1.

Writing Nonconformances
Principles of Writing Audit Findings

► All audit findings of nonconformity shall have three parts

 a statement of the nonconformity
 the requirement (or specific reference to it) not followed
 the objective evidence observed that supports the statement of nonconformity

Example
Finding: The certificate expiration date is greater than 3 years maximum from the
certification date.
Requirement: Rules 5.1
Objective Evidence: Certificate XXX-XXX, Certification Date 06/17/03. Expiration Date :
06/17/06.

► Many audit findings are written so poorly that we cannot understand

what the auditor really thought was the nonconformity
► An audit finding should be able to be read and understood years
later. Think of it as a stand alone document
Bureau Veritas Presentation _ Date 2
Principles of Writing Audit Findings
1. The statement of nonconformity should be directed to the system or the
process, not the incident found
 This helps direct the auditee to the systemic issue instead of the specific incident

2. Give specific details of the incident observed only in the Objective

Evidence section
 Refer to the projects, form, etc.
 Give enough detail so that the auditee can find exactly what you found
 Record all instances of objective evidence

3. State the Requirement specifically

 If you reference a clause in a standard, or a procedure, and it has more than one paragraph, then
quote the specific point that has been violated

4. Check that the three parts of the Audit Finding agree

 Has the Requirement referenced actually been violated?
 Does the Objective Evidence actually support the statement of nonconformity?

Bureau Veritas Presentation _ Date 3

Principles of Writing Audit Findings

Opportunities for Improvement are optional

► An OFI can only identify an issue, it cannot suggest a solution
 many OFIs violate this rule
► OFIs can only be written where the auditee’s system meets the
requirements. There shall be evidence of conformance in the
auditor notes or report

Bureau Veritas Presentation _ Date 4

2. Responding to Audit Findings
Principles of Responding to Audit Findings
► The NCR is the “history” of the problem solving effort
 Should record what, when, how many, who, why, etc.
 It is fine to have a NCR response that is many pages!

► A response to an NCR is part of a document

 Do not use as few words as possible

► If someone picked up the NCR 2 years from now, would they understand what happened?
what you did ?
 Think “paragraphs,” not single sentences

► Corrective Actions should be written by a team

 Not a single individual
 Good root cause analysis requires challenging assumptions
 One person does not do this well

► NCRs are too often written as though the recipient was part of the team
 Most details are assumed
 The steps are not explained, so it cannot be independently reviewed
 Remember from school, “Show your work

► Don’t assume that the same person or someone familiar with your system will always be
reviewing your response. Write Bureau
the response as if an
Veritas Presentation accreditation body will be
_ Date 6
Non-Conformance Reports

► KEY PARTS
► KEY WEAKNESSES

1. Problem Statement 1. Problem Statement

2. Correction / Containment 2. Correction / Containment
Action Action
3. Root Cause Analysis 3. Root Cause Analysis
4. Irreversible Corrective Action 4. Irreversible Corrective Action
5. Preventive Action 5. Preventive Action
6. Verification 6. Verification

Bureau Veritas Presentation _ Date 7

Expanding Problem Statements

Bureau Veritas Presentation _ Date 8

Problem or Opportunity?

“Within each problem lies a

disguised opportunity…but it is
the art of unmasking the disguise
that distinguishes between the
two.”
Anonymous

Bureau Veritas Presentation _ Date 9

Problem Recognition

► No matter how large the tip of

an iceberg seems, 80 percent
of it lies below the surface of
• Symptom
the water.
► It’s the same way with
problems.

