How to Write Audit Findings That Stand Up to Challenge

Why Your Audit Findings Keep Getting Pushed Back

You have spent two days on site, reviewed dozens of records, interviewed six people, and identified three genuine nonconformities. You write them up, send the report, and within 24 hours the auditee is pushing back. They say the finding is vague, the clause reference is wrong, or the evidence does not actually prove what you claimed. Sound familiar?

Writing audit findings that stand up to challenge is one of the most underrated skills in auditing. Most training programmes teach you how to gather evidence and conduct interviews. Far fewer teach you how to translate that evidence into a written finding that is factually airtight, clearly referenced, and impossible to dismiss on a technicality. This article fixes that gap.

Whether you are writing findings for an internal audit, a second party supplier audit, or a formal certification audit, the principles are the same. A finding that cannot be challenged is a finding that is specific, evidenced, correctly referenced, and logically structured. Here is how to build one from the ground up.

Understanding What an Audit Finding Actually Is

Before you can write a strong finding, you need to be clear on what a finding actually represents. Under ISO 19011, audit findings are the results of evaluating collected audit evidence against audit criteria. That definition matters more than it sounds.

A finding is not your opinion. It is not a general impression of the department. It is the output of comparing objective evidence to a defined requirement. When you keep that definition front of mind, your writing becomes sharper immediately.

Findings fall into several categories. Nonconformities are the most significant, representing a failure to meet a requirement. Observations or opportunities for improvement note something that is not yet a nonconformity but warrants attention. Positive findings note where the organisation is performing well against the criteria. Each type has its place in a well-written audit report.

If you want a deeper look at how these categories work in practice, the article on classifying findings: NC, OFI and observation explained covers the distinctions in detail.

The Four Components Every Strong Finding Must Have

The fastest way to improve your finding writing is to ensure every finding contains four components. Miss any one of them and you create an opening for the auditee to challenge you.

1. The Requirement

State exactly what the standard, procedure, or other audit criterion requires. Quote the clause number and, where helpful, the specific requirement in plain language. Do not paraphrase loosely. If the requirement says the organisation shall retain documented information as evidence of competence, say that. Do not write the standard requires training records, because that is your interpretation, not the text.

Be precise about which document you are referencing. Is it ISO 9001 Clause 7.2? The organisation's own procedure QP-07? A regulatory requirement? Name it. A finding that references only a vague requirement is easy to dispute.

2. The Objective Evidence

This is where most findings fall apart. Objective evidence must be specific, verifiable, and factual. It is not what you thought you saw or what the auditee told you without corroboration. It is a document reference, a record number, a date, a name, an observation you can describe precisely.

Compare these two versions of the same evidence statement:

Weak: Several employees did not have current training records on file.

Strong: Training records for three of the five production operators interviewed (J. Smith, K. Patel, and M. Torres) could not be located during the audit on 14 June 2025. The training register (Form TRN-01, version 3) was reviewed and showed no entry for these individuals against the forklift competency assessment required by Procedure WHS-12.

The second version is specific enough that the auditee cannot simply say it did not happen. It names people, dates, documents, and the specific gap. That is what makes it stand up.

3. The Gap

Once you have stated the requirement and the evidence, you need to articulate the gap between them. What is missing? What was done that should not have been done? What was not done that should have been? The gap statement connects the evidence to the criterion and explains why this constitutes a finding.

Keep the gap statement factual, not judgmental. Avoid language like management clearly does not care about this or the system is completely broken. Those statements invite an argument about your attitude rather than the substance of the finding.

4. The Classification

Classify the finding correctly. A major nonconformity typically indicates a systematic failure or the complete absence of a required element. A minor nonconformity indicates an isolated or partial failure. Getting the classification wrong is one of the most common ways findings get disputed, particularly in certification audits where the classification affects the outcome.

If you are unsure how to grade nonconformities, the article on grading nonconformities under ISO 19011:2026 walks through the updated expectations in detail.

Structuring Your Finding: The Statement, Evidence, Clause Format

One of the most reliable structures for writing a nonconformity is the SEC format: Statement, Evidence, Clause. Some auditors call it different things, but the logic is the same. Start with a clear statement of what the nonconformity is, follow it with the evidence that supports it, and close with the clause or requirement that has not been met.

Here is an example using ISO 14001:

Statement: The organisation has not identified all significant environmental aspects associated with its maintenance activities.

Evidence: During a review of the Environmental Aspects and Impacts Register (EAI-Register-2025, last reviewed March 2024), the maintenance workshop was not listed as an activity. During a site inspection on 15 June 2025, the auditor observed lubricant storage and solvent use in the maintenance workshop. When interviewed, the Maintenance Supervisor confirmed these activities had not been included in the aspects assessment.

Clause: ISO 14001:2015 Clause 6.1.2 requires the organisation to determine the environmental aspects of its activities, products, and services that it can control or influence.

That finding is tight. The auditee can see exactly what was reviewed, what was observed, who was spoken to, and what requirement applies. There is no ambiguity to exploit.

Common Mistakes That Make Findings Vulnerable to Challenge

Vague Evidence References

Saying you reviewed training records without specifying which records, which version, and on what date gives the auditee room to say you looked at the wrong file. Always include document identifiers, version numbers, dates, and names where relevant.

