ISO Audit Group / Findings

Write findings that can be acted on

Requirement, evidence, and why it matters.

A finding needs three parts: the requirement that was not met, the specific evidence, and enough detail that somebody who was not present can understand it in six months. Findings that cite a clause and assert non-conformity fail the third.

The evidence should be specific to the point of being checkable: which record, which date, which site. Vague findings are disputed, and the dispute is about the finding rather than about the problem.

It is worth stating why it matters, briefly. A finding that explains what could go wrong is acted on properly; one that reads as a technicality is closed with a technical response.

Findings should not prescribe the solution. Identifying the requirement and the gap is the auditor's role; deciding how to close it is the organisation's, and an auditor who specifies the remedy has taken on responsibility for whether it works.

Grading matters and should follow the actual criteria rather than the auditor's sense of severity. Inconsistent grading across audits is one of the fastest ways for an audit function to lose credibility internally.

There is a further discipline in writing findings, which is to avoid words that characterise. Describing a process as inadequate or poor invites a dispute about the adjective; describing what the requirement is and what was found does not, and it is harder to argue with.