Most auditors finish an audit, write up their observations, and move on. The report gets filed. Management glances at it. Nothing changes. Six months later, the same issues reappear, and auditors wonder why their findings never stick. The problem is not that the issues were missed. The problem is that the observations were documented in a way that did not compel action or clarify what actually needed to change.
On this page
Good audit documentation is not about ticking boxes or protecting yourself legally, though both matter. It is about creating a record that forces the organisation to think differently, that makes the root cause obvious, and that makes the corrective action unmistakable. This is the difference between an observation that drives improvement and one that gets ignored.
Why Most Audit Observations Fail to Drive Improvement
Audit observations get lost in translation. An auditor identifies a genuine issue during fieldwork, documents it in their working papers, then translates it into formal language for the audit report. Somewhere in that process, the observation becomes generic, vague, or so wrapped in technical language that it loses its grip on the reader's attention and action.
Consider a common example. An auditor visits a warehouse and notices that product quality checks are supposed to happen before despatch but are happening after. The auditor writes: "Observed that quality assurance activities were not performed in accordance with documented procedures during the despatch process." That sentence is technically accurate. It identifies a nonconformity against the procedure. But it tells management almost nothing about why this matters, how serious it is, or what they need to fix.
Contrast that with: "On 14 March, 47 units of product were released to customers without completion of the final quality check required by SOP 04 03. The check is designed to catch defects before shipment. Products released without this check on 14 March were subsequently returned by three customers with quality failures that the check would have detected. This resulted in courier costs of $2,100 and reputational impact." Now management understands the consequence. They can see the pattern. They know what needs to change.
The difference is specificity. The first observation describes what happened in abstract terms. The second describes what happened with dates, quantities, and business impact. One is easy to dismiss. The other demands a response.
The Anatomy of an Observation That Drives Improvement
Every audit observation should contain five core components, regardless of whether it is a major nonconformity, minor finding, or observation for improvement. When all five are present and clearly documented, the observation becomes difficult to ignore and easy to act on.
The Specific Fact
Start with what you actually saw or verified. Not what should have happened. What did happen. Use dates, times, locations, and quantities. Name the person interviewed if relevant. Reference the specific document reviewed. If you inspected a warehouse and found five pallets stacked incorrectly, say so. If you reviewed training records and found that three employees had no evidence of completion for the mandatory annual refresher, state that explicitly.
The specificity matters because it cannot be argued with. "I observed that controls were not working" is arguable. "During my audit on 16 March, I observed that the daily reconciliation for the cash register had not been completed on 13 March, 14 March, or 15 March" is a fact that can be verified and cannot be dismissed as interpretation.
Many auditors soften their language to avoid conflict. They write "It appeared that" or "There was evidence suggesting that" when they should write "I observed that." If you are uncertain, clarify with the auditee during the audit until you are certain. Then document what you actually verified.
The Requirement
State clearly what the standard, procedure, or regulation required. Quote the relevant clause or section if it helps. Be precise about which document set the expectation. If the issue relates to ISO 9001, state the clause number. If it relates to an internal procedure, name the procedure and version. If it relates to a legal requirement, cite the relevant regulation.
This is not a place for assumption. If you think the organisation should have done something but have not verified it is required, stop. Go back and confirm the requirement during the audit. An observation that attributes a requirement to a document the organisation does not actually follow is weak and will be challenged.
Do not confuse what is best practice with what is required. Your role is to verify conformance to stated requirements, not to impose your view of how the organisation ought to operate. If the requirement is not clear, say so in the observation and flag it as something needing clarification in management review.
The Gap or Evidence
Describe clearly where reality diverged from requirement. This is where you explain what you found that showed the requirement was not being met. Be factual and neutral. Avoid loaded language. Do not say "They ignored the procedure." Say "The procedure requires a daily reconciliation. Reconciliations for the dates sampled were not completed."
This section should make the nonconformity or observation obvious to someone who was not present at the audit. A third party reading only this section should be able to understand what the gap is. If they cannot, you have not explained it clearly enough.
Include the sample size or scope here. If you audited one transaction and found an error, that is different from auditing fifty transactions and finding errors in ten. If you observed the process once and saw a deviation, that is different from observing it daily for a week and seeing the deviation every time. Be transparent about how extensive your sample was.
The Root Cause or Contributory Factors
This is where many auditors fall short. They stop at describing the gap and do not dig into why the gap exists. A good observation explores the factors that contributed to the nonconformity or issue. Did the procedure not exist? Did it exist but the team did not know about it? Did they know about it but lacked the resources or tools to follow it? Did they understand it differently than intended?
Root cause analysis is not always possible during an audit. You may need to state that the root cause requires further investigation by management. That is acceptable. But if you can identify contributing factors during your audit work, include them. This helps management understand whether the issue is a one off mistake or a systemic problem.
