How to write an audit finding (with examples)

The audit finding is the most consequential thing an auditor produces. It is what the auditee walks away with, what the corrective action process is built on, and what the certification decision ultimately rests upon.

However, the way an audit finding is written can make a significant difference to what happens next.

A poorly written finding can leave the auditee unclear about the nature of the nonconformity. This makes it harder to identify the underlying causes, take effective corrective action and prevent the issue from happening again – which may ultimately lead to a repeat finding raised in the next audit.

A well-written finding does something different. It gives the auditee enough information to understand what requirements were not met, why it matters, and where in their system to look for the cause. That is what drives genuine improvement – and it starts with the auditor knowing how to write the finding.

The three types of findings

Before you write anything, you need to be clear on what you are raising.

Nonconformity – a specific requirement not met. A nonconformity must be traceable to a clause. If you cannot name the clause and explain which part of it is not being met, you do not have a nonconformity – you may have an observation. Nonconformities are classified as major or minor (more on that below).

Opportunity for Improvement (OFI) – no requirement is being breached, but there is a clear and specific way the organisation could do better. An OFI is not a softened nonconformity. It is a genuine observation that something could work more effectively even though it currently meets the standard's requirements.

Observation – a notable pattern or area worth watching. Not a finding in its own right, but worth recording and revisiting at the next audit. Use observations sparingly; they should add value, not function as a dumping ground for things you noticed but could not substantiate.

How you classify an audit finding matters, because an auditee who receives a nonconformity when an OFI was warranted will have a legitimate grievance. Likewise, an auditee who receives an OFI when a nonconformity was warranted may not address the issue with the urgency it deserves.

Major vs minor nonconformity – understanding the distinction

This is where most auditors hesitate, and where the most common classification errors occur.

A major nonconformity indicates a systematic failure – the management system is not achieving its intended result in a significant area, or a fundamental requirement is entirely absent. A major finding at a certification audit will typically prevent certification or require a follow-up audit before it can be granted.

Examples: no internal audit programme exists at all; the organisation has no documented process for handling nonconforming outputs; or, under ISO 14001 and ISO 45001, the organisation has no process to identify applicable legal and other requirements, has not determined how they apply to the organisation, and cannot demonstrate how it monitors its legal compliance.

A minor nonconformity is an isolated lapse, or part of a requirement is not met.

Examples: the organisation has an audit programme in place, however it doesn't assign responsibility or identify the criteria for the audit to be undertaken; or although the organisation has established a process for internal auditing, including an internal audit programme, only four of the ten scheduled audits have been completed in the past 12 months.

The most common error is calling something major because it feels serious. Seriousness can be subjective, whereas a classification is a determination based on evidence. The question to ask is not "how bad does this look?" but "does this represent a systemic failure of the management system, or an isolated gap in an otherwise functioning system?" If you cannot answer that from the evidence in front of you, you need more evidence – not a stronger adjective.

How to structure a finding

A well-structured audit finding has three components, in this order:

1. The requirement. Name the clause and describe what it requires. Be specific – not "the organisation must maintain documented information" but "Clause 7.5.3 requires documented information to be suitable for use, where and when it is needed and be adequately protected (from loss of confidentiality, improper use or loss of integrity)."

2. The evidence. Describe what you observed, reviewed, or verified during the audit. This must be objective and verifiable – specific documents, records, dates, people, locations. Evidence is not your interpretation; it is what you found.

3. The finding. Explain how the evidence demonstrates non-fulfilment of the requirement. This is the connection between what the standard expects and what the audit found. Keep it factual, present-tense, and non-directive. Do not tell the auditee what to do about it – that is their job, not yours.

The finding should be self-contained. Someone who was not present at the audit should be able to read it, understand exactly what was found, locate the evidence, and understand which requirement was not met.

Example 1: Maintenance manuals inaccessible

Clause 7.5.3 Control of documented information (9001; 14001; 45001) – Minor Nonconformity

• Requirement: The standards require documented information needed for the management system to be available and suitable for use, where and when it is needed.

• Audit Evidence: At the time of the audit, it was noted that maintenance staff did not have access to the maintenance manuals retained in SharePoint.

• Nonconformity: The organisation has not fully maintained the availability of documented information required by maintenance staff to perform their work.

