After reading, you can write a finding nobody can dispute and get to the cause behind it.
Definition
ISO 19011 defines findings as the results of evaluating evidence against criteria, showing conformity, nonconformity or an opportunity for improvement. Internal audit practice often sets them out as criteria, condition, cause and consequence.
Why it matters
Management acts on what a finding makes clear. A vague finding gets disputed, and the action that comes out of it tends to treat the symptom.
How it works
State the criterion and the facts, with enough references for someone else to verify them, and keep your opinion out of it.
Explain the effect on the business and dig for the root cause, with the five whys or a similar method. Grade it on a scale defined beforehand.
Confirm the facts with the audited team. Agree a correction for the immediate problem, a corrective action for the cause, an owner and a date. Later on, verify that it worked.
A worked case
Criterion: laptop encryption, required by policy IS-04, section 3. Finding: 6 of 40 laptops sampled on 12 March are not encrypted, according to the device report. Effect: a lost laptop would expose customer data. Cause: devices bought locally bypass the IT setup. Grade: major.
The correction is to encrypt the six by 20 March. The corrective action is deeper: purchases go through IT from 30 April.
Good practices
- Write one finding per issue, so that each can close on its own.
- Grade by the effect on objectives. Ten trivial cases can matter less than one serious one.
- Discuss the facts before the report goes out, because surprises turn the audited team against you.
- Keep open findings visible to management until they close.
Common mistakes
- Naming a person as the cause. It ends the analysis too early and makes people defensive.
- Writing “improve the process” as an action.
- Mixing several subjects in one finding, which then never closes.
- Closing findings with no test of whether the fix worked.
Questions
- What is the difference between major and minor nonconformities?
- In certification, a major one affects the system's ability to reach its results, such as a requirement entirely missing. A minor one is an isolated failure.
- What is an audit observation?
- A point that is not a nonconformity but could become one, or could be improved. The wording varies with the audit scheme.
- What is the difference between a correction and a corrective action?
- A correction fixes the problem found. A corrective action removes its cause, so that it does not come back.
- Can the audited team disagree with a finding?
- Yes. They can challenge the facts, and ISO 19011 expects unresolved differences to be recorded.
- How long do you have to close a finding?
- The action plan sets the date. Certification bodies set their own limits for major nonconformities.