What this is
What is an audit finding record?
What is an audit finding record?
An audit finding record documents a single nonconformance identified during an internal, external, regulatory or customer audit: the requirement it breaches, the objective evidence, its grade, whether the auditee agreed, and the response and closure that follow. It is built against ISO 19011 cl.6.4.
Who completes an audit finding record?
The auditor, at the point the nonconformance is identified during the audit. The requirement, evidence and grade should be agreed with the auditee before the audit closes, which is why the record carries its own field for that agreement.
How is this different from the generic Finding record?
The generic Finding record (FDN-015) can be raised from almost any check. This one is specific to formal, certifiable audits: it adds the management system standard, the auditee's agreement to the grade, a systemic-versus-isolated judgement, and a full corrective-action and effectiveness workflow that the generic record does not carry.
Scope
When is an audit finding record required?
This record belongs to a formal audit against a named management system standard. Using it for a routine inspection finding, with no standard, no auditee agreement step and no certification stake, adds machinery that finding does not need.
Use this template when
- An internal, external, regulatory or customer audit against a named management system standard has identified a gap between the requirement and the evidence
- The audit programme requires a graded finding, agreed or disputed with the auditee, before the audit closes
- The finding needs an extent-of-condition judgement because it may be systemic rather than confined to the area audited
- A previous finding is being reopened or escalated because an earlier closure did not hold
- Certification or recertification readiness depends on this finding being tracked to a verified, effective closure
Do not use it for
- Finding (FDN-015), for a deficiency from a routine inspection, checklist or informal check with no named management system standard behind it
- Internal Audit Report, which records the audit as a whole; this record holds one nonconformance within it
- Root Cause Analysis, once Root Cause Analysis Required is answered Yes; the finding links to it rather than performing the analysis itself
- Corrective and Preventive Action, for the action plan itself; this record links to the CAPA rather than containing it
- Recording a grade as agreed when the auditee actually disputed it, which removes their right of reply from the record
Compliance mapping
Which ISO 19011 cl.6.4 requirements does this satisfy?
ISO 19011 cl.6.4 sets out how audit evidence is collected, evaluated against criteria and turned into findings, and cl.6.6 covers the follow-up that confirms a correction actually worked. This record is built around that sequence end to end.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 19011 cl.6.4 | Audit evidence collected against defined criteria, traceable to source and management system standard | Header |
| ISO 19011 cl.6.4.9 | Findings generated by evaluating evidence against the audit criteria, with the requirement and evidence both stated | The finding |
| ISO 19011 cl.6.4.9 | Findings reviewed with the auditee before the audit closes | The finding |
| ISO 19011 cl.6.4.10 | Audit conclusions consider whether findings indicate a systemic issue beyond the area sampled | Extent |
| ISO 19011 cl.6.4 | Response to findings planned with an owner and a due date | The finding |
| ISO 19011 cl.6.6 | Follow-up conducted to verify correction, root cause action and their effectiveness | Response |
| ISO 19011 cl.6.6 | Closure confirmed with evidence of completion and effectiveness, not correction alone | Closure |
What it does not cover
- Finding (FDN-015), which is the right record when the deficiency comes from a routine check rather than a formal audit against a named standard.
- Internal Audit Report, which records the audit's overall scope, coverage and outcome; the finding is one entry within it.
- Root Cause Analysis, which this record links to via RCA ID rather than performs, once a systemic or repeat pattern calls for one.
- Corrective and Preventive Action, which plans and tracks the fix itself; this record carries the CAPA ID reference, not the action plan.
- Extent of Condition Review, which is the dedicated record for examining whether a systemic finding exists elsewhere, referenced here by ID rather than duplicated.
Global
Audit Finding Record requirements by country
The duty to audit at all is usually contractual or certification-driven rather than statutory. What varies is how much weight a regulator or certification body gives to how findings were graded, agreed and closed.
Customer and certification-body audit schemes; OSH Act General Duty Clause for underlying hazards
No general statute governs finding format, but an audit finding describing a recognised hazard left open carries its own exposure regardless of certification status.
A finding closed on paper without effectiveness evidence does not answer a regulator asking whether the underlying hazard was actually addressed.
UKAS-accredited certification bodies applying ISO 19011 and the relevant management system standard
Certification bodies expect major nonconformances to block certification until closed and verified, with minor findings tracked to the next surveillance visit.
A disputed grade recorded as agreed, or a major finding closed without a second signature, is exactly what a surveillance auditor tests for.
ISO 19011; scheme-specific rules under ISO 45001, ISO 14001, ISO 9001, BRCGS, SQF and FSSC 22000
ISO 19011 provides the common method; each scheme sets its own grading language and closure timescales on top of it.
The record's Management System Standard field exists because grading language and closure expectations differ by scheme even where the audit method is the same.
How to complete it
How to complete an audit finding record, step by step
Most audit finding records get the requirement and evidence right, because the audit forces that conversation in the room. What slips is everything that happens after the auditor leaves: the agreement step, the extent judgement, and the difference between correction and effectiveness.
