ISO Audit Group / Findings

The finding nobody wants to write

When the system conforms and does not work.

Occasionally an auditor concludes that everything is in place, the records are complete, and the system is achieving nothing: the risk assessments are performed and never inform a decision, the reviews occur and change nothing, the objectives are set and are not measured.

Writing that is harder than writing a conformity finding, because it is a judgement about management rather than about clerical performance, and it will be contested. It is also the most valuable thing the audit can produce.

The way to make it defensible is to ground it in the standard's own effectiveness requirements rather than in the auditor's opinion, and to evidence it the same way as any other finding: specific instances where the process ran and demonstrably informed nothing.

An opportunity for improvement is the usual softer route and it is frequently the wrong one, because it allows the finding to be noted and not addressed. Where a requirement genuinely is not met, that is a non-conformity.

This is the point at which the commercial pressure in certification auditing is felt most directly, and it is worth naming that plainly rather than pretending the incentive does not exist.

The other reason effectiveness findings are avoided is that they take longer to evidence, and audit time is fixed. An audit programme that wants them has to allocate time for them explicitly rather than hoping they emerge from a conformity sample.