Auditors raise OFIs where a requirement is met but the practice is weak, inefficient or likely to slip, for example a risk register that is accurate but hard to keep current. The organization decides whether to act on them, and auditors avoid prescribing solutions because that would compromise their independence.
Ignoring the same OFI year after year can become a finding if the weakness it pointed at turns into a gap. See minor nonconformity.
Read more
Related terms
- Minor nonconformity
- A minor nonconformity is an audit finding of a single lapse or partial gap against a requirement that does not undermine the management system as a whole.
- Nonconformity
- A nonconformity is a failure to meet a requirement of a management system standard or of the organization's own documented management system.
- Surveillance audit
- A surveillance audit is the yearly audit a certification body performs between ISO certification audits to confirm the management system is still maintained.
- Internal audit
- An internal audit is an organization's own planned review of whether its management system or controls conform to its requirements and work as intended.