A nonconformity is the non-fulfilment of a requirement. The requirement may be a clause of a standard, a legal regulation, a customer condition or the organization’s own procedure.
How is a good finding written?
A usable nonconformity statement contains three components:
- Requirement: What the clause or document says
- Evidence: What was observed on site, which record was examined
- Deviation: The difference between the two
“Calibration tracking appears to be inadequate” is not a finding; it is an impression. The audited department does not know what to do with it, and no corrective action can be raised.
The difference between correction and corrective action
Correction is eliminating the detected deviation: for instance, sending an out-of-calibration instrument for calibration.
Corrective action is the system change that will prevent the deviation from recurring: adding an alert to the tracking system, defining responsibility, updating the procedure.
Findings closed with a correction only are reopened at the next internal audit.
Who is responsible for the root cause?
Root cause analysis is the responsibility of the audited department. The auditor identifies what is nonconforming; finding and eliminating the cause is the process owner’s job.
Finding writing is an auditor skill independent of the standard. Constructing, classifying and reporting nonconformity statements is practised on sample scenarios in the ISO 19011 training. To audit against the clauses of a specific standard, you also need to take the training for that standard.