Three parts
- Requirement: which clause, which law, which internal procedure is breached?
- Evidence: what was seen? Which record, which date, which person, which field observation.
- Deviation: the gap between evidence and requirement, in one sentence.
A poor finding: “Training records are inadequate.” A good one: “ISO 45001 clause 7.2 requires competence records to be retained; the attendance record for the work-at-height training of 12 March lacks the signatures of three workers, and those three carried out the same task on 4 April.”
Why the fix is not part of the finding
If the auditor writes the fix, two things follow: the auditee does not own it, and at the next audit the auditor is auditing their own suggestion. Independence applies here too. The auditor states what is wrong; the process owner decides what to do.
Findings are shared at the closing meeting
Findings are stated verbally before they are written up, so misunderstandings are corrected there. A finding first heard at the closing meeting is not a surprise — but a finding first seen in the report is a problem with the audit, not the system.
Positive findings are written too
A practice that works well and is never recorded can be quietly removed at the next reorganisation. “This works, keep it” is also an audit output.