The form's own guidance draws this line. Requirement Breached names the rule, standard or procedure; Objective Evidence is what was seen or documented that proves the gap. A record with only one of the two reads as an opinion rather than a nonconformance.
Grade Agreed With Auditee is not a formality field. An auditee who disputes the grade in the room and finds the record shows Agreed later has lost the chance to have that dispute on file, which matters if the finding is escalated during certification review.
Marking a finding isolated when the same gap plausibly exists elsewhere understates what the audit found. Systemic and possibly-systemic answers should trigger an Extent of Condition Review rather than being closed as a single-instance fix, because closing the instance does not close the pattern.
Evidence Of Completion shows the immediate fix happened. Effectiveness Checked asks a different question: did it hold. A finding closed on completion evidence alone, with Effectiveness Checked left at Scheduled or No, is not actually closed.
What auditors find
Most common audit finding record findings
Because this record sits inside a certification-facing programme, its recurring problems are less about missing description and more about the audit-specific steps: agreement, extent, and effectiveness.
| Finding | Clause | What fixes it |
|---|---|---|
| Requirement Breached or Objective Evidence stated too vaguely to distinguish a finding from an observation. | ISO 19011 cl.6.4.9 | Require both fields to name the specific clause and evidence, per the form's own guidance. |
| Grade Agreed With Auditee recorded as Yes when the auditee disputed it during the audit. | ISO 19011 cl.6.4.9 | Record Disputed accurately and capture the auditee's reasoning; do not soften a disputed grade to agreed after the fact. |
| Systemic Or Isolated marked Isolated without checking whether the same gap exists in other areas or shifts. | ISO 19011 cl.6.4.10 | Route possibly-systemic and systemic findings to an Extent of Condition Review before closure. |
| Repeat Of Previous Finding marked No without checking the previous finding register at the same site. | ISO 19011 cl.6.6 | Search prior findings by site and area before answering; escalate genuine repeats rather than reissuing the same grade. |
| Closed as Yes with Effectiveness Checked left at No or Scheduled. | ISO 19011 cl.6.6 | Block closure until effectiveness is checked and recorded, not merely correction. |
| Verified By and the second signature completed by the same person who owns the corrective action. | ISO 19011 cl.6.6 | Require an independent verifier and auditor signature separate from the action owner before closure. |
Case in point
Case in point: the finding agreed twice and closed once
An internal ISO 9001 audit found that incoming inspection records for a supplier were incomplete, graded Minor, and recorded as agreed with the auditee. In the closing meeting the auditee had actually pushed back, arguing the gap was a one-off, but the disagreement was never written into the record because the finding was already marked agreed beforehand.
The corrective action closed on a completion evidence check: the missing records had been backfilled. Effectiveness Checked was left as Scheduled and never revisited. Six months later the same gap reappeared, graded again as a fresh Minor rather than recognised as a repeat, because Repeat Of Previous Finding had not been checked against the earlier, never-verified record.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
5 sections
- Reference
- CMP-004
- Archetype
- Record
- Record ID
- FND-2026-000
- Scoring
- Severity classification
- Direction
- High is good
- Singleton
- No
- Basis
- ISO 19011 cl.6.4
- Links
- Links Audit, Clause; feeds CAPA
- Tags
- Audit, Finding
- Sections
- 5
- Fields
- 50
- Follow up fields
- 3
- Repeating sections
- 0
- Links out
- 6
Header
13 fieldsFinding ID*
Auto sequence. Format FND-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date and Time*
Completed By*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Source*
Internal audit, external audit, regulator, customer audit, inspection or self identified.
Source Record ID
Immediate predecessor record
Raised By*
Management System Standard*
ISO 45001, ISO 14001, ISO 9001, ISO 50001, BRCGS, SQF, FSSC 22000 or an internal standard.
Clause Or Requirement
Clause ID
Links to FDN-009 Clause ID
State The Requirement, The Evidence, The Gap
A finding that only says what somebody saw is an observation. A finding names the requirement it breaches and the evidence that proves it.
The finding
8 fieldsRequirement Breached*
Objective Evidence*
Grade*
- Critical0 pts
- Major1 pt
- Minor2 pts
- Observation3 pts
- Opportunity for improvement3 pts
Grading Rationale
Grade Agreed With Auditee*
- Yes3 pts
- Disputed1 pt
- No0 pts
Area Or Process*
Owner Assigned*
Response Due Date*
Extent
6 fieldsSystemic Or Isolated*
- Isolated2 pts
- Possibly systemic1 pt
- Systemic0 pts
Other Areas Likely Affected*
- No3 pts
- Possibly1 pt
- Yes0 pts
Extent Of Condition ID
Links to FDN-018 Review ID
Repeat Of Previous Finding*
A repeat finding means the earlier closure was cosmetic. Escalate rather than reissuing the same action.
- No3 pts
- Yes0 pts
Previous Finding Reference
Escalated
Response
11 fieldsCorrection Made
What was done immediately to fix the specific instance. Not the same as the corrective action.
