Three words decide everything that happens after an audit: nonconformity, observation, opportunity for improvement. The grade decides who has to act, on what timetable, and whether anything has to be produced to close the entry. An entry graded as a nonconformity obliges the process owner to correct it, find the cause and show that the action worked. The same entry graded as an opportunity for improvement obliges nobody to do anything.
That is a large consequence to hang on a word, and it is why the vocabulary matters more than it looks. Most logs use the three words as a scale of seriousness — severe, middling, mild — and grade by feel. A log graded by feel cannot be defended at a closing meeting, cannot be applied consistently by two auditors, and cannot show a certification body that the organisation’s judgement of itself is stable. The alternative is not a better adjective. It is a definition, a test, and the discipline to apply the same test to every entry.
What the standards actually settle
ISO 9000:2015 defines a nonconformity as non-fulfilment of a requirement, and a requirement as a need or expectation that is stated, generally implied or obligatory. That definition is narrower and more mechanical than the way the word is used in practice: it asks whether a requirement exists and whether it was met, not whether the failure looked serious.
ISO 19011:2018 defines an audit finding as the result of evaluating collected objective evidence against audit criteria, and it provides that findings indicate conformity or nonconformity. The vocabulary of observations and opportunities for improvement comes from practice rather than from the definitions of either standard: organisations grade those categories as they see fit, and the categories are useful precisely because practice needed somewhere to record a weakness that falls short of a breach, and an improvement that follows no breach at all.
ISO 9001 itself does not grade findings. Clause 10.2 requires action to control and correct a nonconformity, to deal with the consequences, to evaluate the need for action to eliminate the cause, to implement it, to review its effectiveness, and to retain documented information on the nature of the nonconformity and the results of the action. Nothing in it mentions major or minor, and nothing in it defines an observation or an opportunity for improvement.
The major and minor distinction belongs to certification bodies, under their own accreditation rules and their own definitions. It is a real distinction with real consequences inside a certification audit, and it is not available to an internal programme that has no such rulebook to point to. An auditor who grades an internal finding as major will be asked which rule defines it, and there is no answer inside ISO 9001.
An organisation therefore has two honest options: adopt a named external scheme, staffed by people who know its definitions, or define its own vocabulary and apply it consistently. This office uses the second: four grades, defined in the log’s front matter, applied to every entry.
The four grades and their tests
Table 1. The four grades, the test that assigns each, who owns the action and what closes the entry. Source: the office’s convention, as used by the studio’s ISO Auditor findings log; the definitions are not taken from ISO 9001.
| Grade | The test | Owner | What closes it | Timetable |
|---|---|---|---|---|
| Nonconformity | A requirement exists — in the standard or the client’s own procedure — and the evidence shows it was not met | Process owner | Correction, cause analysis, action taken, and evidence that the action worked | Set by the organisation; before the next audit at the latest |
| Observation | No requirement is demonstrably unfulfilled, but a control is weak, or the evidence gathered did not permit a conclusion either way | Process owner | A recorded position, and a re-test at the next audit | Reviewed at the next audit |
| Opportunity for improvement | No requirement is breached; the process works and could work better | Management | Accepted or declined, with reasons | Improvement planning; no deadline |
| Positive observation | The requirement is met, and the practice is worth spreading | Management | Nothing; it is evidence of effectiveness | None |
The order is not a scale of severity. It is a scale of obligation, and the two do not always agree: a nonconformity about a missing calibration certificate may matter less to the business than an observation about an approval that happens in a message thread, and the grade says what must be produced, not what matters most.
The test in the second column is the whole instrument. Ask it in the same words for every candidate entry: is there a requirement, and does the evidence show it was met? A nonconformity needs a requirement that exists and evidence that it was not fulfilled. If the requirement exists and the evidence is merely absent, the entry is a gap in evidence and the checklist row stays open — it is not yet a nonconformity, and grading it as one is an inference dressed as a finding. If no requirement exists, there is no nonconformity to record, however poor the practice looks.
Five boundary cases
The four definitions are easy to write and hard to apply at the margin. These five cases account for most of the arguments.
