Understanding Audit Findings From the Ground Up
If you have ever sat through a closing meeting and wondered exactly what the auditor meant when they said they had a finding, you are not alone. The term gets used loosely, and that looseness causes real problems. Auditees argue with findings they do not understand. Corrective actions miss the point. Management reviews gloss over things that deserved attention. Getting clear on what audit findings actually are is not a pedantic exercise. It is the foundation of useful auditing.
On this page
This article explains what audit findings are, how they are classified, what distinguishes one type from another, and how they connect to the broader audit process. Whether you are preparing for your first internal audit, studying for a lead auditor course, or trying to improve the quality of your audit reports, this guide gives you the practical grounding you need.
The Definition of an Audit Finding
ISO 19011:2018 defines an audit finding as the result of evaluating the collected audit evidence against audit criteria. That is the formal version. In plain English, a finding is what you conclude after comparing what you observed against what the standard, procedure, or requirement says should be happening.
Three things feed into every finding. First, you need audit criteria. These are the requirements you are auditing against, whether that is a clause of ISO 9001, an internal procedure, a legal obligation, or a contractual requirement. Second, you need audit evidence. This is the objective information you gather through interviews, document review, and observation. Third, you need to evaluate the two against each other. That evaluation produces the finding.
It is worth being precise here. A finding is not simply something you noticed. It is a conclusion reached through evidence. If you walk past a messy storeroom and write it up as a finding without connecting it to a specific requirement and supporting evidence, that is not a proper finding. It is an opinion. Findings must be grounded in evidence, and the evidence must relate to a specific criterion. If you want to go deeper on this, the article on audit evidence explained covers the types of evidence and how to use them effectively.
Exemplar Global Certified Training ProviderRTP No. 310970
The Three Main Types of Audit Findings
In ISO auditing, findings generally fall into one of three categories. Different organisations and certification bodies use slightly different labels, but the underlying concepts are consistent across the industry.
Nonconformity
A nonconformity is a finding where a requirement has not been met. The requirement could come from the standard itself, from a documented procedure the organisation has established, or from a legal or contractual obligation that applies to the organisation.
Nonconformities are further divided into two grades: major and minor. A major nonconformity indicates a significant failure. It might mean a requirement has not been implemented at all, or that a system breakdown is likely to result in the delivery of nonconforming products or services, or that a serious safety or environmental breach has occurred. A major nonconformity from a certification body will typically put your certificate at risk until it is resolved.
A minor nonconformity is a single, isolated lapse. The system exists and generally functions, but there is a specific gap or failure in one instance. Think of a training record that is missing for one employee in an otherwise well managed competence process. The process works. One record is absent. That is a minor.
The distinction between major and minor is one of the most discussed and debated areas in auditing. The article on grading nonconformities goes into the grey zone in detail, including how experienced auditors make that call when the evidence sits on the boundary.
Observation or Opportunity for Improvement
An observation, sometimes called an opportunity for improvement or OFI, is a finding that does not constitute a nonconformity but where the auditor has identified a weakness, a risk, or a practice that could be improved. The requirement has technically been met, but something is worth flagging.
Observations are often misunderstood. Some auditors treat them as a soft way to raise things they are not confident enough to call a nonconformity. That is the wrong approach. A genuine observation is a considered professional judgement that the organisation is compliant but could benefit from looking at a particular area. It is not a consolation prize for a borderline finding.
Good observations add value. They draw attention to emerging risks, practices that work but are fragile, or areas where the organisation is meeting the minimum but missing an opportunity to improve. Poor observations are vague, unsupported, or simply a restatement of the requirement with no specific context.
Conformity
This one is often forgotten, but it matters. A conformity is a positive finding. It records that a requirement has been met and that the evidence supports that conclusion. Auditors who only record problems are missing part of the picture. Conformities give management a balanced view of system performance. They also acknowledge good practice and provide a baseline for future audits.
In practice, conformities are often recorded in the body of the audit report rather than as formal findings, but they should be documented. An audit that only reports problems is not giving the organisation a fair picture of how its system is performing.
How Findings Are Developed During an Audit
Findings do not appear fully formed. They develop progressively as you gather evidence throughout the audit. Here is how that typically works in practice.
Gathering Evidence First
You start with your audit criteria and your questions. You interview staff, review documents and records, and observe activities. As you do this, you are collecting evidence. Some of it will confirm that requirements are being met. Some of it will raise questions. Some of it will point clearly to a gap.
At this stage, resist the urge to form conclusions too quickly. A single piece of evidence that looks like a problem might be explained by something else you have not seen yet. Experienced auditors hold their judgement until they have enough evidence to be confident in a conclusion. The article on evidence versus inference in auditing is worth reading if you want to sharpen this skill.
Evaluating Evidence Against Criteria
Once you have gathered sufficient evidence, you evaluate it against the criteria. You are asking: does the evidence show that the requirement has been met, partially met, or not met at all? This is where your professional judgement comes in. You are not just checking boxes. You are forming a considered opinion based on what you have seen, heard, and reviewed.
If you find a gap, you need to be able to articulate it clearly. What is the requirement? What did you find? What is the specific evidence that supports your conclusion? These three elements are the core of any well written finding.
Recording the Finding
Once you have formed your conclusion, you record it. A well written finding states the requirement that applies, describes what was found, and references the specific evidence. It is factual, specific, and objective. It does not use emotive language. It does not speculate about intent. It does not make recommendations unless that is appropriate for the type of finding.
