# Anatomy of an Audit Finding

Every nonconformity has three parts. Without all three, the auditee cannot accept it, find the cause or close it.

| Part | Question it answers | Good practice |
|------|---------------------|---------------|
| **Requirement** | What should happen? | Clause number plus the requirement in short (ISO 9001, customer requirement, own procedure clause) |
| **Evidence** | What did you see? | Facts anyone can re-check: record IDs, revisions, dates, locations, quantities, sample size |
| **Statement** | What is the gap? | One sentence: the system did not meet the requirement. No cause, no solution, no names |

## Before -> after

**Calibration**
- Before: "Calibration is poor on the shop floor."
- After:
  - Requirement: ISO 9001 7.1.5.2 a) - measuring equipment calibrated at specified intervals against traceable standards.
  - Evidence: At lathe 4, micrometer M-112 was in use with calibration due 2026-08-01 (CAL-REG). 1 of 8 gauges sampled at the station was overdue.
  - Statement: Measuring equipment used for product acceptance was not always within its calibration interval.

**Contract review**
- Before: "Sales don't review orders. They should use a checklist."
- After:
  - Requirement: ISO 9001 8.2.3.1 - review requirements before committing to supply; QP-02 section 5.2 requires a signed review for orders over GBP 10k.
  - Evidence: Orders SO-4471, SO-4502 and SO-4519 (all over GBP 10k, Sept 2026) had no signed review; 3 of 6 sampled.
  - Statement: Orders were accepted without the review required by QP-02.

**Competence**
- Before: "Mr. Smith is not trained."
- After:
  - Requirement: ISO 9001 7.2 b), d) - ensure persons are competent; retain evidence.
  - Evidence: The CMM operator on night shift had no record of CMM training (competence matrix HR-05 rev C); CMM report CMM-2210 was signed by that operator.
  - Statement: Evidence of competence was not available for a person performing product verification.

## Rules

1. **Facts, not opinions.** Remove: poor, inadequate, sloppy, lack of commitment, I feel.
2. **System, not person.** Use roles; findings name processes, not culprits.
3. **No solutions.** The auditee owns root cause and action; the auditor verifies.
4. **Quantify.** "3 of 12 sampled records" lets the auditee judge extent and the auditor grade it.
5. **Re-checkable.** Another auditor should find the same thing from your evidence.
6. **Agree the facts** with the auditee at the closing meeting (the grade can be discussed; the facts should not be).

## Opportunity for improvement (OFI)

No requirement is broken. State the observation and the risk, keep it short, and let the auditee decide. OFIs
are where "consider", "could" and suggestions belong.