Internal audits exist to make the management system better, not to catch people out. How findings are labelled and communicated has a big effect on whether the audit actually achieves that. Get it wrong and the audit becomes something to dread, work around, or quietly ignore.
Non-Conformity or Observation in Internal Audits
The term non-conformity carries weight. It implies a formal failure against a requirement, something that needs corrective action, root cause analysis, and a documented response. That's appropriate when the issue is serious: a legal compliance gap, a missed certification requirement, a control that simply isn't operating. It's not appropriate for a typo on a form or a record that was filed late.
Raising every minor issue as a non-conformity does two things, both bad. It upsets the people involved, who feel they've been formally accused of not doing their job correctly. It also dilutes the term, so when something genuinely serious is raised, it carries no more weight than the last six trivial things. An observation is often the better label for a minor point or for findings raised in an internal audit, leaving non-conformity for issues that genuinely warrant it.
Opportunity for Improvement (OFI) Misuse in Audits
Opportunity for Improvement, or OFI, sounds helpful but in practice it's frequently misused. Some auditors use OFIs to slip in personal opinions about how the system should be run, effectively offering consultancy under the guise of an audit finding. The auditee then has to decide whether to act on advice that isn't actually a requirement, and often feels obliged to, in case it comes back at the next audit.
Certification bodies make this worse by using different terminology and applying different expectations to what counts as a non-conformity versus an observation versus an OFI. Some expect a full root cause analysis for anything raised, regardless of severity, which is absurd when the issue is a pedantic point about wording. Others are more proportionate.
A more honest term here is 'Recommendation' as this is what it usually is. Something the auditor is suggesting, or recommending, and which you may not agree with and which may not actually lead to any improvement. Some auditors have a fairly blinkered view of the world and may suggest improvements that don't improve anything.
Proportionate Internal Audit Findings in Practice
For internal audits, a more proportionate approach works better. Use plain language. If something is genuinely wrong and needs fixing, say so and treat it as a non-conformity with proper corrective action. If something is a minor point, log it as an observation if it needs some follow up or recommendation if only making a suggestion and allowing the auditee to decide if any action is required.
The aim is for the audit to identify useful information that the business can act on and not to cause internal conflict!
Corrective Action and Audit Follow-up
Internal Audit Training Course
Published: 15 May 2026