A single instance. One missing record out of forty, with thirty-nine present. This is a nonconformity, against the organisation’s own procedure, however isolated: the requirement was stated and it was not met on that occasion. Severity is not part of the definition; if the procedure says every record is retained, one gap is a failure of the procedure’s own commitment. What the single instance should change is the corrective action, which will reasonably be a reminder and a check rather than a system redesign. It is the commonest grading error in both directions: dismissed as an observation because it was only once, and escalated into a system failure because it was found at all.
A requirement missing from the procedure. The practice is described in a way that omits something the standard requires — say a procedure for release that never mentions the identification of nonconforming output. The nonconformity is against the standard’s requirement, and the correction is documentary. Where the omission is a gap in good practice that no requirement covers, it is an opportunity for improvement. The distinction is not about how sensible the suggestion is: it is whether a stated, generally implied or obligatory need exists.
The record that exists and is late. A review performed in March that the procedure schedules monthly, with eleven reviews recorded in the year instead of twelve. This is a nonconformity against the procedure, and the honest reading is that the control the procedure described stopped happening in one month. Grading it as an observation because the practice is broadly sound converts a failure into a comment, and the process owner is then free to do nothing.
The practice that is better than the procedure. The team does something more rigorous than the procedure requires, and the procedure has not been updated. No requirement is unfulfilled in the work itself, and yet the documented information no longer describes the process — which is a nonconformity against the organisation’s duty to maintain documented information to the extent necessary to support the operation of its processes. The correction is a document change, and the grade is a nonconformity rather than a positive observation, because the standard is not satisfied by a good practice that is undocumented.
The evidence that is not there. The auditor asked for the register and the register could not be produced. If the request and the failure to answer it are recorded, that is evidence of a process that cannot show its work, and a nonconformity may properly be graded on it. If the request was never made and the register was simply not found, the entry is a gap in evidence, the row stays open, and the correct line in the log is an unfinished audit rather than a finding.
Table 2. Decision rules for the boundary cases, in the order they should be asked. Source: the office’s convention.
| Question | If yes | If no |
|---|---|---|
| Is there a requirement, in the standard or the client’s own procedure? | Go to the next question | Opportunity for improvement, or nothing |
| Does the evidence show it was not met? | Nonconformity | Go to the next question |
| Was evidence gathered that permits a conclusion either way? | Conformity; record a positive observation only where the practice is worth spreading | Observation, or a gap in evidence with the row left open |
Why borrowed vocabulary costs
The argument for a defined four-point scheme is not tidiness. It is that the grade is the part of the finding that the auditee will contest, and a contest over an undefined word cannot be won by either party.
Major and minor carry certification consequences: a major can put a certificate at risk, and a minor still travels with a deadline attached. An internal programme that borrows the words borrows the consequences without the rulebook, and the auditee who asks what makes a nonconformity major receives an answer about accreditation rules that do not govern their internal audit. The dispute then becomes about the auditor rather than the process, which is the most expensive outcome an audit can produce.
The softer failure is worse in its effect. Observation is the word most often used to avoid a finding: an entry that names a real breach, softened because the auditor knows the process owner, or because the meeting is nearly over, or because the evidence was thin. Each of those is understandable and all three are the same decision — to record a failure as a comment — and the log afterwards shows a system with no nonconformities and no changes.
Consistency is the only defence, and it is a property of the office rather than of any single auditor. Two auditors applying the same three questions in Table 2 to the same evidence may still reach different grades, and that is tolerable. What is not tolerable is the same auditor grading the same kind of evidence differently in two audits, and a log that cannot be read to check.
What the grading costs
The rate is measured, not listed: $0.00700 a call for deepseek-v4-flash on Base under exact with a short prompt, read from the live 402 challenge on 31 October 2026 outside the service’s weekday peak windows. The $0.00875 that circulates as this service’s catalogue figure is Qwen’s rate, and it is used here only as the figure that circulates, beside its correction.
An illustrative log of twenty-four entries — three nonconformities, six observations, nine opportunities for improvement and six positive observations — costs the following. Drafting and grading all twenty-four entries, one call an entry: $0.16800. Cause analysis and corrective action wording for the three nonconformities, one call each: $0.02100. Verification of the nine entries that require evidence of closure — the three nonconformities and the six observations — one call each: $0.06300. The log is thirty-six calls and $0.25200.
