A nonconformity report is only as good as the evidence behind it. If you cannot defend every element of your finding when challenged, the report will not drive the corrective action the organisation needs. Writing nonconformity reports that stand up to scrutiny is one of the core skills separating capable auditors from those who produce paperwork that gets disputed, diluted, or quietly ignored. This article walks through the structure, language, and evidence requirements that make a nonconformity report defensible, credible, and genuinely useful.
On this page
Why Nonconformity Reports Get Challenged
Before getting into how to write a strong report, it is worth understanding why weak ones fail. In over a decade of conducting external ISO certification audits, the same patterns appear repeatedly when auditees push back on findings.
The most common reasons a nonconformity gets challenged are:
- The clause reference is wrong or missing entirely
- The requirement has been paraphrased incorrectly
- The evidence is vague, such as records were not available rather than naming the specific records reviewed
- The finding describes a symptom rather than the actual nonconformity
- The grading as major or minor cannot be justified
- The auditor has mixed opinion with fact
Each of these problems is avoidable. They come down to discipline in how you record and report what you found. The good news is that fixing these habits is straightforward once you understand what a properly structured nonconformity report actually contains.
Exemplar Global Certified Training ProviderRTP No. 310970
The Four Elements Every Nonconformity Report Must Have
Regardless of which standard you are auditing against, whether that is ISO 9001, ISO 14001, ISO 45001, or ISO 27001, a defensible nonconformity report needs four things working together. Miss one of them and the report becomes vulnerable to challenge.
1. The Requirement
State the clause number and quote the relevant requirement directly from the standard. Do not paraphrase. Do not interpret. Quote it.
For example, if you are raising a finding against ISO 9001 Clause 7.2, the requirement section should include something like:
ISO 9001:2015 Clause 7.2 requires the organisation to determine the necessary competence of persons doing work under its control that affects the performance and effectiveness of the quality management system, ensure that these persons are competent on the basis of appropriate education, training, or experience, and where applicable, take actions to acquire the necessary competence.
This is not about being pedantic. It is about establishing the exact standard against which the evidence will be measured. If you paraphrase and get it slightly wrong, the auditee can argue the requirement means something different. Quoting directly removes that ambiguity. You can read more about how auditors use clause requirements as audit criteria in our article on audit criteria explained.
2. The Objective Evidence
This is where most nonconformity reports fall apart. Objective evidence must be specific, verifiable, and factual. It should describe exactly what you saw, read, or were told, and it should name the documents, records, people, and dates involved.
Compare these two versions:
Weak: Competency records were not available for reviewed staff.
Strong: During the audit conducted on 14 May 2025, training records were requested for five personnel performing welding operations in the fabrication area. Records were sighted for two personnel (employee IDs W001 and W003). No competency records could be located or provided for W002, W004, or W005. The production supervisor confirmed that these three employees had been performing welding operations since January 2025.
The second version is defensible. It names the date, the process area, the sample size, the records that existed, the records that did not exist, and includes a corroborating statement from the supervisor. Anyone reviewing this report can verify every element of it. The first version proves nothing.
For practical guidance on what counts as valid evidence and how to gather it, see our article on audit evidence explained.
3. The Nonconformity Statement
The nonconformity statement is a concise, factual description of the gap between the requirement and the evidence. It should not contain recommendations. It should not express frustration. It should not speculate about why the gap exists.
A well written nonconformity statement follows a simple pattern: the organisation has not done X, as evidenced by Y, which does not meet the requirement of Clause Z.
Using the welding example above, the statement might read:
The organisation has not ensured that all persons performing welding operations are competent. No competency records were available for three of five welding personnel sampled, despite those personnel having performed welding work for approximately four months. This does not meet the requirements of ISO 9001:2015 Clause 7.2.
Clear, factual, and directly linked to both the evidence and the requirement. That is what you are aiming for.
4. The Grading
Grading a nonconformity as major or minor is a judgement call, but it needs to be a justifiable one. A major nonconformity typically indicates a systemic failure, a complete absence of a required process, or a situation where the integrity of the management system is seriously in doubt. A minor nonconformity is generally an isolated lapse or partial implementation.
In the welding example, if this were an isolated instance with one employee who had just started, it would likely be a minor. If it were three out of five employees across a core production process, the systemic nature of the failure would point toward a major. Document your reasoning. Write a sentence or two explaining why you graded it the way you did. This protects you if the grading is questioned.
The updated guidance in ISO 19011:2026 provides more explicit expectations around grading. If you want to understand the current standard of practice, our article on grading nonconformities under ISO 19011:2026 covers the new expectations in detail.
Language That Weakens a Nonconformity Report
The words you choose matter more than most new auditors realise. Certain types of language introduce ambiguity, subjectivity, or opinion into what should be a factual document.
Avoid Vague Quantifiers
Words like some, several, many, and occasionally are not evidence. If you reviewed twelve records and found problems with four, say so. Specific numbers are defensible. Vague language is not.
Avoid Evaluative Language
Phrases like inadequate, poor, insufficient, and unsatisfactory are conclusions, not evidence. Your job is to describe what you found and let the gap between the evidence and the requirement speak for itself. If the evidence is specific and the requirement is clear, the nonconformity is self evident. You do not need to editorialize.
Avoid Recommendations Inside the Finding
A nonconformity report describes what is wrong. It does not tell the organisation how to fix it. Mixing recommendations into the finding muddies the distinction between the auditor role and the consultant role, and it can also give the auditee an easy way to dispute the finding by arguing about your proposed solution rather than the actual gap.
