Internal Audit Findings Explained: NC, OFI, Observation & Positive Findings
Internal audit findings help organisations understand whether their management systems are working effectively and where improvement is needed. During an ISO audit, findings are typically classified as Nonconformities (NCs), Observations, Opportunities for Improvement (OFIs), or Positive Findings.
A Nonconformity identifies where a requirement has not been met. An Observation highlights a potential future risk. An Opportunity for Improvement identifies ways to strengthen an existing process, while Positive Findings recognise effective practices that should be maintained.
Managing these findings properly is essential for ISO 9001, ISO 14001 and ISO 45001 continual improvement. iAudit Global is an ISO audit management software platform built by auditors to help organisations plan audits, capture evidence, manage findings, track corrective actions and maintain visibility across their audit programmes.
By keeping audit findings connected from identification through to follow-up, organisations can move beyond compliance paperwork and use audits as a practical tool for improving performance.
One of the questions that comes up regularly during internal audits is surprisingly simple.
“Should this be raised as a nonconformity, an observation or an opportunity for improvement?”
The answer isn't always obvious.
Not every issue deserves a nonconformity, and not every process that meets the requirements should be left without comment. Good auditors don't categorise findings based on instinct. They follow the evidence and decide what that evidence is actually telling them.
Understanding the difference between a Nonconformity (NC), an Opportunity for Improvement (OFI), an Observation and a Positive Finding helps produce better audit reports and, more importantly, better decisions after the audit.
What Are Internal Audit Findings?
An audit finding is the outcome of comparing objective evidence against the audit criteria.
The evidence might come from interviews, records, observations, site inspections or sampled activities. Once you've gathered that evidence, your job is to determine whether the process conforms to the requirements, presents a potential risk or offers an opportunity to improve.
Every finding should answer one simple question:
What does the evidence tell us?
That's why findings should always be factual. Assumptions, opinions and guesswork have no place in an audit report.
If you're unsure how findings fit into the overall reporting process, read our guide on writing an ISO internal audit report.
Why Classifying Findings Correctly Matters
It's tempting to think that every issue should become a nonconformity.
The opposite can happen too. Auditors sometimes avoid raising a nonconformity because it feels easier to record it as an observation instead.
Neither approach helps the organisation.
When findings are classified correctly:
- ✓
Corrective actions are proportionate to the issue
- ✓
Management understands where the biggest risks exist
- ✓
Improvement opportunities are captured before they become problems
- ✓
Audit reports become far more useful for decision making
The purpose of an internal audit isn't to find faults. It's to provide an accurate picture of how well the management system is working.
Positive Findings
Not every audit finding needs to highlight a weakness.
Positive findings recognise processes that are working particularly well or demonstrate good practice.
Examples might include:
Excellent housekeeping standards across production areas
Consistently completed pre-start safety inspections
Strong document control with no outdated procedures found during sampling
Employees demonstrating a clear understanding of emergency procedures
Recording positive findings does more than acknowledge good work.
It gives management confidence that effective controls are in place and provides examples that can often be shared across other departments or sites.
An audit should reflect both strengths and weaknesses. If a report only contains problems, it rarely gives a balanced view of the organisation.
Observation
An observation identifies something that isn't currently a nonconformity but could become one if it's ignored.
Think of it as an early warning.
For example, imagine training records are fully up to date. During the audit, however, you discover there's no formal process for reminding managers when refresher training is due.
Today, everyone remains competent.
Six months from now, several qualifications may have expired.
That's an observation.
Nothing has failed yet, but there's a weakness that deserves attention before it develops into a larger issue.
Observations encourage organisations to act proactively rather than react after a problem has already occurred.
Opportunity for Improvement (OFI)
An Opportunity for Improvement is different.
The requirement has already been met.
The process works.
You've simply identified a practical way to make it work even better.
For example:
Example OFI
| ID | Clause | Area | Opportunity |
|---|---|---|---|
| OFI-01 | ISO 9001 Clause 9.1 | Performance Monitoring | Improve KPI tracking through automated dashboards. |
The existing process remains compliant.
The suggested improvement could increase efficiency, improve visibility or reduce unnecessary effort.
OFIs often create the greatest long-term value because they encourage continual improvement instead of waiting for weaknesses to appear.
Nonconformity (NC)
A nonconformity is raised when objective evidence shows that a requirement has not been fulfilled.
That's the important part.
A nonconformity isn't based on opinion or expectation.
It's based on evidence.
For example, if your calibration procedure requires measuring equipment to be calibrated every 12 months and sampled equipment is found to be overdue, the evidence demonstrates that the requirement hasn't been met.
Your finding should clearly identify:
- •
The requirement
- •
The objective evidence
- •
Why the requirement has not been fulfilled
For example:
Example Nonconformity
| ID | Clause | Area | Statement | Due Date |
|---|---|---|---|---|
| NCR-01 | ISO 9001 Clause 5.1 | Improvement | Improvement targets were not clearly defined or monitored. | 30 April 2026 |
Notice what's missing.
The auditor hasn't prescribed the solution.
The report identifies the issue.
The organisation decides how it will correct it.
Observation vs OFI vs NC
If you're unsure how to classify a finding, this simple comparison usually helps.
Finding comparison guide
| Finding | Does the requirement meet the standard? | Corrective Action Required? | Purpose |
|---|---|---|---|
| Positive Finding | Yes | No | Recognise good practice |
| Observation | Yes, but future risk exists | Usually recommended | Prevent future issues |
| Opportunity for Improvement | Yes | Optional | Improve an already effective process |
| Nonconformity | No | Yes | Restore conformity |
Rather than asking “What type of finding do I want to raise?”, ask yourself:
“What does the evidence support?”
The answer is usually much clearer.
Every Finding Should Lead Somewhere
One mistake I see is treating audit findings as the end of the process.
They aren't.
Every finding should lead to a decision.
Nonconformity
Should trigger corrective action.
Observation
Should prompt the organisation to review potential risks.
Opportunity for Improvement
Should encourage better ways of working.
Positive findings
Should be shared so successful practices can be repeated elsewhere.
That's how audits contribute to continual improvement rather than becoming another compliance exercise.
If your audit programme follows the PDCA cycle, each finding naturally feeds into the next stage of improvement.
Keep Findings Connected
As audit programmes grow, keeping findings connected to evidence, corrective actions and reporting becomes much harder if everything is spread across spreadsheets, Word documents and email threads.
Having one place to record findings, assign actions and monitor progress makes it much easier to ensure nothing gets overlooked.
That's exactly why we built iAudit Global around the way auditors actually work, keeping every stage of the audit process connected from planning through to follow-up.
Turning Audit Findings Into Real Improvement
Every audit finding tells a story.
Sometimes that story is about a requirement that hasn't been met.
Sometimes it's about a process that could become a future risk.
Sometimes it's about an opportunity to improve.
And sometimes it's about recognising something that's already working exceptionally well.
The important part isn't choosing the most serious category.
It's choosing the category that best reflects the evidence.
When findings are objective, clearly explained and followed through properly, audits stop becoming paperwork and start becoming a practical tool for continual improvement.
If you'd like to improve the way your organisation manages audit findings, corrective actions and reporting across ISO 9001, ISO 14001 or ISO 45001, we'd be happy to help.