What an audit finding is
An audit finding is the result of comparing audit evidence against the audit criteria — in ISO 19011's words, the outcome of evaluating what you observed against what the standard, procedure or customer requirement demands. Crucially, a finding is not automatically bad news. It can record conformity, where the requirement is met; non-conformity, where a requirement is not fulfilled; or an opportunity for improvement, where nothing is breached but the process could be strengthened. A balanced audit records all three, so the report reflects the real state of the process rather than only its faults.
The finding that drives action, though, is the non-conformity — defined in ISO 9000 simply as the non-fulfilment of a requirement. Everything the corrective-action machinery does begins with an NC that is well identified, well graded and well written. Get the finding wrong — too vague to verify, mis-graded, or a mere opinion — and every downstream step inherits the flaw. This is why classifying and recording findings correctly is one of the highest-leverage skills in an audit programme, and it slots into the wider lifecycle described in the audit management pillar.
The anatomy of a non-conformity
A defensible non-conformity always has the same three parts, and a finding that is missing any one of them is where disputes start:
Alongside those three, a finding needs its attribution — the process or area it belongs to, and the auditee and auditor associated with it — and its classification, which is what the rest of this guide is about. Recording the clause number against every finding is what later makes it possible to see whether the same clause keeps failing, which is the single most useful pattern a programme can surface.
Major, minor and observation
Findings are graded into three levels, and the grade drives what happens next — how urgently it must be contained, whether it blocks certification, and how deep the root-cause work needs to go:
Major non-conformity
The absence or total breakdown of a required control, or a failure that undermines the system's ability to achieve its intended results — no procedure where one is required, or a control systematically ignored.
Systemic breakdownMinor non-conformity
An isolated lapse against a requirement that does not indicate a systemic failure — one missing record in an otherwise reliable process, a single instance of a step not signed off.
Isolated lapseObservation / OFI
Not a breach of any requirement, but a potential weakness or a chance to improve before something fails. No corrective action is compelled, but recording it drives continual improvement.
Not an NCThe most common mistake is blurring the line between a minor NC and an observation. A minor is a genuine breach of a requirement, however small; an observation breaches nothing. Collapsing the two either inflates the NC count with suggestions or, worse, quietly downgrades real breaches into "observations" that never get corrected. Keeping the three grades distinct — as separate, recorded values — is what makes the non-conformance register trustworthy.
Are your NCs graded consistently, or does it depend on the auditor?
See Fast Audit capture each finding with its clause, discrepancy, NC category and fresh-or-repeat flag — then roll them into one register — in a 30-minute demo.
How to grade: the major-versus-minor call
The judgement that most affects an audit's consequences is whether a non-conformity is major or minor, and it turns on one question: does the evidence point to a systemic breakdown, or an isolated slip? A few tests help make the call consistently:
| Test | Points to a major | Points to a minor |
|---|---|---|
| Control present? | The required control is absent altogether | The control exists but was missed once |
| Pattern? | Multiple instances, or the same failure across the process | A single, isolated instance |
| Effect on outcomes? | Risks non-conforming product reaching the customer or a legal breach | No material effect on product or compliance |
| Accumulation? | Several minors against the same clause, together a breakdown | Stands alone against its clause |
Two of these deserve emphasis. A total absence of a required control — no calibration system where one is mandated — is a major almost regardless of immediate impact, because the system to prevent failure simply is not there. And an accumulation of minors against one requirement is a recognised route to a major: individually forgivable, together they demonstrate the control is not working. Recording the clause against each finding is what lets a programme see that accumulation instead of missing it.
Fresh versus repetitive findings
The most valuable single flag on any finding is whether it is fresh or repetitive. A repeat non-conformance — the same clause or process failing again after it was supposedly corrected — is the clearest evidence that a previous root cause was never actually fixed, only papered over. A programme that cannot see repeats is doomed to rediscover the same problems every surveillance cycle; one that flags them turns the audit into an early-warning system for ineffective corrective action.
Practically, a repeat should do more than get logged. It should carry more weight in grading — a recurrence often justifies escalating a minor to a major — and it is frequently the trigger to move the finding into formal, deeper root-cause analysis rather than another quick fix. The CAPA process for audit findings is where that escalation happens, and repeat detection is what tells you it is needed. A major or recurring NC can move into Fast Quality's 8D / CAPA engine for structured analysis.
