:2015 standard, or a situation that would call into question the effectiveness of the QMS to control processes and assure the conformity of products or services. Specifically, a finding is classified as major if:

• There is a total breakdown of a process or system (e.g., no internal audits have been conducted, or there is a complete failure of the design and development controls under Clause 8.3).
• Multiple minor nonconformities are found within the same clause or process, indicating a systemic failure (e.g., five separate instances of uncontrolled documents across different departments, showing Clause 7.5 is not controlled).
• A nonconformity directly results in, or has a high probability of resulting in, the release of nonconforming product or services to the customer (compromising Clause 8.6 or 8.7).
• The organization has failed to address a previously identified minor nonconformity within the agreed timeframe, showing a failure in the corrective action process itself (Clause 10.2).

Minor Nonconformity

A minor nonconformity is an isolated lapse, slip, or single error that does not compromise the overall integrity of the QMS or the ability of the organization to deliver conforming products and services. It is typically characterized by:

• A single, isolated failure to follow a documented procedure (e.g., one employee out of twenty interviewed was not aware of the quality policy).
• An inconsistency in record-keeping that does not affect process traceability or product quality.
• A minor oversight in calibration schedules where the instrument was immediately verified and found to be in tolerance (Clause 7.1.5).

Opportunities for Improvement (OFIs)

An OFI is not a nonconformity. It is a value-added observation. However, lead auditors must tread carefully here. Under ISO/IEC 17021-1, certification body auditors are strictly prohibited from providing consultancy. An OFI must state a fact and a potential benefit, but it must never suggest a specific solution.

• Incorrect (Consultancy): "The organization should use XYZ software to automate their training matrix."
• Correct (OFI): "While the manual spreadsheet used for tracking employee training is currently compliant, the growing headcount may introduce data entry risks. Automating this tracking could improve efficiency and reduce the likelihood of scheduling errors."

---

Writing the Nonconformity Report (NCR)

A poorly written nonconformity leads to confusion, resistance from the auditee, and ineffective corrective actions. To write a robust, indisputable nonconformity report, auditors use the PLOC formula:

• Problem (Statement of Nonconformity): A clear, concise sentence describing the failure. It must state what went wrong without using vague language like "poor," "inadequate," or "bad."
• Location: The specific department, line, site, or process where the failure occurred.
• Objective Evidence: The specific, verifiable facts observed during the audit (document numbers, serial numbers, names of roles, dates, or specific quotes).
• Criteria (Requirement): The exact source of the requirement that was violated. This includes the specific clause of ISO 9001:2015 and the section of the organization's internal procedures.

The Statement of Nonconformity: Best Practices

When drafting the statement of nonconformity, always ensure it is:

1. Objective: State only what was found, not your opinion or speculation about why it happened.
2. Clear: Use the organization's own terminology where possible.
3. Traceable: Provide enough detail that another auditor could easily find the exact same record six months later.
4. Focused on System failures: Write the finding in a way that points to a process failure rather than blaming a specific individual. Do not include names of personnel; instead, refer to job titles (e.g., "the Assembly Operator" or "the Quality Director").

---

Audit Finding Consensus and Calibration

Before presenting findings to the auditee, the audit team must meet in a private session to review all notes and agree on the categorization of each finding. This is called "calibration." During calibration, the team reviews the gathered evidence to ensure:

• The findings are supported by objective evidence.
• The grading (Major vs. Minor) is consistent and fair.
• The correct clauses have been cited. If a finding could fit under multiple clauses, the team must determine which clause is the most direct fit (e.g., training records failure belongs under Clause 7.2 Competence, rather than 7.5 Documented Information).

If there is any doubt or lack of objective evidence for a suspected nonconformity, the auditor must not document it as an NC. The benefit of the doubt always goes to the auditee, though the auditor may flag the area for future investigation or note it as an OFI if appropriate.