How to Improve Internal Audits - The Importance of Accurate Nonconformance Reporting in ISO and AS9100 Audits | My ISO Consultants
Updated: Sep 18
Accurate nonconformance reporting is one of the most important parts of an effective internal audit. A finding should clearly show what requirement applies, what objective evidence was observed, and how the evidence demonstrates that the requirement was not fulfilled. When a nonconformance is vague, subjective, or based on an auditor's preferred way of doing something rather than an actual requirement, it creates confusion and weakens confidence in the audit process.
For ISO 9001 and AS9100 organizations, strong nonconformance reporting helps management understand the real issue, assign appropriate corrective action, identify recurring problems, and improve the Quality Management System (QMS).
2026 Auditing Update
ISO 19011:2026 is now the current international guidance standard for auditing management systems. It defines audit findings as the result of evaluating collected audit evidence against audit criteria and recognizes that findings can indicate conformity or nonconformity. The basic principle remains important for both ISO 9001 and AS9100 audits: an auditor's conclusion should be traceable to verifiable evidence and an applicable requirement.
For aerospace certification audits, IAQG 9101:2022 also standardizes the audit and reporting process. Internal audits do not automatically require the same certification-audit forms, but the same discipline of clear, evidence-based reporting is valuable.
What Makes a Nonconformance Valid?
A well-written nonconformance should answer three basic questions:
What requirement was not met?
What objective evidence demonstrates the problem?
What is the specific statement of nonconformity?
The requirement may come from the applicable ISO or AS9100 standard, a customer or regulatory requirement, or the organization's own documented QMS requirements. The evidence should be factual and verifiable. The nonconformance statement should connect the evidence to the requirement without exaggeration or speculation.
1. When a Finding Is Questioned, Verify It Before Finalizing It
If a process owner challenges a proposed nonconformance and the issue is not immediately clear, do not turn the discussion into an argument. Recheck the requirement, review the evidence, and, when appropriate, consult an experienced lead auditor, consultant, technical expert, or senior quality professional before finalizing the finding.
A second review can help determine whether the finding is actually supported by the audit criteria or whether the issue is better treated as an observation, opportunity for improvement, or no finding at all.
2. Do Not Assume a Long-Certified Organization Cannot Have a New Nonconformance
An organization may have been certified for years and still develop a new gap, or a previous audit may simply not have sampled the same condition. Certification history should not be used to dismiss a legitimate finding.
At the same time, an unexpected finding in a mature system deserves careful verification. Make sure the requirement is explicit, the evidence is sufficient, and the finding is not based on a personal interpretation that goes beyond the audit criteria.
3. Do Not Create Documentation Requirements That Do Not Exist
One of the most common auditing problems is treating a preferred record or document as mandatory when the applicable requirement does not actually require it. Documentation can be excellent objective evidence, but auditors should distinguish between documented information that is specifically required and other forms of evidence that can demonstrate effective implementation.
For example, if a process is required to take action when performance targets are not achieved, the auditor should evaluate whether the required action occurred and whether the organization can demonstrate that it was effective. A separate corrective-action form should not be demanded unless the applicable standard, customer requirement, regulation, or organization's own QMS requires that specific documented information.
This does not mean records are optional whenever an organization can explain what happened. ISO and AS9100 contain specific documented-information requirements, and an organization's own procedures may create additional record requirements. The auditor should identify the actual requirement first and then evaluate whether the available evidence satisfies it.
4. Tie Every Nonconformance to an Applicable Requirement
A nonconformance should be grounded in the audit criteria. Cite the applicable clause, customer requirement, regulatory requirement, specification, procedure, work instruction, or other controlled requirement that was not fulfilled.
This makes the finding objective and defensible and gives the organization a clear basis for investigating the cause and determining corrective action.
5. Keep Personal Preferences Out of the Finding
Auditors should not write nonconformances because they would personally design the process differently. A better practice, a preferred form, or a more efficient method is not automatically a requirement.
When an auditor identifies a useful improvement that is not required, it may be appropriate to discuss it separately as an observation or opportunity for improvement, depending on the organization's audit process. It should not be presented as a nonconformance unless an applicable requirement has actually not been met.
6. Write the Finding So Management Can Act on It
A finding should be specific enough that someone who was not present during the audit can understand what happened. Avoid vague statements such as 'the process is ineffective' unless the report also explains the evidence that supports that conclusion.
Useful reporting identifies the requirement, the evidence reviewed, the condition observed, and the relationship between the evidence and the unmet requirement. That clarity makes root-cause analysis and corrective action more focused.
7. Do Not Prescribe the Corrective Action in the Nonconformance
The auditor's role is to identify and clearly report the nonconformance. Management and the responsible process owners should determine the correction, evaluate the cause, decide whether broader action is needed, and verify effectiveness.
An auditor can clarify the requirement and the evidence, but the finding should not be written in a way that forces the organization into the auditor's preferred solution.
Why Accurate Reporting Improves the Internal Audit Program
Consistent nonconformance reporting does more than improve individual audit reports. It makes it easier to track repeat findings, identify weak processes, evaluate corrective-action effectiveness, and provide management with useful information about the condition of the QMS.
Poorly written findings create the opposite effect. Teams spend time debating what the auditor meant, corrective actions may address the wrong issue, and recurring problems are harder to recognize.
Organizations that need a more objective review of their audit program or additional qualified audit capacity can use My ISO Consultants' professional internal auditing services to evaluate processes, identify defensible findings, and strengthen internal audit effectiveness.
Frequently Asked Questions
What should an ISO or AS9100 nonconformance report include?
A strong report should identify the applicable requirement, describe the objective evidence, and clearly state how the evidence demonstrates that the requirement was not met. The wording should be factual, specific, and understandable to someone who was not present during the audit.
Can an auditor write a nonconformance if the standard does not require a specific document or record?
Not simply because the auditor prefers to see one. The auditor should determine what the applicable requirement actually requires and whether objective evidence demonstrates conformity. However, if the standard, customer, regulator, or organization's own QMS requires documented information, the absence of that required information can support a nonconformance.
Can a company challenge an ISO or AS9100 audit finding?
Yes. An organization can ask the auditor to identify the requirement and evidence supporting the finding and can provide additional relevant evidence or context. For certification audits, the certification body's formal review or appeal process may also apply. A disagreement does not automatically make a finding invalid, but the finding should be traceable to objective evidence and applicable audit criteria.
What is the difference between a nonconformance and an opportunity for improvement?
A nonconformance means an applicable requirement has not been fulfilled. An opportunity for improvement identifies a potential way to strengthen performance or the management system when there is no demonstrated failure to meet a requirement. Keeping the two separate helps prevent recommendations or auditor preferences from being presented as mandatory.
Conclusion
Accurate nonconformance reporting protects the integrity of the internal audit process. When findings are based on applicable requirements, supported by objective evidence, and written clearly, organizations can spend less time debating the report and more time correcting real problems and improving the QMS.
If your organization needs help improving internal audit quality, validating difficult findings, or adding experienced audit support, My ISO Consultants provides internal auditing services for ISO 9001, AS9100, and other management system standards.