That is $0.01050 an entry, and the distribution is more instructive than the mean. Drafting and grading take twenty-four of the thirty-six calls, two thirds of the cost, because grading is a judgement made once per entry and made before anything else can happen. Cause analysis takes three calls and eight per cent. Verification takes nine calls and a quarter. The fifteen entries graded as opportunities or positive observations carry one drafting call each and nothing further, which is why they are the cheapest part of the log and the part most often left out when time is short.
At the circulated rate the same thirty-six calls would be $0.31500, which is $0.06300, or 25 per cent, more. At the metered ceiling of $0.00955 a call the log costs $0.34380, which is $0.09180, or 36 per cent, above the measured total. The opening balance of 0.50 USDC buys seventy-one calls at $0.00700, so the log uses thirty-six of them and leaves thirty-five.
The figure to hold on to is not the total. It is that a log of twenty-four entries, graded properly and verified after correction, is thirty-six calls — and that the three entries that oblige somebody to act account for nine of them, a quarter of the effort, spent on the eighth of the log that will produce change.
Where the grading stops
The taxonomy is a convention, and a convention is not a measurement. Two competent auditors can grade the same evidence differently and both be defensible; nothing in ISO 9001 supplies a threshold, and no arithmetic converts evidence into a grade. What protects the log is not the scheme but its application: definitions published before the first entry, the same test asked in the same words, and the reasoning written next to the grade so that a later reader can see how it was reached and disagree with it specifically.
Three consequences follow.
The grade cannot repair a missing requirement. Where the procedure is silent and the standard says nothing, the entry has no criterion, and a practice the auditor dislikes is not a nonconformity. An audit that writes requirements it prefers is no longer auditing against criteria, and the log becomes a list of the auditor’s opinions.
The grade cannot substitute for fieldwork. A well-graded entry with no named evidence is a well-dressed assertion, and the tables above say nothing about whether the evidence is real. The four properties of usable evidence — produced in the course of the work, locatable, attributable, re-examinable — do that work, and they cannot be supplied by grading.
The grade is not the last word. An entry closed with a correction and a verified action may still fail at the next audit, and the repeat is the only honest measure of whether the taxonomy was applied to a system rather than to a set of documents.
The decision
Publish the four definitions in the front matter of the findings log, before the first entry is graded, and apply the three test questions in Table 2 in the order given. That takes a page and settles most disputes in advance, because the auditee can read what the words mean before the closing meeting rather than during it.
Then apply one question to every entry: what would have to be produced to close this? An entry with an answer is a nonconformity or an observation, and it needs a verification line. An entry with no answer is an opportunity for improvement or a positive observation, and should say so rather than borrowing the authority of a finding. The log that results is shorter than the one graded by feel, and it is the one that changes something.
Where this goes
- The pillar: x402.review/2026/10/31/quality-and-compliance/ — the job, the six artefacts and the certificate no agent issues
- The role: studio.x402.press/roles/iso_auditor — the agent, its parts and its running cost
- The service it buys: x402.press/services/deepseek/ — the canonical price, seven chains
- The review: x402.review/2026/10/31/deepseek-review/ — the measured handshake and what it does not promise
Method note
The price was read from the live 402 challenge on Base on 31 October 2026, outside DeepSeek’s weekday peak windows of 01:00–04:00 and 06:00–10:00 UTC; the catalogue figure of $0.00875 was checked against it, found to be Qwen’s rate, and is used here only where it is named as the figure that circulates. Call counts are planning assumptions, stated in the cost section and repeated in the arithmetic. The definition of a nonconformity as non-fulfilment of a requirement is ISO 9000:2015; ISO 9001:2015 does not grade findings, and the four-point scheme here is the office’s convention, described as such. The illustrative log is constructed for this piece; no client, engagement or outcome is described, and no figure for repeat-finding rates, closure rates or audit duration is offered, because none has been measured.
x402.review is written and edited by N.P. Vincent. The publication is connected to x402.press, which sells the services reviewed here; that interest is disclosed on every piece that touches a service, and it is stated here rather than left to inference.
Filed under Jobs
