An audit finding is a claim that somebody else has to answer. That is the whole of its purpose, and it is the test that most of the entries in a findings log fail. A finding that names the requirement, quotes what the organisation promised, produces the record that fails to show it, and states what happened is answerable in two lines: the auditee agrees and corrects it, or disagrees and produces the evidence that was missing. A finding that says document control is weak is not answerable at all, and an auditee who cannot answer will dispute it, reasonably, until somebody withdraws it.
The writing is therefore not a presentational concern. It decides whether the audit produces changes or produces an argument, and it decides whether the log can be read by anyone other than the person who wrote it. This piece sets out the six fields an entry needs, the two criteria every finding is judged against, the four grades and what each one commits the auditee to, one finding rewritten from an opinion into a claim, the measured cost of a log from first draft to closure, and the limit that no wording fixes.
The six fields
An entry has six fields. They are the minimum for a claim that can be answered, closed and later re-read by someone who was not in the room.
Table 1. The six fields of a findings-log entry, what each holds, and the failure it prevents. Source: the role specification for the studio’s ISO Auditor, whose findings log carries one entry a finding.
| Field | What it holds | The failure it prevents |
|---|---|---|
| Requirement | The clause and its requirement, quoted in short form from a licensed copy | The requirement quoted from memory, and corrected by the auditee from the actual text |
| Commitment | What the client’s own procedure says about the same thing | The half-audit that tests the standard and never tests the promise the organisation made |
| Evidence | What was found: named, dated, located, attributable | The finding written from an impression, which cannot be closed and will be withdrawn |
| Grade | One of the four points, applied by a stated definition | The borrowed major-and-minor vocabulary, and the dispute it produces at the closing meeting |
| Action | The correction and the corrective action, written by the process owner | The finding that ends in a conclusion rather than a change |
| Verification | What will be examined, when, and by whom, to show the action worked | The open loop: findings logged, actions proposed, nothing checked |
The third field is where entries are won and lost. Evidence is a record, an observation of the act itself, an interview answer that names a person, a task and a source of instruction, or a measurement with its instrument behind it. Anything else is a claim about practice offered in place of the practice. Where the evidence does not exist, the correct entry is not a weaker finding; it is a gap, recorded as a gap, with the checklist row left open. An audit that infers a nonconformity from an absence is guessing, and when the guess is wrong the auditee is left with a corrective action it cannot close, which returns as a finding at the next audit and as a reason to distrust the whole pack.
The sixth field is the one most often missing, and its absence is the clearest evidence that the cycle was not run. Clause 10.2 requires action to eliminate the cause of a nonconformity, a review of the effectiveness of what was done, and records of the nature of the nonconformity and the results of the action. Clause 9.2 requires the audit results to reach the relevant management, and clause 9.3 requires management review to consider them. A log that stops at the action is an inventory of problems, and the next audit will find the same ones.
Two criteria, and which one failed
Every audit point is judged against two criteria, and a finding has to say which one failed. The first is the standard’s requirement. The second is the organisation’s own commitment — what it said, in its own words, that this process would do.
The second criterion is where most real nonconformities live. An organisation writes a procedure that conforms and then works to a different rhythm, and the standard’s requirement to retain documented information is met in form while the control the procedure described has quietly stopped happening. A monthly review recorded twice in a year is not a documentary failure; it is a failure against the client’s own commitment, and the correction is behavioural.
Three outcomes are possible, and each implies a different corrective action.
The practice fails the standard while conforming to the procedure: the procedure is the defect, and the correction is a document change. The practice conforms to the standard while failing the procedure: the practice is the defect, and the correction is behavioural. The practice fails both: the rarest case and the most urgent, because it usually means the process has changed and nobody has noticed, or that the procedure was written for a process that no longer exists.
An audit that applies one criterion measures half a system. Applying the standard alone passes a procedure that is complete, signed and useless — one that describes a control unrelated to the risk it names, or assigns a duty to a role that has not existed since a reorganisation. Applying the client’s procedure alone passes a practice that satisfies the organisation’s own paperwork while missing a requirement of the standard entirely.
Writing the sentence
The sentence that carries a finding has four parts, in this order. A requirement. A commitment. Evidence. A conclusion.
Clause 7.1.5.2 requires measuring equipment to be calibrated or verified at specified intervals, identified so that its status can be determined, and safeguarded from damage or deterioration. Procedure QP-08 states that gauges are calibrated annually and the certificate is filed with the register. The register shows gauge G-114 calibrated on 4 February 2025, with no later entry; the certificate on file has the same date. The gauge was in use on the final inspection on 12 March 2026. This is a nonconformity against both criteria.
