ISO 9001 Lead Auditor Training

Module 6 Conducting On-site Activities

6.1.5.4 Recording Nonconformities
As the audit proceeds, there might arise situations where the facts indicate there is a
failure, either partially or wholly, of the quality management system. This is called many
names in auditing. For the purposes of consistency in these notes, such a situation is called
a nonconformity.
What is nonconformity?
a condition adverse to Quality
the non-fulfillment of a requirement
Examples of requirements:
Conditions of contract
ISO 9001 standard
QMS documentation
Regulatory and industry
There may be nonconformity for one of three reasons:
1. the procedure or defined process does not conform to ISO 9001 requirements
2. the procedure or process has not been put into practice in the described way
3. the practice, what is actually done, is not effective (planned results not achieved).
ISO 9001 Auditor Training - Many situations arise during an audit with the potential to
become nonconformities. As soon as the facts are indicative of nonconformity, the auditors
should immediately voice their thoughts to the departmental representative. This is certainly
not a cause for rejoicing, but total openness from auditors will encourage the same from the
auditee.
It is essential that both parties fully understand the problem and how serious it is. Auditors
will often need a little help from the auditee to do that. Once the facts of the matter are
established, they should be written down by the auditor and agreed to by the auditee.
It is generally not good practice to complete the form during the interview, as it might break
the flow of the interview, as well as, to avoid rushing the writing of the nonconformity
statement. The auditee should agree with the facts at this point (and certainly before the
auditors leave the area for another part of the audit).
ISO 9000 Training - The statement of nonconformity needs to be in a format understandable
both to people in the audit and to those who were not. People who were not present at the
audit will often be assigned to take the necessary corrective action. This need alone defines
some rules for the recording of nonconformities:
Exact observation of the facts. Only the facts are needed and the reporting of them
needs to be exact.

Where was it found? The statement needs to identify exactly where it was found,
otherwise it may not be found again.
What was found? It needs to be clear so that people understand what aspect of the
system is nonconforming.
Why it is a nonconformity? The statement needs to make it clear what specified
requirement has not been met.
What is the objective evidence of the nonconformity? What audit evidence do we
have - records, documents, statements or observations for our nonconformity findings.
Who was involved? The statement often has no need to involve specific people, but where
the objective evidence was based on a statement, then the statement and the originator(s)
need to be clear. Job titles rather than names should be used.
Use local terminology. Industry has its own names for certain activities, documents, etc.
These unique terms should be used for clarity.
Make it retrievable. Someone has to go back after the audit and put it right, possibly after
a considerable period of time.
Make it helpful. To be helpful, nonconformity statements should be complete, correct,
concise and clear. Suggestions, particularly on external audits, are not recommended, nor
are they the auditors duty. Some examples of typical nonconformities will allow at least
some of the above points to be made, assuming these are from audits to ISO 9001.
Example 1
Requirement: Procedure OPT869 requires that all system specifications be under
configuration control and included in the CON master list.
Finding: System Specification ISS420 is not included in the CON master list for Contract
946x90 and there is no procedure to ensure its current issue status is known.
ISO 9001 Auditor Training - This example is factual, the evidence can be found again, and it
is clear that it is a nonconformity. It is obvious to put this right at least two aspects need to
be considered.
There are two reasons why it is nonconformity. First, the specification should be in the
master list, so that is a lack of implementation of a procedure. Second, there is no method
to know its issue status, so this is a lack of a system for document and data control.
It violated two specified requirements: the procedure (OPT869) and, therefore, ISO 9001.
A further purely practical consideration is that of brevity. The nonconformities have to be
prepared during the audit (written down) and presented in the review sessions and at the
closing meeting. It can aid effective understanding if they are kept as short as practical.