Example 2: Maintenance manuals outdated and illegible

Clause 7.5.3 Control of documented information (9001; 14001; 45001) – Minor Nonconformity

• Requirement: The standards require documented information needed for the management system to be suitable for use and controlled to ensure changes are managed and legibility is preserved.

• Audit Evidence: At the time of the audit, it was noted that the maintenance manuals available in the maintenance workshop were outdated and had deteriorated to the extent that they were illegible.

• Nonconformity: The organisation has not fully maintained control of the maintenance manuals to ensure that current, legible information is available for use.

Comparitive examples: strong vs weak

Nonconformity – weak

"The team does not seem to understand the work instruction and needs better training."

This is not a finding; rather it is an impression. There is no clause reference, no specific evidence, and a directive embedded in the observation ("needs better training"). An auditee who receives this cannot write a meaningful corrective action, and a certification body reviewer cannot evaluate whether the finding is justified.

Nonconformity – strong

"Records reviewed during the audit confirm that three of the five operators interviewed were unable to identify the current version of Work Instruction WI-014 (rev. 4, issued March 2026). The current version was not available at the workstation where the process is performed. This does not meet the requirements of Clause 7.5.3, which requires documented information controlled by the organisation to be available at the point of use."

This finding names the clause, describes specific evidence (three of five operators, a named document, a version and date, a specific location), and explains the connection to the requirement. The auditee knows exactly where to look and what to address.

OFI – weak

"The organisation might benefit from reviewing its Customer Satisfaction process."

This tells the auditee nothing useful. Why? Based on what? An OFI should be specific enough that the auditee understands what improvement is available to them.

OFI – strong

"The organisation could consider developing a shared spreadsheet to capture customer feedback received by Project Managers and other personnel through emails, meetings and informal discussions. Dropdown fields identifying the source and type of feedback, such as compliments, complaints or suggestions, could support consistent recording. This would enable feedback to be consolidated across projects, support analysis of customer satisfaction trends and help identify opportunities for service improvement."

This OFI is specific, evidence-based, and genuinely useful. The auditee understands exactly what could be improved and why it matters.

Common mistakes auditors make

Raising a nonconformity without a clause reference. If you cannot identify the specific clause and the specific part of it that is not being met, you do not have a nonconformity. Go back to the standard before you go back to your notes.

Combining multiple issues into one finding. This is one of the most damaging habits in audit report writing. When a finding covers two or three separate issues, the corrective action will almost always address only one of them – usually the most visible one. Separate issues deserve separate findings.

Including recommendations in the finding. "The organisation should update its procedure" is not a finding – it is corrective action advice. The finding describes what was found. What the organisation does about it is their determination, not yours.

Recording impressions rather than evidence. "Staff appeared unaware of the policy" is an impression. "Two of three staff interviewed in the warehouse were unable to state the organisation's quality policy when asked, and confirmed they had not received the awareness training recorded as completed in the training register" is evidence.

Using emotive or directive language. Words like "failure," "neglect," "inadequate," and "must immediately" have no place in an audit finding. The finding is a professional, factual document. Its strength comes from the quality of the evidence, not the strength of the language.

The finding is the beginning of improvement

A well-written finding does not solve the problem – it makes it possible for the auditee to solve the problem. That distinction matters. The auditor's job ends at an accurate, evidence-based, clause-referenced finding. The auditee's job begins there.

This is why the skill of writing findings is worth developing deliberately. It is not a paperwork exercise. It is the mechanism through which an audit translates into improvement – or does not.

Writing effective findings is a core skill developed in our Integrated Management Systems Lead Auditor course, where participants practise raising and defending findings across real audit scenarios over five facilitated days. The Internal Auditor Course covers the same skill for those building an internal audit programme from the ground up.

Why train with us?

Auditor Training Co is powered by Southpac International Group, with over 20 years as management systems specialists in aviation and other high-risk industries. Our auditor training offering has developed as a result of understanding both what it takes to build effective management systems and what effective third-party auditing looks like, as a JAS-ANZ accredited certification body. Our courses are certified by Exemplar Global and are facilitated by some of the industry's most experienced trainers with auditing backgrounds.

We offer comprehensive training courses for various auditing roles – from those looking to specialise in auditing Integrated Management Systems across quality, safety and environment, to those wanting to develop the skills to conduct effective internal audits.