A finding is accepted when a stranger can read it, see which requirement was missed, see the evidence and agree. Most weak findings fail on one of those three. This is as true for internal audits that certification bodies later read as for the certification audit itself.
Last reviewed: 17 October 2026. Facts checked. This post describes common practice. We did not open ISO 19011, the standard for certification bodies or any body's reporting template, and we cannot say how a given body words or grades findings. The three-part structure is widely taught but not a required format. Examples are invented, and no clause numbers are quoted. Our earlier post on major versus minor nonconformities covers grading; this one is about writing.
What a certification body needs from a finding
Certification bodies review audit reports and decide on certificates. Reviewers are not at the audit. They need to see:
- What requirement applies, from the standard, the client's documented system, legal requirements or customer requirements the organisation has accepted.
- What evidence the auditor found: specific, verifiable, traceable.
- What conclusion follows: the requirement is not met, in what way.
Without all three, the client can reasonably dispute it, and the reviewer cannot defend it. Disputes consume the closing meeting and damage trust.
The three-part structure
1. Requirement. Refer to the clause of the standard or the organisation's own procedure. Use the wording as you understand it from the document you hold; avoid paraphrase that changes meaning.
2. Evidence. What was seen, heard or read. Include who, where, when and which record. Numbers and identifiers help: batch number, work order, record date, person's role.
3. Statement. One sentence that joins them: "The organisation did not X, as required by Y."
An example, invented: "Requirement: The organisation shall retain documented information as evidence of competence. Evidence: Of six welders listed on the project, training records could not be produced for two (named by role: welder 3 and welder 5). Statement: Evidence of competence was not retained for two of six welders sampled."
It is short and checkable. The auditee can look at the same list and agree or disagree on facts.
Write the evidence so it can be re-found
A good test: could another auditor, a year later, find the same record from your note? Include:
- The record title and identifier.
- The date range sampled.
- The location or system.
- The person's role, rather than a casual description like "a technician".
Avoid vague counts such as "several" or "some". If you checked eight and two failed, say so; the proportion helps the reader judge whether it is isolated or systemic.
Common mistakes
| Mistake | Why it fails | Better |
|---|---|---|
| Opinion words: "poor", "inadequate", "weak" | Cannot be verified | State what was missing |
| No requirement cited | Reader cannot see the rule | Name the clause or procedure |
| Several issues in one finding | Hard to close; fix one, argue about others | One requirement, one finding |
| Describing the cause as the finding | Auditor guesses reasons | State the gap; leave cause to the auditee's analysis |
| Prescribing the fix | Auditor becomes consultant | State what is not met, not how to fix it |
| Naming individuals | Turns a system issue into blame | Use roles |
| Mixing standards | Confuses which system failed | Separate by requirement source |
| "Not all..." with no number | Looks like a hunch | State the sample and the failures |
Separate fact from judgement
Findings are facts plus a comparison against a requirement. Judgement is allowed in grading severity and in deciding what to sample, but the evidence should stand on its own. Test each sentence: if two auditors would disagree about it, it is probably opinion.
Cause is the auditee's job
A common internal-audit habit is to write "due to lack of training" in the finding. If it was not tested, it is a guess. The auditee analyses cause as part of corrective action; see root cause analysis methods. If the cause is obvious and evidenced, you can note it separately, but keep the nonconformity statement about the gap.
Observations and opportunities
Not everything is a nonconformity. If a requirement is met but you see a risk that it might not be, record it as an observation or opportunity for improvement, if your system or the certification body uses that category. Be careful that observations are not nonconformities in disguise. If a requirement is clearly not met, say so.
Let the auditee confirm the facts
At the closing meeting, or sooner, read the evidence back to the auditee. Facts can be corrected on the spot: a record was elsewhere, a person was newly transferred. This is not negotiation of the conclusion, it is making sure the evidence is right. Agreement on facts reduces later disputes. If the auditee disagrees about the requirement, note it and let the certification body or audit programme manager decide.
Good and bad, side by side
Weak: "Calibration control is poor and equipment is not calibrated properly."
Stronger: "Requirement: measuring equipment used to verify product conformity shall be calibrated at specified intervals against traceable standards (organisation's calibration procedure, section on intervals). Evidence: Three of five gauges used at final inspection on Line 2 (IDs listed in the audit notes) showed calibration due dates before the audit date; the calibration register listed the same dates. Statement: Measuring equipment used for final inspection was used beyond its specified calibration interval."
The second is longer and far less arguable.
Speed matters
Write the finding while the evidence is fresh, ideally the same day. Details fade, and a finding assembled from memory a week later is the one that gets disputed.
Reviewing before release
Ask three questions of each finding: is the requirement cited, is the evidence specific and verifiable, does the statement follow? A second person reading it cold is the best test. For wider writing guidance, see writing audit observations with condition, criteria, cause and effect.
The takeaway
Requirement, evidence, statement. Keep it factual, specific and one issue at a time. A finding written this way is accepted because it is checkable, not because anyone was persuaded.
Last reviewed: 17 October 2026. Facts checked. Opened: nothing new for this post. Could not open: ISO 19011, ISO/IEC 17021-1 or any certification body's finding templates; the three-part structure is a widely taught convention, not a verified requirement of any body. Examples are invented.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error