What Goes into an Audit Report: A Practical Guide for ISO Auditors

An audit report is the permanent record of everything that happened during an audit. It captures what was examined, what was found, and what the auditor concluded. Yet despite being one of the most important outputs an auditor produces, the audit report is also one of the most inconsistently written documents in the profession. Some reports are so thin they are useless. Others are so padded with boilerplate text that the actual findings get buried. If you want to produce audit reports that genuinely inform decision makers and drive improvement, you need to understand what goes into one and why each element matters.

This guide walks through every component of a well structured audit report, from the cover page to the conclusion, with practical advice on what to include, what to leave out, and how to write it in a way that people will actually read and act on.

Why the Audit Report Matters More Than People Think

The audit report is not just a formality. It is the lasting record of the audit. Once the closing meeting is done and the auditor has left the building, the report is all that remains. It becomes the basis for corrective action decisions, management review inputs, and in the case of certification audits, the certification body's decision on whether to grant, maintain, or withdraw certification.

A poorly written report creates real problems. Vague findings lead to inadequate corrective actions. Missing context means management cannot prioritise responses. Incomplete records make follow up audits harder to conduct. And if a nonconformity is ever disputed, a report that lacks specific evidence will not hold up.

Good audit report writing is a skill that takes practice. It is worth investing the time to get it right. If you want to understand how findings should be classified before you write them up, the article on what audit findings are provides a solid foundation.

The Standard Components of an Audit Report

ISO 19011 does not prescribe a rigid template, but it does identify the information that a complete audit report should contain. The following sections reflect both the standard's guidance and what experienced auditors actually include in practice.

Cover Page and Report Identification

Every audit report needs a cover page that identifies the document clearly. This is not decoration. It is how the report gets filed, referenced, and retrieved later. The cover page should include:

• The name of the organisation being audited
• The audit type, such as internal audit, second party supplier audit, or certification audit
• The standard or standards being audited against
• The audit date or date range
• The report date
• The lead auditor's name
• A unique report reference number
• The distribution list, meaning who receives the report

Some organisations also include a version number and a confidentiality classification. For certification body reports, the report reference number is particularly important because it links back to the audit record in the certification body's system.

Audit Objectives

The report should state clearly what the audit was trying to achieve. Objectives are agreed before the audit begins, and they should be reproduced in the report so that readers understand the purpose of the exercise. Common audit objectives include determining conformity with the applicable standard, assessing the effectiveness of the management system, and identifying opportunities for improvement.

Stating objectives upfront also protects the auditor. If someone later questions why a particular area was or was not examined, the stated objectives provide the context for those decisions.

Audit Scope

The scope defines the boundaries of the audit. It tells the reader what was included and, by implication, what was not. A well written scope statement covers:

• The physical locations audited
• The organisational units or departments included
• The processes examined
• The time period covered by the audit
• Any exclusions and the reason for them

Scope statements are often written too broadly. Saying the audit covered the entire quality management system tells the reader very little. A more useful scope statement names the specific sites, processes, and clauses that were examined. This matters especially in large organisations where not every site or process can be audited in a single visit.

Audit Criteria

Audit criteria are the reference points against which evidence is compared. For an ISO 9001 internal audit, the criteria might include the ISO 9001 standard itself, the organisation's quality manual, documented procedures, and any customer or regulatory requirements that apply. The report should list these explicitly so that readers know what benchmark was used.

This section is often skipped or merged with the scope section, but keeping it separate is good practice. It makes clear that findings are not based on the auditor's personal preferences but on agreed standards and requirements.

Audit Dates, Duration, and Personnel

The report should record when the audit took place, how long it ran, and who was involved. This includes:

• The date or dates of the audit
• The names and roles of all auditors, including any technical experts or observers
• The names and roles of the key auditees and guides

Recording personnel is important for traceability. If a finding is later disputed or a corrective action is being tracked, knowing exactly who was present during which part of the audit helps resolve questions quickly.

The Findings Section: The Heart of the Report

The findings section is where most of the substantive content lives. It is also where most poorly written reports fall apart. Findings need to be clear, specific, evidence based, and linked to the relevant requirement.

Nonconformities

Nonconformities are the most significant findings in any audit report. They represent failures to meet a requirement, whether that requirement comes from the standard, a documented procedure, a legal obligation, or a customer specification. Each nonconformity should be written as a standalone statement that includes:

• A description of what was found, in plain language
• The specific evidence observed, such as document references, record numbers, or what was said during an interview
• The clause or requirement that has not been met
• The grading, either major or minor

A major nonconformity indicates a systemic failure or an absence of a required element. A minor nonconformity indicates an isolated lapse or partial implementation. The distinction matters because it affects how urgently corrective action must be taken and, in certification audits, whether the certificate can be issued or maintained.

For practical guidance on writing nonconformities that will withstand challenge, the article on writing nonconformity reports that stand up to scrutiny covers this in detail.

Observations and Opportunities for Improvement

Not everything an auditor notices during an audit rises to the level of a nonconformity. Observations are areas where the auditor has noted something worth the organisation's attention, even though no requirement has technically been breached. Opportunities for improvement are positive suggestions for doing something better.