Sometimes the root cause is obvious. If you review training records and find that new starters received no induction, the root cause is likely that no induction process was defined or resourced. Sometimes it is more complex. If you find that procedures are not being followed, you might discover that the procedure is outdated, was changed without formal notification, or requires tools that are no longer available.
Ask "Why?" during your fieldwork. When you find a gap, ask the person involved why it happened. Their answer often reveals the root cause. "Why was the reconciliation not completed?" "Because the system crashed and we were told to wait for IT to fix it before doing anything." Now you have a root cause that shapes the corrective action. The issue is not a broken process but a dependency on IT support that was not available.
The Business Impact or Risk
Explain why this observation matters to the organisation. What could go wrong if this pattern continued? What actually did go wrong if this has happened before? What does this mean for customers, compliance, or business objectives?
This is often the component that converts an observation from "noted" to "acted upon." When management understands the real consequence, they prioritise the corrective action. If you document an observation about a process deviation but do not explain why it matters, management may reasonably deprioritise it against other work.
The business impact might be customer facing. "This deviation in the despatch process resulted in three customer complaints and two returns." It might be compliance related. "This gap in record keeping means the organisation cannot demonstrate compliance with the retention requirements of the Privacy Act." It might be operational. "The lack of documented procedures for this process means that when the subject matter expert is absent, the process does not run."
Quantify impact where possible. Avoid overstatement. If you do not know the impact, say so. "The consequence of this deviation is unclear and should be evaluated by management" is honest. Better to be conservative than to speculate and lose credibility.
Classifying Observations Correctly
Before you document an observation, you need to classify it correctly. Is it a major nonconformity, minor nonconformity, or observation? The classification shapes how you document it and how management will respond. Understanding the difference between audit findings, observations, and nonconformities is essential for clear documentation.
A major nonconformity is a failure to meet a requirement of the standard or a procedure that has, or could have, a significant impact on the effectiveness of the management system or the conformance to the standard. It is something that puts the certification at risk. If the auditor found evidence that the organisation does not have a quality management system because a major clause of ISO 9001 is not being implemented, that is a major nonconformity.
A minor nonconformity is a failure to meet a requirement but one that does not significantly undermine the management system or conformance to the standard. It is isolated, or it affects a limited area, or the impact is low. If the auditor found that one person did not complete their annual training but the training system is in place and working for everyone else, that might be a minor nonconformity.
An observation is not a nonconformity. It is something the auditor noticed that could be improved but which does not constitute a failure to meet a documented requirement. It might be a best practice suggestion, an inconsistency in how different departments implement the same procedure, or a potential risk that the organisation may wish to address. Observations are often the most valuable part of an audit because they open conversations about how the system could work better.
When documenting, be clear about which category each item falls into. Do not call something a nonconformity if it is actually an observation. Conversely, do not downgrade a genuine nonconformity to an observation just to avoid difficult conversations. Writing nonconformance reports that actually drive change requires honesty about severity.
Documentation Methods That Work
How you document observations affects whether they drive improvement. The method depends on your audit context, but certain approaches have proven more effective than others.
Working Papers and Field Notes
During the audit, record observations in working papers as you go. Do not rely on memory. Write down the specific fact, the requirement, the gap, and any relevant quotes or context immediately. Include the date, time, location, and person interviewed. Later, when you sit down to write the formal observation, you will have all the detail you need. Without it, you will either over generalise or forget important specifics.
Use a consistent format in your working papers. This might be a template or simply a disciplined structure. For each area audited, document what you reviewed, what you verified, what you found, and what questions remain. This creates an audit trail that you can reference weeks later when writing the report or when management asks for evidence of your findings.
Evidence Registers
Maintain a register that links each observation to the evidence that supports it. This might be a simple spreadsheet with columns for observation, supporting document or interview, date verified, and evidence location. When you document an observation, reference the evidence register. This helps you stay organised and gives management a clear path to the evidence if they want to verify your finding.
An evidence register also protects you. If management challenges an observation, you can immediately produce the supporting evidence. This is particularly important if you are auditing as an internal auditor or as a consultant. A strong evidence trail demonstrates professional rigour.
The Formal Audit Report
The audit report is where observations are formally documented for the organisation. The report needs to be clear, complete, and structured in a way that drives action. Use a consistent format for each observation. Include the five components outlined earlier: the specific fact, the requirement, the gap, the root cause or contributory factors, and the business impact or risk.
Number observations sequentially and reference them consistently. If an observation is discussed during the closing meeting, it should be possible to refer to it by number in the report. If management needs to track it during the corrective action process, that number should remain stable.
Use headings and white space to make the report scannable. Management may not read every word. They need to be able to quickly understand what each observation is about and why it matters. A dense block of text is less likely to be acted on than a clearly structured observation with headings and short paragraphs.
Common Documentation Mistakes to Avoid
Several patterns undermine the effectiveness of audit observations. Being aware of them helps you avoid them.
