Distinguishing Nonconformity from Opportunity for Improvement

Start With an Applicable Audit Criterion

A nonconformity is established against a requirement: A relevant standard clause, law, contract, approved procedure or another agreed audit criterion. An auditor who prefers a three step sign off has not identified a breach simply because the organization uses one step authorization. Determine what the criterion actually requires and whether the selected implementation can meet it.

Audit question

ISO 19011:2026 offers guidance on audit conduct and evidence based findings; it does not turn every audit suggestion into a normative requirement. ISO 9001:2026 is a relevant requirement source when quality management is in scope. Use current official publications and the organization’s agreed procedures, avoiding unsupported clause quotations.

A requirement must be identified at the correct time and scope. A procedure may have been revised after a transaction; a new standard edition may be published while a certification transition is still underway. An auditor must distinguish current source status from the criteria agreed for the audit and any applicable transition arrangements. Avoid calling a historical activity nonconforming against a requirement that did not yet apply.

Establish the Condition With Objective Evidence

State who, what, when and where: An inspection record was absent for one identified lot, a calibration check was overdue on a named instrument or an approval occurred after release contrary to a documented rule. Distinguish observed facts from an interview statement or an auditor inference.

Evidence to request

Evidence does not need to encompass every activity to demonstrate an individual breach, but the conclusion must not imply untested universal failure. Identify the sampling limits and verify that the criterion was in force at the time of the event.

The evidence statement should be reconstructable without naming or shaming individuals. A record identifier, decision timestamp, location, applicable criterion and relevant exception can be sufficient. If an employee explanation is the only source, seek corroboration before asserting the process condition. Clarify whether the staff member described personal practice or an organization wide arrangement.

• Describe actual evidence and the extent sampled.
• Separate factual breach from preference or prospective improvement.

Recognize Genuine Improvement Opportunities

An opportunity for improvement arises where existing arrangements meet applicable criteria but a better method could improve efficiency, reliability, resilience or clarity. For example, an auditee may run a fully compliant manual review that could benefit from clearer exception reporting. That is a recommendation, not an automatic finding of nonconformity.

Practical decision

Explain the value proposition and allow management to decide whether and how to act. Do not use an OFI category to obscure a known compliance failure. If the audit team cannot establish the condition, record an unresolved question or evidence limitation rather than disguising suspicion as an OFI.

An OFI is stronger when the auditor explains a plausible benefit and respects the owner’s discretion. For example, introducing trend review could help find recurring exceptions earlier, but may not be mandatory. Present the suggestion with its cost, complexity or data quality limitations if these matter, rather than describing every proposed improvement as obviously beneficial.

Avoid Premature Root Cause Claims

A clear nonconformity may exist even before its root cause is known. Auditors should describe the failed criterion and verified condition, then allow the responsible owner to investigate underlying causes. Declaring “staff are insufficiently trained” from one missing authorization form is an inference requiring further evidence.

Verification angle

Classification and corrective action design are related but separate decisions. Whether a finding is minor or major depends on the applicable internal scheme or certification body rules, not a generic severity formula invented for an internal audit.

When root cause is unclear, report the established condition first. A finding should not shift between nonconformity and OFI merely because the auditee proposes an appealing explanation. Conversely, a suspicious control design is not enough to establish a breach unless it fails an applicable criterion or the required outcome. Accurate separation protects both fairness and improvement.

Handle Ambiguous and Mixed Evidence

Sometimes different records give different accounts of whether a requirement was met. Preserve both sources and investigate provenance, operating context and timing before classification. Another possibility is a compliant control with poor performance indicators; investigate whether the required outcome or procedure was actually breached.

Interpretation boundary

A legitimate concern can be reported as an observation with a verification action when evidence is incomplete, provided the organization’s reporting conventions permit it. Explicitly avoid stating that uncertainty proves conformity or nonconformity.

Testing ambiguous evidence may be the proper next action. Obtain another transaction, check system history or clarify the requirement’s scope. If the audit window does not permit resolution, make the evidence limitation visible. Do not treat the option of recording an observation as permission to conceal an actual unmet legal or normative requirement.

• Quote or accurately identify the applicable audit criterion.
• Describe actual evidence and the extent sampled.

Write Distinctive, Usable Statements

For nonconformities, combine the criterion, observed evidence, condition and scope. For OFIs, describe the compliant baseline, the potential benefit and any evidence that supports the suggestion. Keep personal preferences out of both. Management should be able to reconstruct the decision without guessing which requirement the auditor had in mind.

Reporting discipline

Review wording with the auditee for factual accuracy while preserving auditor impartiality. A process owner may challenge the evidence or applicability; they should not control the classification solely by negotiation.

An actionable nonconformity names the unmet requirement and the evidence. An OFI names the opportunity and the potential advantage. Each can lead to management action, but only the former asserts non fulfilment of an applicable requirement. This distinction should remain consistent across auditor teams and audit cycles.

Illustrative Scenario: Manual Complaint Review

Illustrative scenario: A service team responds to complaints within its documented limits and retains records. The auditor suggests a dashboard to make emerging patterns more visible. Without another unmet criterion, the dashboard is an OFI.

Scenario analysis

In a separate sampled complaint, the team did not perform the escalation expressly required by its procedure. That case can support a nonconformity. The auditor must avoid grouping both issues under one label merely because they relate to the same complaint process.

Under the complaint example, the manual review could be fully appropriate if required response and analysis controls are performed. A dashboard would then be an optional design choice. Failing the procedure’s required escalation is separate and is not excused because the same process has other opportunities for efficiency.

Closing Perspective

Clear classification protects both compliance accountability and the constructive space for voluntary improvement.

For the next audit cycle, make the selected control, evidence boundary, decision owner and follow up trigger visible in the working papers. An audit programme earns trust by making its reasoning reviewable and by allowing verified contrary evidence to change the conclusion.