How to write an audit finding that gets fixed

A good audit can still produce nothing if its findings are unclear. “Training records need improving” gets a shrug, a vague action and the same finding next year. A finding that says exactly which requirement was missed, what was seen and how far the problem extends gets a proper investigation. This guide sets out a structure that works for internal and supplier audits under any ISO management system standard, with before-and-after rewrites.

What a finding is for

An audit finding is the result of comparing audit evidence against audit criteria. It can show conformity or nonconformity, and good practice is to record both, but this guide is about the nonconformities, because those are the findings that have to drive change.

A written nonconformity has three readers:

• The process owner, who has to accept it and investigate the cause. If they can argue with it, they will.
• Whoever verifies the corrective action, often months later, who needs to know exactly what was wrong to judge whether it is fixed.
• The certification auditor, who samples your internal audit records to see whether your audits find real problems and whether the problems get closed.

Write for the reader who was not in the room. If they can verify the finding from the text alone, it is good enough.

The three-part structure

Most certification bodies and audit training courses teach some version of the same three parts.

1. Requirement. What should be happening, and where it is written. Reference the clause of the standard, and, where the gap is against your own system, the procedure, specification, contract or legal requirement too. Paraphrase the requirement in a sentence so the reader does not have to look it up.
2. Evidence. What the auditor actually saw, heard or read. Records sampled, sample size, IDs, dates, locations, who was interviewed by role. Objective and verifiable: no adjectives, no assumptions.
3. Statement of nonconformity. One sentence that says how the evidence fails the requirement. This becomes the title of the finding, so it should make sense on its own in a list.

Keep each part separate. The commonest failure is to blend them into a paragraph where the reader cannot tell what was observed from what the auditor concluded.

Weak and strong findings side by side

The following examples come from audits at Kestrel Metals, a fictional fabrication company.

Supplier control

Weak: “Supplier management is not effective. Purchasing needs to be more proactive with evaluations.”

Strong:

• Requirement: ISO 9001 clause 8.4.1 and procedure QP-08 require external providers to be evaluated and re-evaluated against defined criteria; QP-08 sets an annual re-evaluation.
• Evidence: The approved supplier list (rev. 14, last reviewed March 2024) lists 11 active suppliers. For 3 of the 11, including the steel stockholder used for line 2, no evaluation since 2023 was on file. Purchasing confirmed the annual review had not been carried out in 2025.
• Statement: Approved supplier list not reviewed since March 2024; three of eleven active suppliers have no current evaluation.

The weak version is an opinion. The strong one gives the process owner a sample to check, a scale (3 of 11) and a clear gap.

Calibration

Weak: “Some gauges are out of calibration.”

Strong:

• Requirement: Clause 7.1.5.2 requires measuring equipment used for product verification to be calibrated at specified intervals and identified so its status can be determined.
• Evidence: Of 15 gauges sampled at line 2 inspection, gauge G-207 (bore gauge) carried a calibration label due 4 August 2026. It was in use on 2 September 2026 to accept batch 26-1184. The calibration register showed no later calibration.
• Statement: Bore gauge G-207 used to accept product after its calibration due date.

Note what the strong version also implies: product accepted with an overdue gauge may need a review, which is a correction the process owner should consider straight away.

Information security

Weak: “Leavers process is poor; accounts not removed.”

Strong:

• Requirement: The access control policy (IS-04) requires user accounts to be disabled on the leaving date, supporting Annex A control 5.18 of ISO/IEC 27001:2022.
• Evidence: Of 8 leavers between April and June 2026, 2 still had active accounts in the finance system on the audit date, 41 and 63 days after leaving. HR leaver notifications for both had been sent to IT.
• Statement: Two of eight leavers retained active finance system accounts more than 40 days after leaving.

Language that helps and hurts

Small wording choices decide whether the auditee engages or defends.

Use:

• Numbers and samples: “2 of 8”, “all 15 sampled”.
• Record IDs, dates, versions and locations.
• Roles rather than names: “the line 2 shift supervisor”.
• Neutral verbs: “was not”, “did not include”, “showed”.

Avoid:

• Absolutes you cannot support: “never”, “always”, “no one”.
• Judgement words: “poor”, “inadequate”, “sloppy”, “lack of commitment”.
• Causes you have not established: “because staff were not trained”. That is the process owner’s investigation, not the auditor’s conclusion.
• Solutions: “should buy a new gauge”, “must retrain the team”. A recommendation tends to become the action without any root cause work.
• Bundling: three unrelated gaps in one finding. Split them so each can be closed on its own evidence.

Before you leave the audit, read each nonconformity to the auditee at the closing meeting. Agreement on the facts at that point saves weeks of dispute later; disagreement about the grade is normal and can be settled afterwards.

Grading, observations and positives

Every finding needs a grade, and the grade should follow the evidence, not the auditor’s mood. Many organisations borrow the certification bodies’ major and minor split; others use a three- or four-level severity scale. The guide on major vs minor nonconformity compares the two approaches.

Not every finding is a nonconformity. Where the requirement is met but there is a risk it will not be, or there is a better way, record an observation or opportunity for improvement. Write it with the same discipline (what was seen, why it matters) so that it is still useful if it becomes a nonconformity next time.

Record good practice too. A short note that the line 1 first-off inspection records were complete and signed for all 20 sampled batches tells management where the system works and tells the next auditor what to compare against.

When the auditee disputes a finding

Disputes are normal, and a well-written finding makes them short. They usually fall into one of three kinds, each with a different response.

The facts are wrong. The auditee shows a record you did not see, such as the missing supplier evaluations filed in a different folder. Check it. If it meets the requirement, withdraw or amend the finding and say so in the report. An auditor who corrects a mistake openly gains more credibility than one who defends it.

The requirement is misread. The auditee argues that the procedure does not actually require what you said. Go back to the text of the procedure or the clause together. If the requirement is ambiguous, the finding may be better recorded as an observation about the procedure itself, since an instruction two people read differently is a risk in its own right.

The grade is too harsh. This is the commonest dispute and the easiest to settle if your grading scheme has written definitions and examples. Point to the definition rather than arguing case by case.

Whatever the outcome, record the dispute and its resolution on the finding. When K. Lewis disputed a calibration finding at Kestrel Metals because the gauge had been calibrated but the register not updated, the finding was amended to a records issue rather than withdrawn, because the register is what the inspectors rely on. That reasoning, written down, saves the same argument at the next audit.

A checklist before you issue a finding

Run each nonconformity through these questions before it leaves your hands:

• Does it name the specific requirement, with a clause or document reference?
• Could someone who was not there find the same records from the evidence given?
• Does it state the sample and how many failed?
• Is the statement one sentence that makes sense in a list of findings?
• Is it free of opinions, causes and solutions?
• Is it one problem, not three?
• Has the auditee seen it and agreed the facts?
• Is the grade justified by the evidence?

In Orisynx, findings are linked to the audit they came from, graded low, medium, high or critical, and can carry files, links and notes as evidence, so the three parts and the proof stay together. Once a finding is issued, the work moves to the process owner: see root cause analysis and corrective action for what a good response looks like.