No matter how many times I have had to do it, raising a nonconformity is not easy.  Particularly during an initial certification.  Everyone is so excited, they have worked for this moment for months and months and they think that they have covered everything.  Then !BLAM! I hit them with a nonconformity.

An auditor has to be the bad guy, more often than I’d like to admit.  I equate it to giving my kids medicine, it may not taste good and I will do my best to sweeten it up, but in the end it’s for their own good.

I truly believe that an audit is an opportunity for an organization and its people to improve and grow and just be better at what they do.  And finding little things to fix, which is par for the course, happens all of the time and the auditee usually accepts it without too much hesitation.  Its when you have to deliver the bad news that they are receiving a major nonconformity, that’s hard.  But it’s never as hard as during that initial certification audit.  Why?  Because it delays certification.  I try and tell them that they will still get certified, as long as they respond to the finding within 90 days.  But when I know that they have been working so diligently and hard and earnestly, it makes it a bitter pill.

But as an auditor, you have to do what you have to do.  Ask yourself a couple of questions:

• Will this finding help them improve the way that they are doing things?
• Is this a finding because they just didn’t meet the requirements of the criteria?
• Do you have strong supporting evidence (not just a gut feeling, or one unverified information) to help defend your position?

Communicating the nonconformity is also important.  Do your best to stick to the key points of the nonconformity and be clear about it.

• Clearly identify the criteria and any other references (i.e. their own procedures).
• Step by step go through each piece of evidence factually.
• Clearly identify the gap between the evidence collected and the expectations for meeting the criteria.
• Do not exaggerate, minimize or guess.
• Do not offer suggestions for fixing it or dive into the root cause analysis

In my 15 years of auditing, it doesn’t get any easier.