Every internal auditor has watched it happen: the audit closing meeting turns into a negotiation. The process owner disputes the finding, the auditor defends it, and the conversation drifts away from the actual problem. Almost every time, the root cause is the same — the nonconformity was written in a way that invited argument.
The three-part structure
A defensible nonconformity has exactly three parts, and each one has a job.
1. The requirement. Quote or precisely reference what the standard, procedure, or customer requirement says. Not your interpretation of it — the requirement itself. If you cannot point to a requirement, you do not have a nonconformity; you may have an opportunity for improvement, which is a different animal.
2. The objective evidence. State exactly what you observed: the record you examined, the interview response, the condition on the floor. Include identifiers — document numbers, dates, part numbers, work order numbers. Evidence with identifiers cannot be argued with; vague evidence always can.
3. The statement of nonconformity. One sentence connecting the two: the evidence shows the requirement was not met. Resist the urge to editorialize, speculate about causes, or prescribe solutions.
What to leave out
The most common mistake is embedding the corrective action in the finding — “the procedure should be revised to…” The moment you prescribe the fix, you have taken ownership of the problem away from the process owner, and you have compromised your independence for the follow-up audit.
The second most common mistake is stacking multiple issues into one finding. One requirement, one body of evidence, one statement. If you found three problems, write three findings — they will each get their own corrective action and their own effectiveness verification.
A quick test before you issue it
Read the draft and ask: could a person who was not on the audit reproduce my conclusion from what is written here? If they would need to ask you a question first, the evidence section is not specific enough yet.
Findings written this way close faster, because the corrective action team spends its energy on root cause instead of relitigating the audit. That is the entire point of the internal audit program — findings that make the system better, not paperwork that survives the certification body’s sampling.
ZLG trains internal auditors and lead auditors for ISO 9001, ISO 13485, AS9100, and IATF 16949, and provides independent internal auditing services. If your findings keep bouncing back, our auditor programs address exactly this.