ISO 9001 Lead Auditor Training

Module 6 Conducting On-site Activities

6.1.5.4  Recording Nonconformities
As the audit proceeds, there might arise situations where the facts indicate there is a failure, either partially or wholly, of the quality management system. This is called many names in auditing. For the purposes of consistency in these notes, such a situation is called “a nonconformity”.

Examples of requirements:
• Conditions of contract
• ISO 9001 standard
• QMS documentation
• Regulatory and industry

There may be nonconformity for one of three reasons:

1. the procedure or defined process does not conform to ISO 9001 requirements
2. the procedure or process has not been put into practice in the described way
3. the practice, what is actually done, is not effective (planned results not achieved).

ISO 9001 Auditor Training - Many situations arise during an audit with the potential to become nonconformities. As soon as the facts are indicative of nonconformity, the auditors should immediately voice their thoughts to the departmental representative. This is certainly not a cause for rejoicing, but total openness from auditors will encourage the same from the auditee.

It is essential that both parties fully understand the problem and how serious it is. Auditors will often need a little help from the auditee to do that. Once the facts of the matter are established, they should be written down by the auditor and agreed to by the auditee.

It is generally not good practice to complete the form during the interview, as it might break the flow of the interview, as well as, to avoid rushing the writing of the nonconformity statement. The auditee should agree with the facts at this point (and certainly before the auditors leave the area for another part of the audit).

ISO 9000 Training - The statement of nonconformity needs to be in a format understandable both to people in the audit and to those who were not. People who were not present at the audit will often be assigned to take the necessary corrective action. This need alone defines some rules for the recording of nonconformities:

Exact observation of the facts. Only the facts are needed and the reporting of them needs to be exact.

Where was it found? The statement needs to identify exactly where it was found, otherwise it may not be found again.

What was found? It needs to be clear so that people understand what aspect of the system is nonconforming.

Why it is a nonconformity? The statement needs to make it clear what specified requirement has not been met.

What is the objective evidence of the nonconformity?  What audit evidence do we have - records, documents, statements or observations for our nonconformity findings.

Who was involved? The statement often has no need to involve specific people, but where the objective evidence was based on a statement, then the statement and the originator(s) need to be clear. Job titles rather than names should be used.

Use local terminology. Industry has its own names for certain activities, documents, etc.  These unique terms should be used for clarity.

Make it retrievable. Someone has to go back after the audit and put it right, possibly after a considerable period of time.

Make it helpful. To be helpful, nonconformity statements should be complete, correct, concise and clear. Suggestions, particularly on external audits, are not recommended, nor are they the auditor’s duty. Some examples of typical nonconformities will allow at least some of the above points to be made, assuming these are from audits to ISO 9001.

Example 1
Requirement: Procedure OPT869 requires that all system specifications be under configuration control and included in the CON master list.

Finding: System Specification ISS420 is not included in the CON master list for Contract 946x90 and there is no procedure to ensure its current issue status is known.

ISO 9001 Auditor Training - This example is factual, the evidence can be found again, and it is clear that it is a nonconformity. It is obvious to put this right at least two aspects need to be considered.
There are two reasons why it is nonconformity. First, the specification should be in the master list, so that is a lack of implementation of a procedure. Second, there is no method to know its issue status, so this is a lack of a system for document and data control.
It violated two specified requirements: the procedure (OPT869) and, therefore, ISO 9001.
A further purely practical consideration is that of brevity. The nonconformities have to be prepared during the audit (written down) and presented in the review sessions and at the closing meeting.  It can aid effective understanding if they are kept as short as practical.

"Understanding ISO 9001" provides a detailed explanation of each ISO 9001 clause (requirements).

ISO 9001 FAQ provides answers to commonly asked questions about the ISO 9000 family of quality management standards.