An ISO 9001 nonconformity example is useful when it shows how an unmet requirement is established through evidence. Copying a sample finding without checking the actual criterion and circumstances can produce an inaccurate report or a poorly targeted response.
The external audit guide explains the assessment context. Every case below is fictional and independently written. The examples do not reproduce standard clauses, assign universal grades or determine conformity for a real organisation.
Example: obsolete instructions at the point of use
A workshop’s adopted document-control procedure requires current approved instructions at workstations. During an audit, an operator uses Revision 2 of an instruction although Revision 4 is the current approved version and includes a changed acceptance check.
The finding needs the procedure reference, the instruction identity, the observed version and relevant evidence of its use. Merely stating bad document control leaves the process owner guessing. The response should consider affected work and how obsolete instructions remained accessible.
Replacing the copy is a correction. Investigating distribution, access and withdrawal arrangements addresses the cause. Do not assume that reminding the operator is sufficient if the system itself supplies the obsolete version.
Example: release before required authorisation
A distributor’s own release procedure requires approval before dispatch. Two selected orders were dispatched before that approval. The auditor checks record timing and confirms that an alternative authorised route did not apply.
The finding can identify the adopted requirement and the affected records. Further enquiry may establish whether a software bypass or unclear authority affected other work. Do not claim that all dispatches are uncontrolled solely from two examples.
An appropriate response may include assessment of delivered items, investigation of the bypass and changes to the release mechanism. The chosen action needs a reasoned connection to the supported cause.
Example: competence evidence does not fit the task
A service company assigns a specialist activity using competence criteria established in its own process. The person has a general attendance certificate, but the required task evaluation has not been completed and observed work reveals an unresolved capability gap.
The issue is not that a particular commercial course was absent. The finding should connect the task criteria, assignment and relevant evidence. Another organisation could demonstrate suitable capability through a different justified combination of training, experience and evaluation.
Consider supervision and affected work immediately where the consequence warrants it. Cause investigation can examine why assignment controls allowed the gap rather than assuming that another generic training session will resolve it.
Example: a corrective action is closed without support
A previous finding concerned changed customer requirements not reaching operations. The action record states that staff were reminded and marks the issue complete. Later sampled changed orders show the same communication failure.
The auditor needs to evaluate applicable response requirements and the actual evidence. Recurrence can indicate that the original action did not address the cause or was not implemented effectively. The report should describe that relationship rather than simply accuse management of not caring.
The organisation should review its extent assessment, cause reasoning, selected action and effectiveness criteria. Repeating the same reminder may leave the original mechanism unchanged.
Distinguish a finding from a preferred method
| Situation | Why further evaluation matters |
|---|---|
| No quality manual | Determine what information is actually required and controlled |
| No numerical risk matrix | Examine how relevant risks are considered and addressed |
| Different document numbering | Evaluate identification and control, not aesthetic preference |
| No course from a named provider | Assess relevant competence criteria and evidence |
These absences do not automatically establish nonconformity. The organisation’s own adopted arrangements or other applicable obligations may change the evaluation, so the criterion must be identified.
The major and minor comparison explains why grading depends on system effect and context rather than the label attached to an example.
Write and use examples responsibly
For a real finding, replace every fictional assumption with verified information. Identify the current criterion, relevant records, observation and demonstrated gap. Keep scope limitations visible and avoid collecting unnecessary confidential details.
Examples can also support employee learning. Ask participants which requirement applies, what evidence is missing and what further enquiry is needed. This is more useful than memorising a list of supposedly automatic failures.
When responding, separate immediate correction from action addressing cause. Confirm the certification body’s submission and review arrangements. A clear example helps explain the reasoning, but the real response must be grounded in the organisation’s actual process and evidence.
If an example is reused in training, label it as fictional and remove any suggestion that its classification is predetermined. Ask learners to identify what additional facts could change the evaluation. A required approval may be evidenced in another controlled system, for instance, while an apparently isolated missing entry may reveal a much wider control gap after investigation.
For example-based learning, compare two superficially similar cases with different criteria. A missing signature might be immaterial where another authorised record demonstrates the decision, but consequential where the signature is the only adopted release authorisation and no approval occurred. The comparison helps prevent automatic findings based only on appearance.