An internal audit nonconformity identifies a requirement that was not met, supported by relevant evidence. A useful example shows the criterion, the sampled facts and the resulting gap without inventing a cause or prescribing an unsupported solution.
The internal audit guide explains the full process. The guide to identifying findings explains the reasoning. Every scenario below is fictional. Its internal instructions illustrate possible audit criteria, not universal ISO wording or legal requirements.
Example one: a required review was not performed
A fictional workshop’s approved change process requires an environmental review before introducing a new cleaning material. The auditor selects three recent introductions and traces requests, approvals and operating information.
For one identified introduction, purchasing and use began without the required review. Relevant staff confirm that no alternative approved assessment occurred. The evidence therefore supports a finding about implementation of the workshop’s established change process.
A clear statement identifies the instruction, the specific introduction and the missing review. It does not say that the material was necessarily unlawful or that environmental harm occurred. Those conclusions would need separate criteria and evidence.
The finding should not prescribe a particular software tool. The organisation needs to correct the issue, examine its extent and investigate why the handover failed. The cause might involve unclear responsibility or an approval route that bypasses the review.
Example two: a defined inspection arrangement is unreliable
A fictional depot requires a designated storage check at a frequency set in its own approved instruction. Sampled records for a defined period contain gaps, and corroborating enquiries establish that the relevant checks were not completed.
The supported issue is failure to implement that arrangement. Identify the sampled period and records, rather than using broad language such as inspections never occur.
A record gap alone may initially be ambiguous. The check might have occurred without the required record, which could be a different finding. The assessor needs to investigate before deciding what the evidence establishes.
The consequence also needs care. Missing checks can reduce confidence in control, but do not automatically prove that every stored item was defective or that a release reached a receptor. Report the system gap accurately and identify any additional observed condition separately.
Example three: corrective-action closure lacks the defined verification
A fictional organisation’s response process requires effectiveness verification before closing certain actions. The auditor samples an action concerning recurring delivery-handling errors.
The tracker shows closed, but the required verification was not performed. Relevant records and enquiries support that conclusion. The finding can identify the gap between the established closure arrangement and the sampled action.
Do not assume that the action itself was ineffective merely because verification is missing. It may have worked, but the organisation did not carry out the evaluation it required. Further assessment can determine the actual result.
The response should examine why closure occurred without verification and whether similar actions are affected. Adding a retrospective tick without a genuine check would not address the underlying issue.
Example four: an unsupported preference is not a finding
An auditor prefers a separate environmental manual. The organisation instead maintains connected procedures, records and process information through a digital system.
The absence of the preferred document title does not automatically establish nonconformity. The assessor must identify an applicable requirement and examine whether the actual information meets the relevant need.
If staff cannot access a necessary current instruction, that may support a finding against a valid control or information criterion. The issue is the established gap, not the fact that the organisation uses a different document structure.
This distinction prevents audit reports from becoming purchasing lists for the assessor’s preferred templates. Improvement suggestions can still be discussed, provided their status is clear.
Compare the examples before writing your own
| Element | What the finding needs |
|---|---|
| Criterion | An applicable requirement or established arrangement |
| Evidence | Identifiable facts relevant to that criterion |
| Gap | A clear explanation of what was not met |
| Boundary | Scope and sampling limits that affect the conclusion |
Cause, wider extent and suitable action may need further investigation. Do not hide those uncertainties by writing a confident but unsupported diagnosis.
Check versions and timing. A record from before a revised instruction took effect should not automatically be assessed against the later arrangement. Conversely, an obsolete instruction still used after change can raise a different information-control question.
Use examples as diagnostic aids
Adapt the reasoning, not the fictional facts. A copied finding can misdescribe the local activity or cite a requirement that does not apply.
Discuss material facts with relevant people and resolve misunderstandings through evidence. Keep supported findings even where they are uncomfortable, while correcting conclusions the evidence does not sustain.
Before issue, ask whether another competent reader can identify the criterion, facts and gap. Then ensure the finding reaches the people responsible for correction, cause investigation and verification. The example is useful only when it improves the accuracy and fairness of that decision chain.
If the organisation grades findings, use its defined criteria and explain the judgement. None of these fictional examples establishes a universal major or minor classification. Classification depends on the applicable system, evidence and context, and should not be copied from an example without evaluation.