Four things make that usable. The requirement is identified by clause and content, so the auditee can check it. The commitment is the organisation’s own words, so the auditee cannot argue that the practice was acceptable. The evidence is dated twice and located in a named register, so it can be re-examined. The conclusion says which criteria failed, so the corrective action follows from it rather than from the auditor’s preference.
The four common bad forms are worth naming, because each is produced by a specific shortcut.
The verdict without a criterion: document control is weak. Nothing here can be answered, and nothing can be closed; the auditee can only agree with a judgement about their competence.
The impression without evidence: the supervisor seemed unsure of the procedure. This is a note about an interview, not a finding about a system; what matters is whether the record exists, not whether the person could describe it.
The absence treated as a finding: records were not available. If the records were requested and could not be produced, the finding is that the process cannot show its work, and the evidence is the request and the failure to answer it — but that has to be written down, with the request named.
The finding that is really the auditor’s preference: a spreadsheet should not be used for the register. Unless a requirement or the client’s own procedure says otherwise, this is an opportunity for improvement at most, and it belongs in that grade or in none.
Grading on four points
Findings in this office are graded on four points rather than as major and minor. The four are defined, applied consistently and explained in the log, which is what makes a grade defensible. Major and minor are certification bodies’ conventions under their own accreditation rules; borrowing the words without the definitions produces a dispute at the closing meeting, because the auditee will ask which rule defines a major and there is no answer inside ISO 9001.
Table 2. The four grades, their definition, and what each commits the auditee to. Source: the office’s convention; the definitions are not taken from ISO 9001.
| Grade | Definition | Who acts | What closes it |
|---|---|---|---|
| Nonconformity | A requirement is not fulfilled, against the standard or the client’s own procedure | Process owner | Correction, cause analysis, action, and evidence that the action worked |
| Observation | No requirement is demonstrably unfulfilled, but a control is weak or the evidence did not permit a conclusion | Process owner | A recorded position and a re-test at the next audit |
| Opportunity for improvement | The requirement is met and the process could be better | Management | Accepted or declined; no evidence owed |
| Positive observation | The requirement is met and the practice is worth spreading | Management | Nothing; used as evidence of effectiveness |
The middle two grades do most of the damage when they are used loosely. An observation recorded where a requirement was in fact breached is a nonconformity softened into a note, and it removes the obligation to act. An opportunity for improvement recorded where a requirement was breached is worse: it converts a failure into a suggestion, and the auditee is free to decline it. The test is not whether the finding feels serious; it is whether a requirement exists and whether the evidence shows it was met. Everything else follows.
One finding, rewritten
The finding below came out of an illustrative audit of a purchasing process. It is constructed for this piece and describes no client.
As first written: Purchase orders are not always approved before release. The buyer confirmed that verbal approval is common and the system does not enforce a second signature. This is a major nonconformity.
It fails four tests at once. It cites no requirement and no clause. It uses a grade the audit cannot define. Its evidence is an interview answer with no record behind it, and the answer may be perfectly satisfactory — a buyer who says verbal approval is common may be describing a process with a documented delegation. And it concludes before it has looked.
The rewrite required one more piece of fieldwork: three purchase orders selected from the release log, and the approval trail behind each.
Table 3. The same finding, before and after the fieldwork. Source: illustrative example constructed for this piece.
| Part of the finding | As first written | As rewritten |
|---|---|---|
| Requirement | none cited | Clause 8.1 requires the processes needed to meet requirements to be planned, implemented and controlled, with criteria for them determined; procedure QP-11 requires written approval before release |
| Commitment | none cited | QP-11, section 4: release requires the approver’s signature in the release field |
| Evidence | an interview answer | Three orders released on 3, 9 and 14 March 2026 with the approval field empty; the release log names the buyer; QP-11’s own form has the signature block |
| Grade | major, undefined | Nonconformity against the client’s procedure; the standard’s requirement is met by other controls, and the procedure was not followed |
| Action | none | Process owner to decide whether the practice or the procedure is wrong, then correct the one that is; second signature blocked in the system, or QP-11 amended to describe delegated approval |
The rewritten finding is shorter to answer than the first is to argue about. It also changes the correction: the organisation may decide that delegated approval is legitimate and that QP-11 is out of date, in which case the procedure is the defect and the fix is documentary rather than behavioural. That choice belongs to the process owner, and the finding is written so that they can make it.
What a log costs
The rate used here is measured, not listed: $0.00700 for a deepseek-v4-flash call on Base under exact with a short prompt, read from the live 402 challenge on 31 October 2026 outside the service’s weekday peak windows. The catalogue figure that circulates for this service, $0.00875, is Qwen’s rate, and it is used here only as the figure that circulates, beside its correction.
