QULDEXResources · Glossary
What is an audit finding? Types, grading and examples
What does an audit finding mean?
In everyday use 'finding' means a problem. In auditing standards it is broader: any conclusion reached by weighing evidence against criteria, good or bad.
A finding is only useful if someone who was not in the room can understand it. That means quoting the requirement, describing exactly what was seen, and pointing to the evidence.
What are the types of audit finding?
A failure that puts the system's ability to achieve its results in doubt, such as a required process missing.
A lapse that does not undermine the system as a whole, such as one record missing.
Something that conforms today but could become a problem, or an opportunity to improve.
How do you write an audit finding?
A finding from an access management audit.
| Item | What it looks like |
|---|---|
| Requirement | Access rights are removed when employment ends |
| What was found | 3 of 25 sampled leavers had active accounts after their last working day |
| Evidence | Leaver report and user export dated 12 Oct 2026 |
| Grade | Minor nonconformity |
| Next step | Correction the same day; corrective action raised |
This is an illustration written for this page, not a customer record.
How do frameworks treat findings?
| Framework | Where | What it asks for |
|---|---|---|
| ISO 27001 | Clause 9.2 | Internal audit results are reported to relevant management and kept as documented information. |
| ISO 27001 | Clause 10.2 | Each nonconformity is corrected, its cause addressed, and the effectiveness of the action reviewed. |
| SOC 2 | Report | Control failures are reported as exceptions or deviations, with management's response. |
| ISO 9001 | Clause 9.2 | The same internal audit and reporting sequence applies to quality management. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What makes a finding hard to act on?
No requirement quoted
The finding says something is wrong but not what rule it breaks.
Instead: name the clause or the internal document.
Opinion, not evidence
'Access management is weak' cannot be verified.
Instead: state what was sampled and what was seen.
Graded inconsistently
Similar findings are major in one audit and minor in another.
Instead: agree grading criteria before the audit.
How does QULDEX handle this?
Plan, test, record findings and report in eight phases, with every step recorded against the audit.
Finding: common questions
What is the difference between a finding and a nonconformity?
A nonconformity is one kind of finding: a requirement that was not met. Findings also include confirmations that requirements were met, and observations.
What is the difference between a major and a minor nonconformity?
A major nonconformity puts the management system's ability to achieve its intended results in doubt. A minor one is a lapse that does not.
Who decides the grade of a finding?
The auditor, using criteria agreed in advance. In certification audits the certification body's rules apply.
Findings that turn into owned actions
Controls, evidence, findings and corrective actions in one audit workspace.