• Real Problem

Bureau Veritas Presentation _ Date 10

Change-Induced vs. Never-Been-There Situations

“Something Changed Gradually”

Level of
Performance Expectation

Actual

Time

Bureau Veritas Presentation _ Date 11

Change-Induced vs. Never-Been-There Situations

“Something Changed Abruptly”

Level of
Performance Expectation

Actual

Time

Bureau Veritas Presentation _ Date 12

Change-Induced vs. Never-Been-There Situations

“Never-Been-There”

Level of
Performance Desired

Actual

Time

Bureau Veritas Presentation _ Date 13

Problem Statement

► Often the nonconformity recorded is not the problem, but a

symptom of the problem
 Is it expressed as an issue with the system?
• If the problem is expressed in terms of a person or incident, it is at
the symptom stage

► It is important to get to the true problem, or the problem-solving

efforts will not be effective
 Fixing symptoms will not stop the issue from recurring

Bureau Veritas Presentation _ Date 14

Problem Statement
► Statement of Nonconformity
 The certificate expiration date for Company Y is greater than 3
years maximum from the 6/17/06 certification date.
► Statement of Nonconformity
 The certificate development process is not effective.

► Which statement focuses upon an incident?

► Which statement focuses upon the process or system?

Bureau Veritas Presentation _ Date 15

Expanding Problem Statements

► Describe the extent of the problem

 You need to investigate if this is a single occurrence or a bigger
systemic problem

► Expand the problem statement to include data

 What?
 How Many?
 Who?
 When?
 Where?

Bureau Veritas Presentation _ Date 16

Expanding Problem Statements

►Who
 Identify departments and/or offices, persons associated with the
problem
 Which associates are having difficulty?
 Who received the incident?

►What
 Describe the problem adequately
 Does the severity of the problem vary?
 Are operational definitions clear (e.g., timing)?
 Is there a check and balance?
 What type of problem is it?
 Is there more than one problem? Is the current process stable?

Bureau Veritas Presentation _ Date 17

Expanding Problem Statements

►Where
 Where is the problem located?
 What is the geographic distribution of the problem?
 Where in the process does the problem occur?
 Focus on the outcome of the process steps and verify that the data collected is
timely, meaningful, and accurate

►When
 Identify the time the problem started and its prevalence in earlier time periods
 Do all offices experience the same frequencies of the problem?
 What time of the year does the problem occur?

►How Many
 What is the extent of the problem?
 Is the process in statistical control? (e.g., SPC chart)

Bureau Veritas Presentation _ Date 18

Expanding Problem Statements

► Have the problem characteristics been identified?

► Has the problem been defined in measurable terms?

 Have trends been evaluated?
 What is the magnitude of the problem?
► Has the problem been subdivided into its smallest parts?

► What is the current impact on cost, productivity, clients, reputation, etc.?

► What is the urgency and seriousness of the problem?

► Is there a final, concise problem statement from which to measure

results?

Bureau Veritas Presentation _ Date 19

 Incident Specific
Correction / Containment Actions

Bureau Veritas Presentation _ Date 20

Correction / Containment

► These are actions taken related to the incident  “Incident

Specific Actions”
► Correction / containment actions are important

► Should be taken immediately to protect the internal or external

customer
- Start immediately after the report is issued
► Are generally of three types

1. “We corrected the certificate” or “We completed the form”

2. We corrected and reissued all applicable certificates

3. We added additional inspection to catch any further occurrence

Bureau Veritas Presentation _ Date 21

Correction / Containment

► Inspection adds cost to the system, not value

 If inspection is added, then it needs to be removed at the end of the
problem solving process
• The goal is not catching all the concerns, but making changes to the
system such that they can never recur again

► Define and implement containment to protect the customer until

corrective action is implemented

► Test containment (with data) for effectiveness and side-effects

► Establish exit criteria from containment

Bureau Veritas Presentation _ Date 22

 Correction / Containment

► Record what you did in the correction:

 Be specific and include data
 What was done about it, when, by whom

► Record the results of any actions (e.g., any analysis you did - quantity,
date, results, etc.)
► Has containment been documented, implemented, and verified to be
effective?
► Is relevant process data being collected during containment actions?

► Have customers (internal and external) confirmed effectiveness of

containment?