An illustrative log of eighteen findings is costed below. Each step is a call, because each step is a piece of writing with a judgement in it.
Eighteen findings drafted from the fieldwork notes: eighteen calls, $0.12600. Each one read back against its evidence before it leaves the room: eighteen calls, $0.12600. Three rewritten after that read-back because the evidence did not support the grade: three calls, $0.02100. Closure verification after the corrections, for the fifteen entries that require it: fifteen calls, $0.10500.
That is fifty-four calls and $0.37800, or $0.02100 a finding. The split matters more than the total. Drafting and review take thirty-six of the fifty-four calls, two thirds of the cost, before anything is verified; verification takes fifteen. At the catalogue figure the same fifty-four calls would have been $0.47250, which is $0.09450, or 25 per cent, more. At the metered ceiling of $0.00955 a call the log costs $0.51570 — $0.13770, or 36 per cent, above the measured total.
Two readings follow. The first is that the log’s cost is not proportional to its seriousness. Every entry costs a drafting call and a review call; fifteen of the eighteen cost a verification call, because fifteen require evidence of closure; and the three that were rewritten cost a fourth call each. An entry that changes nothing is not free, but it is cheaper, which is worth knowing when the room is booked and the time is short. The second is that the arithmetic is small enough to be irrelevant to the decision. Fifty-four calls is 0.50 USDC’s worth of opening balance with seventeen calls left over. A log costs less than the meeting at which it is discussed, which is the honest reason to spend the calls on writing it properly rather than the reason to buy anything.
Where a finding stops
One limit is structural and no wording fixes it. A well-formed finding is not a validated one. The log records an auditor’s judgement on the evidence that was available on the day, and the judgement can be wrong in either direction: an entry that reads perfectly may rest on a record that was produced for the audit, and an entry that reads badly may be right about a system nobody has described accurately. Only fieldwork settles it, and only a second visit settles whether the correction held.
Three further limits are worth stating plainly.
The finding cannot substitute for the requirement. Where the standard or the client’s procedure is silent, there is no criterion, and a practice that the auditor dislikes is not a nonconformity; it is at most an opportunity for improvement, and it should be graded as one or left out. An audit that writes requirements it has invented is not an audit.
The grade is a convention, not a measurement. Two competent auditors can grade the same evidence differently, and the protection is not agreement but consistency: published definitions, applied the same way to every entry, with the reasoning written into the log so that the next reader can see how the conclusion was reached.
The log does not audit itself. A checklist written by the same assembly that drafted the procedure is not evidence that the procedure works, and clause 9.2 requires auditors to be selected and audits conducted so that objectivity and impartiality are ensured. The fieldwork and the opinion remain a person’s, and where the same office drafted the procedure, somebody else has to test it.
The decision
Two rules will improve a log more than any rewriting exercise, and both can be applied in the hour before the closing meeting.
Apply the answer test to every entry: read it aloud and ask whether the auditee could answer it in two lines — by agreeing and correcting, or by producing the evidence that was missing. An entry that cannot be answered is not ready, and it should be rewritten or withdrawn rather than defended.
Then check that each entry says which criterion failed, because that sentence decides the corrective action. If the practice fails the client’s own procedure, the process owner has a choice between changing the practice and changing the procedure, and the finding should present it. A log of twelve answerable entries, each with a criterion and a named record, produces more change than a log of forty verdicts; the second is longer, and the meeting it produces is about the auditor.
Where this goes
- The pillar: x402.review/2026/10/31/quality-and-compliance/ — the job, the six artefacts and the certificate no agent issues
- The role: studio.x402.press/roles/iso_auditor — the agent, its parts and its running cost
- The service it buys: x402.press/services/deepseek/ — the canonical price, seven chains
- The review: x402.review/2026/10/31/deepseek-review/ — the measured handshake and what it does not promise
Method note
The price was read from the live 402 challenge on Base on 31 October 2026, outside DeepSeek’s weekday peak windows of 01:00–04:00 and 06:00–10:00 UTC; the catalogue figure of $0.00875 was checked against it, found to be Qwen’s rate, and is used here only where it is named as the figure that circulates. Call counts are planning assumptions, stated in the cost section and repeated in the arithmetic. ISO 9001:2015 clause numbers follow the standard’s numbering; the four-point grading is the office’s convention and is described as such. The illustrative organisation and the two versions of the finding are constructed for this piece; no client, engagement or outcome is described, and no figure for findings raised, closure rates or audit duration is offered because none has been measured.
x402.review is written and edited by N.P. Vincent. The publication is connected to x402.press, which sells the services reviewed here; that interest is disclosed on every piece that touches a service, and it is stated here rather than left to inference.
Filed under Jobs