Avoid Referencing Undocumented Requirements
Only raise a nonconformity against a requirement that actually exists. This sounds obvious, but auditors sometimes raise findings against what they think the standard should require, or against internal procedures that do not actually impose the obligation they assume. Check the clause. Check the procedure. Make sure the requirement you are citing is real and applicable.
Connecting Evidence to the Finding
One of the most important disciplines in writing nonconformity reports is the explicit connection between each piece of evidence and the finding it supports. Do not assume the reader will make the connection themselves.
If you reviewed a risk register during an ISO 14001 audit and found that five significant environmental aspects had no associated controls documented, your evidence section should name the aspects, reference the document you reviewed (including its version or date), and confirm that you checked for associated controls and found none. Then your nonconformity statement should explicitly connect that evidence to the clause requirement.
Think of it as building a chain. Requirement at one end, evidence at the other, and a clear nonconformity statement linking them. If any link in that chain is missing or weak, the whole finding can be pulled apart.
Sampling and Its Implications for Your Report
Auditors work from samples. You cannot review every document, interview every person, or observe every process. This creates an important obligation in how you write your findings.
When you raise a nonconformity based on a sample, your report should state the sample size and what proportion of the sample showed the problem. This does two things. First, it makes your evidence specific and verifiable. Second, it helps the auditee understand the scope of their corrective action. If you found the problem in four out of six records sampled, the organisation needs to investigate whether the problem extends beyond your sample.
Be careful not to overstate what your sample proves. If you found one instance of a missing record, that is one instance. It may indicate a systemic problem, or it may be isolated. Your report should describe what you found, and your grading should reflect your assessment of whether the evidence points to a systemic or isolated failure. Do not extrapolate beyond what the evidence supports.
When the Auditee Disputes the Finding
Even well written nonconformity reports get disputed. Auditees sometimes produce additional records during the closing meeting, claim a misunderstanding, or argue that the requirement does not apply to their situation. Knowing how to handle this professionally is part of writing a defensible report.
If additional evidence is produced that genuinely contradicts your finding, you should review it calmly and be prepared to withdraw or modify the finding if the evidence warrants it. This is not weakness. It is professional integrity. The finding must rest on evidence, and if the evidence changes, the finding may need to change too.
If the auditee argues that the requirement does not apply, go back to the clause. Read it together if necessary. The standard is the arbiter, not either party's opinion of what it means.
If the auditee argues that your evidence is wrong, for example claiming that the records you could not locate do actually exist, ask them to produce the records. If they can, review them and adjust accordingly. If they cannot, your original finding stands.
The key is that a well written report gives you solid ground to stand on during these conversations. When your evidence is specific, your clause reference is accurate, and your nonconformity statement is factual, you are in a strong position. Vague reports invite dispute because they give the auditee room to argue.
Practical Tips From the Audit Floor
After conducting hundreds of external ISO audits, a few practical habits consistently produce better nonconformity reports.
Write Notes in Real Time
Do not rely on memory. When you find something that may become a nonconformity, write down the specifics immediately. Document number, version, date, the name or ID of the person involved, what you observed, and what was said. If you wait until the end of the day to reconstruct your notes, detail is lost and your evidence becomes less specific.
Photograph or Copy Documents Where Permitted
Where the auditee permits it and confidentiality allows, taking a photo of a record or requesting a copy gives you concrete, verifiable evidence to reference in your report. This is particularly valuable when the evidence is a specific entry in a register or a particular field left blank in a form.
Confirm Key Points With the Auditee During the Audit
If you observe something that may become a nonconformity, it is good practice to confirm your understanding with the auditee at the time. Ask them to confirm that the record you are looking at is the current version, or that the process you observed is the standard process. This prevents the auditee from later claiming you misunderstood what you were looking at.
Draft Findings Before the Closing Meeting
Do not write your nonconformity reports during the closing meeting. Draft them during the audit, review them during the team debrief if you have one, and arrive at the closing meeting with clear, reviewed findings ready to present. This gives you time to check clause references, tighten your language, and make sure each finding has all four elements in place.
For more on how to structure audit findings from collection through to reporting, our article on how to write audit findings that stand up to challenge provides a useful companion reference.
Exemplar Global Certified Training ProviderRTP No. 310970The Link Between Good Nonconformity Reports and Effective Corrective Action
A well written nonconformity report does more than survive scrutiny. It sets the organisation up to take effective corrective action. When the requirement is clear, the evidence is specific, and the nonconformity statement accurately describes the gap, the organisation can identify the root cause and address it properly.
Vague findings produce vague corrective actions. If your report says that records were not available, the organisation might simply locate some records and close the finding without addressing why the records were not being maintained in the first place. If your report describes exactly which records were missing, for which personnel, in which process, over what time period, the organisation has a much clearer picture of what needs to be investigated and fixed.
Your nonconformity report is the starting point for improvement. Write it with that in mind.
Building This Skill Through Training and Practice
Writing strong nonconformity reports is a skill that develops with practice, feedback, and a solid grounding in audit methodology. Many auditors who struggle with this area have never had their reports reviewed critically by an experienced lead auditor. They have been writing in the same way for years without realising the gaps.
If you are developing your auditing skills or preparing to conduct audits more formally, structured training makes a real difference. At Audit Workshop, our Internal Auditor and Lead Auditor courses include practical exercises in writing nonconformity reports, with feedback from experienced auditors who have conducted hundreds of real certification audits. Courses are available for ISO 9001, ISO 14001, ISO 45001, ISO 27001, and more, in both live and self paced formats. You can explore the full range of courses at auditworkshop.com.