Vague findings cause arguments. If you write that
the training system is inadequatewithout specifying which requirement, which records, and which individuals were sampled, the auditee has nothing concrete to respond to. If you write that training records for three of the five operators in the production area could not be located for the competence requirements defined in procedure QP07, the auditee knows exactly what to address.
What Makes a Finding Credible and Defensible
Any auditor can write up a finding. Writing one that holds up to challenge is a different skill. Here is what separates credible findings from weak ones.
Specificity of Evidence
Name the documents you reviewed. Identify the records by reference number or date. Name the individuals you interviewed if appropriate and if it does not breach confidentiality. The more specific the evidence trail, the harder it is to dispute the finding.
Clear Connection to the Requirement
Every finding must tie back to a specific requirement. Quote the clause number. If the finding relates to an internal procedure, name the procedure and the relevant section. If it is a legal obligation, identify the legislation or regulation. The requirement is the anchor. Without it, the finding has no foundation.
Objectivity
Your findings reflect what the evidence shows, not what you think the organisation should be doing, not your personal preference for how a system should be designed, and not your frustration with the auditee. If you found it, it goes in. If you did not find it, it does not. Findings are not a vehicle for expressing opinions about management decisions or business strategy.
Proportionality
The severity of the finding should match the severity of the evidence. Calling something a major nonconformity when the evidence only supports a minor is disproportionate and will damage your credibility. Calling something an observation when the evidence clearly shows a systemic failure is equally problematic. Get the grade right.
Common Mistakes Auditors Make With Findings
After conducting hundreds of audits and reviewing audit reports from auditors at all levels, certain patterns of poor practice come up repeatedly.
Writing Findings That Are Too Vague
This is the most common mistake. Findings that say things like
records were not maintained as requiredwithout specifying which records, which requirement, and what was actually found are useless. The auditee cannot act on them, and management cannot understand the risk.
Combining Multiple Issues Into One Finding
Each finding should address one issue. If you have found problems in three different areas, write three findings. Combining them makes it difficult for the auditee to address each one properly and makes it hard to track closure.
Raising Findings Without Sufficient Evidence
If you cannot point to specific evidence that supports your conclusion, you do not have a finding. You have a suspicion. Suspicions do not belong in audit reports. Go back and gather more evidence, or acknowledge that you could not substantiate the concern.
Confusing Symptoms With Root Causes
A finding describes what was found, not why it happened. Root cause analysis is the auditee's job during the corrective action process. Your job is to document the nonconformity accurately. If you start speculating about causes in the finding itself, you risk framing the corrective action in a way that misses the real problem.
Failing to Record Conformities
An audit report that only contains nonconformities and observations does not give a balanced picture of system performance. Make sure conformities are recorded and communicated, particularly in the closing meeting and the audit report.
How Findings Feed Into the Corrective Action Process
A finding is not the end of the process. For nonconformities, the auditee is required to investigate the root cause, implement corrective action, and demonstrate that the action has been effective. This is where the quality of the finding really matters.
A well written nonconformity gives the auditee a clear starting point for root cause analysis. A vague one sends them in circles. If the finding is specific about what was found, where it was found, and what requirement applies, the auditee can investigate properly and address the actual issue rather than a surface symptom.
As an auditor, you may be involved in verifying that corrective actions have been completed and are effective. This is often done through a follow up audit or a desk review of evidence submitted by the auditee. The finding you wrote in the first place is the baseline for that verification. If the finding was vague, the verification will be equally difficult. The article on writing nonconformity reports that stand up to scrutiny covers this in more depth.
Exemplar Global Certified Training ProviderRTP No. 310970Findings in the Audit Report
All findings, whether nonconformities, observations, or conformities, need to be captured in the audit report. The report is the formal record of what was found and the basis for any follow up action. It is also a document that may be reviewed by senior management, certification bodies, and regulators, so it needs to be accurate and professional.
Each finding in the report should include the finding type, the requirement it relates to, the evidence that was gathered, and the conclusion. For nonconformities, the grade (major or minor) should be clearly stated. The report should also include a summary of overall conclusions about system performance, not just a list of problems.
Good audit report writing is a skill in itself. The structure, language, and level of detail all affect how useful the report is to the people who need to act on it. If this is an area you want to develop, the article on how to write audit findings that stand up to challenge provides specific practical guidance.
Building Your Skill in Developing and Recording Findings
The ability to identify, evaluate, and record findings accurately is one of the core competencies of an ISO auditor. It is not something you fully develop by reading about it. It comes from practice, from reviewing good and bad examples of findings, from receiving feedback on your own reports, and from working alongside experienced auditors who can show you how it is done in real audit situations.
Structured training plays a significant role in developing this competency. A well designed internal auditor or lead auditor course will walk you through the finding development process, give you practice scenarios, and require you to write findings that are assessed against professional standards. That feedback loop is invaluable, particularly early in your auditing career.
At Audit Workshop, the internal auditor and lead auditor courses across ISO 9001, ISO 14001, ISO 45001, ISO 27001, and other standards are built around practical skill development, not just theory. Participants work through real audit scenarios, practise writing findings, and receive feedback from an experienced lead auditor with over 500 external certification audits behind him. If you are serious about building your auditing skills, exploring the available courses at auditworkshop.com is a practical next step.