Bureau Veritas Presentation _ Date 23

Correction / Containment

► Has containment been documented, implemented, and verified

to be effective?
► Is relevant process data being collected during containment
actions?
► Have customers (internal and external) confirmed effectiveness
of containment?
► Validate effectiveness of containment after implementation

► Remove containment when Permanent Corrective Action is

implemented. Take off the Band-aid!
► If you determine that correction and/or containment are not
necessary, provide an explanation of why

Bureau Veritas Presentation _ Date 24

Systemic Root Cause Analysis

Bureau Veritas Presentation _ Date 25

Root Cause Analysis
► A proper root cause analysis answers this question: “What in the
system failed such that the problem occurred?”
► The focus is on the system, not the incident
► Root Cause Analysis requires effective problem solving
 Keep the method simple
• Don’t use lots of approaches
• Learn and use one or two  recommandation 5 Why’s

► Some Inhibitors to Effective Problem Solving:

 Jumping to conclusions
 Bias
 Lack of factual data
 No logical process
 Impatience
 Failure to use corrective actions

Bureau Veritas Presentation _ Date 26

5 Why’s

• Step 1: Start with the Problem Statement

• Step 2: Ask Why #1, record possible answers

• Step 3: For each answer, ask Why #2.

• Step 4: Record possible answers

• Step 5: Repeat Steps 3 and 4 until Why #5 is reached

– This will almost always be a systemic root cause

!!! Sometimes your answers to a 5-Why question may give you multiple
answers. It’s okay to branch off in more than one direction as long as you follow
each branch to the root cause. !!!

Bureau Veritas Presentation _ Date 27

5-Why Example A

• 1. Why were you late for work this morning?

– Answer: My car wouldn’t start.

• 2. Why wouldn’t your car start?

– Answer: The starter wouldn’t turn the engine over.

• 3. Why wouldn’t the starter turn the engine over?

– Answer: The battery was too weak to engage the starter. I had to get a
friend to jump start my car.

• 4. Why was the battery too weak to start the car?

– Answer: The alternator was not producing enough energy to keep the
battery charged.

• 5. Why was the alternator output low?

– Answer: The alternator drive belt was slipping.

Bureau Veritas Presentation _ Date 28

5-Why Example B

• 1. Why were the audit days inadequate?

– Answer: The employee headcount in our database was incorrect.

• 2. Why was the employee headcount incorrect?

– Answer: The number was old and had not been updated.

• 3. Why had the number not been updated?

– Answer: The auditor did not verify the number in the past.

• 4. Why didn’t the auditor verify the number?

– Answer: The auditor was not aware of our process.

• 5. Why wasn’t the auditor aware of the process?

– Answer: We did not include it as a requirement in the auditor work
instruction.

Bureau Veritas Presentation _ Date 29

Root Cause Analysis- Various Approaches

► Various Approaches for Root Cause Analysis:

 Nominal Group Technique (NGT)
 5 Why’s
 Ishikawa Diagram (Fishbone Diagram)
 Pareto Chart
 Multivoting

► Please refer to the file attached below for additional information:

2_RCA_5_Tools

Bureau Veritas Presentation _ Date 30

 Root Cause Analysis
► Look for Root Causes in Two Areas:
 Technical
• What problems with the process caused the failure?
 Detection
• What detection system failed (or should have caught the problem before it escaped)?

► Many Root Causes restate the incident or include Correction / Containment

Actions This is not acceptable
► Some problems may have multiple root causes  list each one

► A proper root cause analysis answers this question: “What in the system failed
such that the problem occurred?”  The focus is on the system, not the
incident. Blaming the employee / auditor will not be accepted as the only root
cause.
► In addition to your process, don’t forget to investigate the strength of your
documentation (i.e. work instruction, form, template, etc) to determine if it was
part of the problem
► If the same incident repeat after you thought it was resolved  refer to the
previous NCR for history

Bureau Veritas Presentation _ Date 31

Irreversible Corrective Action

Bureau Veritas Presentation _ Date 32

Corrective Action(s)

► Addresses the Root Cause(s)