Root Cause Analysis Required*
RCA ID
Links to FDN-013 RCA ID
Root Cause Identified
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Response Received On Time
- Yes3 pts
- Late1 pt
- No0 pts
Response Accepted
- Yes3 pts
- With clarification2 pts
- Rejected0 pts
Reason If Rejected
Closure
12 fieldsEvidence Of Completion*
- Yes3 pts
- Partly1 pt
- No0 pts
Verified By
Verification Method
- Site visit4 pts
- Record review3 pts
- Photograph2 pts
- Statement only0 pts
Effectiveness Checked*
- Yes3 pts
- Scheduled1 pt
- No0 pts
Effectiveness ID
Links to FDN-016 Verification ID
Closed*
- Yes3 pts
- Partly1 pt
- No0 pts
Days Open
Closed Within Target
- Yes3 pts
- Late1 pt
- No0 pts
Owner*
Signature*
Auditor*
Second Signature*
CMP-004 · record IDs look like FND-2026-000 · Links Audit, Clause; feeds CAPA
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The audit itself produces a good record. What slips afterwards is the agreement step, the extent judgement, and the gap between a correction and a checked effectiveness.
Holds the finding register against the audit programme, flags disputed grades recorded as agreed, and surfaces findings closed without an effectiveness check.
Cross-checks new findings against the open register by site and area, and raises a likely repeat before Repeat Of Previous Finding is answered.
Routes systemic findings to an extent-of-condition review, tracked against this record's Extent Of Condition ID.
This template lives in KnowComply — audit and governance. Audit programmes, legal register, management review, risk and certification.
Meet KnowComply→Glossary
Audit Finding Record definitions and key terms
- Objective evidence
- Information that can be verified, used to prove that a requirement was breached; distinct from an observation, which states only what was seen.
- Grade
- The classification of a finding from Critical or Major down to Observation or Opportunity for Improvement, driving how urgently a response is required.
- Systemic
- A finding likely to recur in other areas or shifts, rather than confined to the specific instance observed, which calls for an extent-of-condition review.
- Effectiveness check
- Confirmation that a corrective action actually resolved the underlying cause, checked separately from confirmation that the immediate correction was made.
- Extent of condition
- A review of whether a systemic finding exists elsewhere in the organisation beyond the area where it was first observed.
FAQ
Frequently asked questions about audit finding record
What makes a record a finding rather than an observation?+
Naming the requirement breached and producing objective evidence that proves the breach. A record that only states what was seen, with no requirement named, is an observation or opportunity for improvement, not a nonconformance.
What happens if the auditee disagrees with the grade?+
Grade Agreed With Auditee should be recorded as Disputed, with the reasoning captured. Recording a disputed grade as agreed removes the auditee's position and weakens the record if the finding is ever escalated.
Why does the record ask whether the finding is systemic?+
Because closing one instance does not close a pattern. A systemic or possibly-systemic answer should trigger an Extent of Condition Review, rather than treating every finding as a one-off.
Is completion evidence enough to close a finding?+
No. Evidence Of Completion shows the immediate fix happened; Effectiveness Checked confirms it held. Closure should not proceed on completion evidence alone.
Who should sign at closure?+
A verifier separate from the corrective action owner, plus the auditor's second signature, so closure is not self-certified by the person who did the work.
When should Root Cause Analysis Required be answered Yes?+
Whenever the finding is graded Major or above, marked systemic, or a repeat, since correction alone will not prevent recurrence without understanding why the gap occurred.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Lockout and Tagout
A defensible energy control programme with a procedure per machine, group lockout, lock removal and yearly verification.
Internal Audit and Certification
Findings closed on root cause rather than on correction, and readiness held every day.
Daily Management System
Actions with owners and dates that survive the board being wiped.
Workplace Inspection
Findings graded and owned, with repeat findings visible across rounds.
Used together in Lockout and Tagout
Lockout/Tagout Procedure (Machine Specific)
Sets out exactly how to isolate a specific machine, listing every energy source and isolation point
LOTO Periodic Inspection
Checks that a specific energy control procedure is being followed correctly in practice
Energy Isolation Verification
Records the physical test proving stored energy is gone before work begins
Group Lockout Record
Records a group isolation where several people work on one machine under a single lockout
Lock Removal Authorization
Authorises removing a lock when the person who applied it is not available
Line Breaking Permit
Controls opening pipework that has held hazardous liquid, gas or steam
More in Internal Audits
Internal Audit Programme
Sets out what will be audited, when, by whom and against which standard, across the year
Internal Audit Report
Records an internal audit against a standard or process, with findings and evidence
Audit Plan
Sets out the scope, criteria, schedule and people involved for a single audit
Audit Follow Up Record
Checks whether audit findings have actually been closed and the fixes work
Auditor Competency Record
Records an internal auditor's training, experience and audits performed
Process Audit Record
Audits a specific process end to end rather than a standard clause by clause
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO 19011:2018 clause 6.4, Conducting the audit
- ISO 19011:2018 clause 6.6, Conducting audit follow-up
- ISO 9001:2015 clause 10.2, Nonconformity and corrective action
- ISO 45001:2018 clause 10.2, Incident, nonconformity and corrective action
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.