So the uh auditor of course needs to document um the audit findings, so you need to evaluate the evidence against the audit uh findings So before the closing meeting, the audit team must discuss the completion of audit findings review and other relevant information that they've collected during the audit. So they need to consider the specific context of the audity. They should evaluate the evidence against the audit criteria. They also need to check the validity of the evidence and if it's sufficient in relation to the audit objectives. Now, very difficult, and the boundary between a minor nonconformity and a major nonconformity is not always easy to define. We can of course agree that if a finding to be conform, if an auditor observes that one transaction in thousand did not meet the requirements, but similarly we can agree that a finding indicates a major nonconformity if 800 transactions in 1000 do not adhere. But nevertheless, it's not always a clear distinction between major and minor nonconformities Because you it's not always very easy to determine. So the specific context of the audit T and other relevant aspects are taken to into consideration when making such a distinction. So most certification bodies provide you with some kind of a checklist where an auditor needs to take a box to say if there is evidence, is there is a procedure, is there is a process where you can basically state if there is a conformity or a non-conformity. So the threshold between the types of audit findings is neither arbitrarily set nor applicable to all audit findings. It is set by the auditor and based on a very specific context of the audity. So that might even be that for one audit client it may be a major one and for another one it may be Maybe a minor one, depending on the judgment of the external auditor. The statement of nonconformity is, of course, the most significant part of documenting a nonconformity. As I stated, a statement is the output of the audit and it does also the input for corrective actions to be taken by the audit. So it needs to be written in a very clearly uh way and it should not be uh mistaken for audit findings and it should also not be a rephrasing or a restatement of that um uh issue. So the nonconformity needs to be written very clearly, it needs to be easily understood because the Audity will use that as an as an improvement action, and it might be the case that people who will work with the nonconformity uh weren't part of the audit. So it needs to be very clear uh what is meant with it and and if it's poorly communicated, poorly written, it will uh make things different Equally important, nonconformity should be recorded and documented systematically by providing traceability and easy-to-follow progress reviews and evidence for the completion and effectiveness of corrective action. So, auditors usually use a non-conformity report form, something like that, by means of recording the non-conformities. And usually audities get that document sent where you get a description of the non-conformity. with a decision with okay this is evidenced by. So if you drive draft a non-conformity report there are a couple of things that you need to keep in the back of your mind So if an audit finding indicates a nonconformity, you need to document it in a non-conformity report and it basically includes three items. First of all, you need to describe The requirement for which the non-conformity was detected, which is basically the audit criteria. Secondly, you need to describe the observed non-conformity. including the evidence supporting the findings and you need to write the type of nonconformity as it a major or a minor nonconformity So, this is for most auditors one of the more difficult things to do to really write it in a correct way So it might be as simple as writing the description of the observation and referring it back to the respective standards requirement. But it is very important that it's very specific in order to avoid any potential misunderstanding. So again, I've already stated it. It's possible to identify findings related to multiple criteria. So it depends a little bit on the arrangement with the audit T, but you can either create separate findings for each criterion. or create one single finding where you include the reference on multiple uh criteria. So this is basically such a non-conformity report. This is an example. So And here you see basically the number of the non-conformity, also always very easy for clients to follow up. You have the name of the client, the file number. The relation to the process that you have audited, the link to the controller class number, in this case it's annex A5. 9. The site was Montreal and the audit criteria is basically what is written in Annex A5. 9 and information an inventory of information and other associated assets including owners shall be developed and maintained. So Then the description of the observed nonconformity. In a sample of 25 assets analyzed originating from the asset list, only five of them were correctly identified. You have the name of the auditor, the date when it happened, an indication of major and or minor, and acknowledgement by the auditive representative that the person is Okay with the non-conformity. So you can also add in this case this is evidenced by usually you add documentation or the name of the asset list that is associated with your findings. So you need to fill it with enough evidence where you can also conform it and to communicate it to your client as well The benefits of the doubts. So an auditor cannot raise a non-conformity if they do not have an identified non-fulfillment of a requirement. So by default, the benefit of the doubt um applies in all cases. So an organization is considered to be conform to the requirements of ISO 2701 as long as there is no evidence to prove the opposite. So the processes, controls, and divisions that the auditor did not have time to check will be considered conform. So auditors should use their work documents to plan the auditing of those parts in future surveillance audits. So that also means that the role of an auditor is not um to find non-conformities. I see that a lot with auditors that I work with. That auditors want to find non-conformity. The purpose of an audit is to verify conformity. So you need to have an open look, you need you want to be curious, you're not there to find Nonconformities. You don't have a KPI on the number of nonconformities you find per customer. So if there is no evidence of the nonconformity, there is no nonconformity. If there is evidence of a non-conformity, you need to document So that's basically a very important thing to raise. Your role is not to find non-conformities, but to verify conformity. So, as a summary, audit findings are results of the evaluation of the collected audit evidence against audit criteria. A minor nonconformity is the partial fulfillment of a requirement, but does not bring a risk To the total capability of the ISMS. A major non-conformity is the non-fulfillment of a requirement or a total failure of its effectiveness. An observation is then a situation or an element observed during the audit that may be subject to improvement without necessarily being a non-conformity. An anomaly is a deviation from a requirement or from the target set by the organization, but that still remains within the organization's established and acceptable levels. Nonconformities should be documented in the nonconformity report, and the nonconformity report specifies the audit criteria, the nonconformity type, major or minor, and the description of the observed nonconformity.