► Should, therefore, address the question, “What in the system failed such that
the problem occurred?”
► Explains the changes to the system that have been tested and then
implemented to prevent further recurrence
► Not only addresses the system, but actions should be “irreversible”
 Should involve a change in the system
• Training is generally not a system change
• Publishing a newsletter is generally not a system change
• Incident specific actions are not irreversible
• Should include an addition or revision to documentation
► Many NCRs give Correction / Containment Actions for the Corrective Action
 not acceptable
► Some NCRs identify multiple root causes, but do not give corrective actions
for all the root causes  not acceptable

Bureau Veritas Presentation _ Date 33

Corrective Action(s)

► There should be at least 1 corrective action for each root cause that was
identified
► For each corrective action:
 Is the responsibility defined?
 Are the action steps spelled out?
 Is it clear how the results will be validated?
 Have Procedures, Work Instructions, Training, etc. been updated?
 Have procedures not only been written, but actually implemented?
 Does the customer agree that the problem has been eliminated?

► For a corrective action to be implemented, the verb tense used should be

the past tense. The work instruction was revised

► An action in the future tense is one that has not been implemented! The
work instruction will be revised. For actions planned for the future, always
include the timing

Bureau Veritas Presentation _ Date 34

Verifying Actions Taken

Bureau Veritas Presentation _ Date 35

Verifying Actions Taken

► This is a critical yet often not performed in the problem solving process

► You should verify that:

 Containment Actions have been taken
 Proper Root Cause Analysis has been performed (turn off / turn on)
 Irreversible System Corrective Actions have been actually and stay implemented
 Containment Actions have been removed

► !!! Corrective actions do disappear ! ! !

 “Systemic change” means that what you do and how you do it are impacted
 Change is difficult
 Systems tend to return to where people are comfortable

Bureau Veritas Presentation _ Date 36

3. Evaluating Non Conformity Response
Reviewing Problem Statements

When you review the Problem Statement, ask:

• Is there enough data to assist in understanding what happened? (i.e who,
what, where, when, how many, what caused the issue to occur)
• Is the problem statement expressed as a system issue or an incident
• Does the problem investigation and problem statement make sense? Are
any details missing?

Bureau Veritas Presentation _ Date 38

Reviewing Correction / Containment

When you review correction/ containment, ask:

• Has containment / correction been documented, implemented and verified to
be effective ?
• Are evidences provided to demonstrate implementation?
• Does containment / correction cover each issue found under the objective
evidence section ? If not, is an explanation provided ?
• Does the containment / correction make sense (=appropriate)?

Bureau Veritas Presentation _ Date 39

Reviewing Root Cause Analysis

When you review the root cause(s), ask:

• Does the root causes restate the incident or is it address a systematic issue?
• Does the root cause include correction / containment actions ?
• Does the root cause restate the problem or does it explain the cause of the
problem ?
• Does it make sense?
• Has it gone deep enough ? Think of the 5 Why’s. Which level is it at ?

Bureau Veritas Presentation _ Date 40

Reviewing Corrective Action(s)

When you review the corrective action(s), ask:

• Is the corrective action really in place?
• Is the language future or past tense ?
• Has evidence been provided ?
• Is there a corrective action that links to each root cause identified ? Clearly
identified ?
• Does the corrective action make sense ?

Bureau Veritas Presentation _ Date 41

Reviewing Verification actions

When you review the verification actions, ask:

• Are the corrective actions actually implemented ?
• Does the evidence show the corrective actions are in place and have stayed
implemented
• Does the verification make sense?

Bureau Veritas Presentation _ Date 42

Reviewing NC additional information and example
► Reviewing and closing non-conformities

1_Reviewing_CA

► Example of NCR

3_EXAMPLE_OF_N
CR

Bureau Veritas Presentation _ Date 43

EVALUATION TEST
► In the following pages you will find 3 Cases of closed
Nonconformance Reports, review them and when you are ready, take
the online Evaluation Test

3 NCRs for online

test

► Each question has 3 possible answers. Select the answer that best fits
the situation in the corresponding NCR Case.
► Acceptable result ≥ 75%

Bureau Veritas Presentation _ Date 44

Bureau Veritas Presentation _ Date 45