These findings are valuable, but they need to be written carefully. An observation should not be written in a way that implies a nonconformity exists when it does not. Similarly, an opportunity for improvement should not be prescriptive. The auditor's role is to identify the gap or the potential, not to design the solution. The article on writing opportunities for improvement worth acting on explains how to frame these effectively.

Positive Findings

Many audit reports focus exclusively on problems and miss an important opportunity. Recording positive findings, areas where the organisation is genuinely doing well, serves several purposes. It gives management an accurate picture of the system's strengths. It acknowledges good work, which helps maintain a constructive relationship with the auditee. And it provides a baseline for future audits.

Positive findings should be specific, not generic. Saying the team demonstrated a strong commitment to quality is meaningless. Saying that all ten calibration records reviewed were complete, current, and signed off by a competent person within the required timeframe is specific and useful.

The Audit Conclusion

The audit conclusion is the auditor's overall assessment of the management system based on the evidence gathered. It is not a summary of the findings. It is a considered judgement about whether the system is conforming to its requirements and whether it is effectively implemented and maintained.

A well written conclusion addresses:

• The overall level of conformity with the audit criteria
• Whether the management system is achieving its intended outcomes
• The significance and pattern of any nonconformities found
• Any trends observed compared to previous audits
• The recommendation regarding certification, where applicable

The conclusion should be written in plain language and should be proportionate to the evidence. If the audit found two minor nonconformities in an otherwise well functioning system, the conclusion should reflect that. If the audit found systemic failures across multiple clauses, the conclusion should say so clearly without softening the message to avoid discomfort.

For a deeper look at how conclusions are formed and expressed, the article on what an audit conclusion is is worth reading alongside this one.

Confidentiality and Distribution

Audit reports contain sensitive information. They may reference specific employees, internal processes, compliance failures, and commercially sensitive data. The report should include a clear statement about confidentiality and the distribution list should be controlled.

In practice, this means:

• The report should be marked as confidential where appropriate
• It should only be sent to those who have a legitimate need to receive it
• For internal audits, distribution typically includes the process owner, the quality manager, and top management
• For certification audits, the report stays within the certification body and the audited organisation
• For supplier audits, the report is typically shared only with the commissioning organisation and the supplier

Auditors sometimes underestimate how seriously organisations take confidentiality. Sending a report to the wrong person, or including more detail than necessary about an individual, can create significant problems. Handle distribution with care.

Attachments and Supporting Documents

The main body of the report should be readable without needing to flip between attachments constantly. But some supporting documents are worth including as appendices. Common attachments include:

• The audit plan or schedule
• The audit checklist or working notes, where required by the organisation's procedure
• Copies of key documents reviewed, where relevant to a specific finding
• Photographs taken during the audit, with permission
• A list of documents and records reviewed
• Sign in sheets from the opening and closing meetings

Not every audit report needs all of these. For a simple internal audit of a small process, a concise report with clear findings is better than a bloated document full of unnecessary attachments. Use judgement about what actually adds value.

Common Mistakes in Audit Reports

After conducting hundreds of audits across multiple industries and standards, certain patterns of poor report writing appear repeatedly. The most common mistakes include:

• Vague findings with no evidence: Saying the organisation does not maintain adequate records is not a finding. Saying that three of five training records reviewed for the production team were missing the competency assessment sign off, contrary to procedure WI-HR-003 version 2, is a finding.
• Missing clause references: Every nonconformity must be linked to a specific requirement. Without this, the organisation cannot determine what needs to be corrected.
• Conclusions that do not match the findings: If the report contains three major nonconformities but the conclusion says the system is largely conforming, something has gone wrong in the writing.
• Excessive boilerplate: Long paragraphs of standard text about the purpose of auditing, the organisation's background, or the audit process add length without adding value. Readers skip them.
• Passive language that obscures accountability: Writing that findings were noted rather than naming what was found and where creates ambiguity that makes corrective action harder.

Timing and Finalisation

The report should be issued promptly after the audit. In certification audit contexts, certification bodies typically have defined turnaround times. For internal audits, a good rule of thumb is to issue the draft report within five working days of the closing meeting, while the detail is still fresh.

Before issuing the final report, the lead auditor should review it against the working notes to confirm that all findings are accurately recorded and that the evidence cited is correct. In a team audit, the lead auditor is responsible for the quality of the entire report, not just the sections they personally wrote.

Some organisations have a process for the auditee to review the draft report for factual accuracy before it is finalised. This is reasonable and can prevent disputes later. However, the auditor should not change findings based on the auditee's preference. Factual corrections are appropriate. Softening a nonconformity because the auditee disagrees with it is not.

Building Your Skills in Audit Report Writing

Writing a clear, accurate, and useful audit report is something that improves significantly with structured training and practice. If you are new to auditing, or if your reports are not generating the responses they should, it is worth examining whether your training has given you enough practical guidance on this skill.

At Audit Workshop, our Internal Auditor and Lead Auditor courses include practical exercises in audit report writing, giving you the chance to draft findings, receive feedback, and understand what a well constructed report actually looks like. Courses are available across ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 42001, and ISO 13485, in both live and self paced formats. If you want to produce reports that decision makers actually use, that is a good place to start.