Wrong Clause Reference

Citing the wrong clause is surprisingly common, particularly when auditors work across multiple standards. Double-check your clause references before finalising the report. A finding citing Clause 7.2 when the actual requirement sits in Clause 8.5.1 will be challenged immediately, and rightly so.

Mixing Evidence with Inference

There is a significant difference between what you observed and what you concluded from that observation. Your finding should contain evidence, not inference dressed up as evidence. If you write the organisation does not monitor its environmental performance, that is a conclusion. The evidence might be that no monitoring records were presented for the period January to June 2025 despite Clause 9.1.1 requiring monitoring at planned intervals. The article on evidence or inference: sharpening your judgement as an internal auditor explores this distinction in depth.

Editorialising

Phrases like the organisation clearly has no interest in compliance, the system is fundamentally broken, or management is failing in its duty do not belong in an audit finding. They are inflammatory, subjective, and they shift the conversation from the finding to your conduct as an auditor. Write factually. Let the evidence do the work.

Sampling Without Acknowledging It

If your finding is based on a sample, say so. Write that three of ten records reviewed showed no evidence of the required verification. Do not write the organisation does not verify records, because that is a sweeping claim your sample may not support. Honest, specific sampling language actually strengthens a finding because it shows methodological rigour.

Bundling Multiple Issues Into One Finding

If you find two separate nonconformities against two separate clauses, write two separate findings. Bundling them together creates confusion about what the corrective action needs to address and makes it easier for the auditee to argue that one of the issues does not actually apply.

Writing Findings for Different Audiences

A finding written for a certification body auditor is read differently to one written for a quality manager who will use it to drive internal improvement. Think about who will read your report and adjust your language accordingly, without compromising precision.

Internal Audit Findings

Internal findings can be slightly less formal in tone, but they must still be specific and evidenced. The risk with internal audits is that familiarity breeds vagueness. You know the team, you know the system, and you might be tempted to write shorthand findings that make sense to you but confuse anyone else who reads the report. Write as if someone outside the organisation will need to understand and act on the finding without asking you for clarification.

Second Party Audit Findings

Supplier audit findings need to be especially clear because the auditee is an external party who may push back commercially as well as technically. Be precise, stay professional, and make sure every finding is traceable to the audit criteria agreed at the start of the engagement. Vague findings in supplier audits can create contractual disputes, not just audit debates.

Certification Audit Findings

Certification body auditors write findings that will be reviewed by technical reviewers, accreditation bodies, and potentially the client's legal team if a certification decision is disputed. Every word needs to be defensible. Follow the format your certification body requires, reference the correct version of the standard, and ensure your evidence is documented in your audit notes before you write the finding.

How to Handle Pushback on a Finding

Even a well-written finding will sometimes be challenged. Here is how to handle it professionally.

First, listen to the challenge without becoming defensive. The auditee may have additional evidence you were not shown during the audit. If that evidence genuinely addresses the finding, you may need to revise or withdraw it. That is not weakness. That is integrity.

Second, if the challenge is about interpretation rather than evidence, refer back to the standard text and your documented evidence. Do not argue. Say something like: the finding is based on the requirement in Clause X and the evidence gathered during the audit. If you have additional records that address this, please share them and I will review them.

Third, if the challenge is simply that the auditee does not like the finding, hold your position calmly. A finding is not a negotiation. It is a factual statement about conformance or nonconformance based on evidence. If your evidence is solid and your clause reference is correct, the finding stands.

Practical Tips for Writing Findings in the Field

Good finding writing starts during the audit, not after it. Here are some habits that make the writing stage much easier.

• Take detailed notes in real time. Record document names, version numbers, dates, and the names of people you spoke to. You cannot reconstruct specific details from memory hours later.
• Flag potential findings as you go. When you observe something that may be a nonconformity, make a note immediately. Do not rely on remembering it at the end of the day.
• Verify before you write. Before you finalise a finding, confirm that you have the evidence to support it. If you are not sure, go back and check during the audit rather than writing a finding you cannot fully support.
• Draft findings before the closing meeting. Your findings should be drafted, not improvised, when you present them. This forces you to think through the structure before you are under time pressure.
• Read each finding out loud. If it sounds vague or confusing when you say it, it will read that way too. Rewrite until it is clear and specific.

Strong audit note taking is the foundation of strong finding writing. The article on audit note taking: capture evidence without killing the conversation has practical advice on building this habit.

Linking Findings to Corrective Action

A well-written finding makes corrective action easier to scope. When the evidence is specific and the requirement is clearly stated, the auditee knows exactly what they need to address. Vague findings produce vague corrective actions, which then fail verification at the follow-up audit.

If you want the corrective action process to work, write your findings with that outcome in mind. Ask yourself: if I received this finding, would I know what to fix? If the answer is no, rewrite the finding until the answer is yes.

Build This Skill Through Practice and Training

Writing strong audit findings is a skill that develops with practice and good coaching. If you are working through your first internal audits, expect your early findings to need refinement. That is normal. The key is to build the habit of specificity early, before vague writing becomes a default.

If you want structured practice in finding writing alongside the full audit methodology, Audit Workshop's Internal Auditor and Lead Auditor courses include practical exercises in writing and reviewing findings across ISO 9001, ISO 14001, ISO 45001, ISO 27001, and other standards. The training is delivered by auditors who have written hundreds of real findings across certification audits, so the feedback you get is grounded in what actually works in the field. You can explore the available courses at auditworkshop.com.