First, avoid vague language. "There were issues with the process" tells the reader nothing. "The process did not produce the required output on four of the six occasions sampled" tells them exactly what you found. Vague language often stems from uncertainty. If you are unsure about what you observed, clarify during the audit rather than documenting in vague terms.
Second, do not confuse observations with accusations. An observation documents facts. It does not blame individuals or imply negligence. "The warehouse manager failed to implement the stacking procedure" is accusatory and will trigger defensiveness. "The products were stacked in a way that does not conform to the stacking procedure specified in SOP 12" documents the fact neutrally and points to the procedure that needs to be followed. The corrective action can address whether this is a training issue, a procedure issue, or a resource issue.
Third, do not make observations about things you have not verified. If you suspect something is wrong but have not confirmed it, either verify it during the audit or note it as something requiring further investigation. Do not document suspicions as findings.
Fourth, avoid making observations that are too broad. "The quality management system is not operating effectively" is not a useful observation. It is so broad that it does not guide corrective action. Instead, document specific observations about areas where the system is not working and explain what is not working about each. This gives management something concrete to address.
Fifth, do not document observations in a way that makes them feel like personal criticism. Your role is to identify gaps between requirements and reality, not to pass judgment on people. Understanding what a lead auditor actually does day to day includes maintaining professional neutrality when documenting observations.
Using Observations to Drive Systemic Improvement
Documentation is only the first step. For observations to drive improvement, they need to be acted on. This requires engagement with management and clarity about what corrective action is expected.
During the closing meeting, walk through each observation with management. Explain what you found, why it matters, and what the likely root cause is. Give them space to provide context you may have missed. Sometimes what looks like a gap from an audit perspective is actually a deliberate choice or a temporary measure. Understanding management's perspective helps you refine the observation if needed.
For nonconformities, be clear about what conformance would look like. What would have to be different for this observation to be closed? If you observed that training records were incomplete, conformance might be that all required training is documented, records are current, and a process is in place to ensure future training is recorded. State this expectation in your observation so management knows what they need to deliver.
For observations that are not nonconformities but are areas for improvement, be clear that you are offering a suggestion. "Observation: The organisation currently uses spreadsheets to track customer complaints. This works for the current volume but may become unwieldy as volume grows. Consider evaluating a dedicated complaints management system." This is different from documenting a nonconformity. Management can choose to act on it or not, but the observation is there for them to consider.
Follow up on corrective actions. Do not assume that documenting the observation is enough. Verify that the corrective action was actually implemented and that it actually fixed the problem. This closes the loop and demonstrates that audits are not just about identifying issues but about driving real improvement. Managing corrective actions after an ISO audit requires a practical approach that includes verification and validation.
Documentation Standards and Templates
Many organisations use templates or standard formats for documenting observations. Templates can be helpful but can also lead to checklist thinking where auditors fill in blanks rather than genuinely thinking through what they found. If you use a template, use it as a discipline tool, not as a substitute for clear thinking.
A good template includes fields for: observation number, area audited, requirement referenced, finding or observation description, supporting evidence, root cause or contributory factors, business impact or risk, classification (major nonconformity, minor nonconformity, observation), and management response area. These fields prompt you to think through all aspects of the observation rather than just the finding itself.
Do not let the template constrain your thinking. If an observation needs more explanation than the template allows, provide it. If evidence needs to be attached, attach it. The template is a guide, not a straitjacket.
Digital Tools for Observation Documentation
Many organisations now use digital audit tools to document observations in real time. These tools can improve consistency and make it easier to track observations across multiple audits. They can also create problems if they are too rigid or if they replace professional judgment with automated workflows.
A good digital tool allows you to record observations with full context. It should allow you to attach evidence, reference requirements, and include photographs if relevant. It should generate reports that are easy to read and professionally presented. It should make it simple to classify observations and assign responsibility for corrective actions.
The tool should not force you to choose from a list of pre written observations. Audit observations need to be specific to what you actually found, not forced into a generic category.
The Role of the Auditor in Observation Documentation
The competence of the auditor directly affects the quality of documented observations. An auditor who does not understand the process being audited will miss important details. An auditor who does not have strong communication skills will struggle to explain what they found in a way that drives improvement. Becoming an ISO internal auditor includes developing the skills needed to document findings effectively.
Before you audit an area, understand what processes operate there and what the requirements are. During the audit, engage actively with the people in the area. Ask questions. Verify your understanding. Do not assume. When you find a gap, explore it with the auditee. What they tell you often reveals root causes that would not be obvious from documents alone.
After the audit, reflect on what you found and what it means. What patterns did you see? Were there common themes across multiple observations? Are there systemic issues or isolated incidents? This reflection improves the quality of your observations and helps you identify the most important things to focus on in your report.
Audit Workshop offers accredited ISO auditor training at Foundation, Internal Auditor, and Lead Auditor levels for ISO 9001, ISO 14001, and ISO 45001. Our courses are Exemplar Global recognised and include practical exercises, case studies, and assessment support.