Writing a finding that holds up
A finding is only as strong as its wording. The three-part structure — requirement, evidence, deficiency — is not academic; it is what makes a finding verifiable and non-negotiable. Compare two versions of the same issue:
- Weak: "Calibration is not being done properly." An opinion — nothing to verify, easy to dispute, impossible to root-cause.
- Strong: "Clause 7.1.5.2 and procedure QP-12 require measuring equipment to be calibrated before use. Vernier caliper VC-07, in use on line 3, showed a calibration due date of March 2026 and no current record. The equipment is in use beyond its calibration interval." Requirement, evidence and deficiency, all present.
The strong version gives the auditee everything needed to contain the issue and find the root cause, and gives a registrar nothing to argue about. Capturing the clause, the observation and the discrepancy as distinct fields — rather than one free-text blob — is what nudges auditors toward writing findings this way every time. See Findings, NC & CAPA Closure for the feature.
How Fast Audit records findings
Fast Audit Software builds this discipline into checklist entry, so a well-formed, graded finding is the default rather than a matter of auditor diligence:
The register that results — filterable by audit, type, clause and period — is exactly what a certification body reviews, and what turns a pile of individual findings into a picture of where a process really stands. For automotive plants, the same finding machinery underpins the product and process audit defect-grading fields. Confirm NC classification thresholds with your certification body.
Frequently asked questions
What is an audit finding?
An audit finding is the result of evaluating audit evidence against the audit criteria. A finding can show conformity — the requirement is met — or non-conformity, where a requirement is not fulfilled, and it can also record an opportunity for improvement. Every finding ties a specific requirement or clause to the objective evidence the auditor observed, so it is a statement of fact rather than an opinion. Non-conforming findings are the ones that drive corrective action; conforming findings and good practices are recorded to give a balanced picture of the process.
What is the difference between a major and a minor non-conformity?
A major non-conformity is the absence or total breakdown of a required control, or a failure that affects the ability of the management system to achieve its intended results — for example, no procedure where the standard requires one, or a control that is systematically not followed. A minor non-conformity is an isolated lapse against a requirement that does not indicate a systemic breakdown — a single record missing from an otherwise sound process. Several minor non-conformities raised against the same requirement can together be judged a major, because collectively they point to a breakdown rather than a slip.
What is an observation or opportunity for improvement (OFI)?
An observation or opportunity for improvement is a finding that is not a non-conformity but flags a potential weakness or a way the process could be made more robust before it fails. There is no requirement being breached, so an OFI does not demand corrective action, but recording it lets the organisation act on early warning signs and drive continual improvement. Good programmes keep OFIs distinct from non-conformities so that genuine breaches are never diluted by suggestions, and improvement ideas are never lost.
What is a repeat or repetitive non-conformance?
A repeat, or repetitive, non-conformance is a finding that has been raised before against the same clause or process and has recurred despite earlier corrective action. It is one of the most important signals in an audit programme, because recurrence means the earlier root cause was never truly fixed. Flagging each finding as fresh or repetitive turns the audit programme into an early-warning system for ineffective corrective action and is often the trigger to escalate a finding into formal root-cause analysis.
How do you write a non-conformity statement?
A sound non-conformity statement has three parts. It states the requirement — the clause of the standard, the procedure or the customer requirement that applies; it states the objective evidence — the specific fact, record, observation or measurement that was seen; and it states the deficiency — how the evidence fails to meet the requirement. Written this way the finding is verifiable and cannot be argued away, and the auditee has everything needed to find the root cause and correct it. Vague statements that give only an opinion are the most common cause of disputed findings.
How does Fast Audit classify findings?
In Fast Audit each checklist answer carries a compliance verdict; anything other than fully complied, an opportunity for improvement, or not applicable is treated as a non-conformance. Each non-conforming answer records its clause number, a discrepancy or observation description, and an NC category that grades it major or minor, attributed to the auditee's area and the auditor. The NC summary report reads these back with a fresh-versus-repetitive flag and per-role closure status, so the whole non-conformance register is available per audit, type and period.