Writing clear audit reports

Recently, I undertook an audit for a third-party certification body. I had taken over the client from another auditor, and the auditee was also fronting a new face, as its previous quality manager had left the business.  

We had a number of previous visit findings to review, and I was amazed at how difficult we found the process. Neither of us had been part of the audit, and the findings that were documented, both on the finding log and in the previous report, were far from clear. With some, we worked out to what the finding alluded, but there were three that we ended up closing down, simply because we had no idea to what the finding related or what actions were required to address them.   

What a waste of time, what a missed opportunity for improvement. Needless to say, what should have been a relatively quick review took far longer than it should have done and impacted on the delivery of the rest of the audit.   

Ask yourself the following questions. Is it clear? Could someone not involved in the audit understand what is required?

It reminded me of another occasion when I managed the audit delivery processes in a large organisation. An auditee rang me in a sense of desperation, having had a finding raised on him by one of the team of internal auditors. It simply read “some of the training records are incomplete”. His question in return was just as simple: “How on earth am I supposed to work out which ones this refers to – I’ve got over 100 staff!”     

My administrator went back to the auditor and asked him for clarification. He was unable to provide any more information other than “there were about five files which I looked at and there were some bits and bobs missing”. Not surprisingly, this was a finding that got parked.   

It’s all in the detail 

I regularly review audit reports written by others, and while I may be seen as pedantic by those whose reports I’m looking at, my comments and requests for changes to be made are precisely to stop these situations occurring.   

When I work with new auditors, I take the same approach. It is quite simple: 

1. Detail the requirement which has not been met, clearly identifying the clause and standard or in-company procedure which relates to the issue;
2. Detail the evidence that illustrates the problem. 

An example to illustrate the first point would be: “ISO 9001 requires that the organisation includes a commitment to continual improvement of the QMS [quality management system] (clause 5.2.1d). A review of the Quality Policy (issue 4 dated 1.4.21) identified that this requirement is not met.” 

The second point is also easily addressed. The detail needed here could be as clear and precise as: “Clause 6.3 of ISO 9001 requires the organisation to consider the allocation or reallocation of responsibilities and duties when planning change. The recent reorganisation of the stores function has removed the post of stores assistant. However, the duties shown for this post in the stores manual have not been reallocated and, as a result, a number of key tasks, including the booking in of steel and the weekly stock take of gas supplies, are not being undertaken.” 

Improving the system 

The same approach can be used when there are opportunities to improve systems. 

For example: “While the organisation has considered the needs and expectations of its interested parties as required by clause 6.1 of ISO 9001, it may wish to review these in the light of the changes being made to the layout of the industrial estate and the increasing number and variety of ‘neighbours’, to ensure that the information held is up to date and relevant.”  

Or to give another example: “Clause 7.5.2c of ISO 9001 requires that the organisation ensures appropriate review and approval of documented information is undertaken.  Currently, the process involves sign-off by a number of staff who may be located across a number of sites. The organisation may wish to consider the opportunities for using its digital signature software to reduce the time taken to achieve this.”  

Lesson learned 

When you next write a finding, ask yourself the following questions. Is it clear? Could someone not involved in the audit understand what is required? If the answer is no, revisit the finding and make sure it’s crystal clear.  

Auditing is about driving forward improvement. Your auditee may not like having a finding raised, but will thank you for giving them something with which they can actually work.