Quality Management System Audit Findings: Which Gaps Show Up Most Often?

Most organisations do not fail a quality audit because of one dramatic error. They collect findings in the same quiet places, year after year: an old procedure still in use, a training record that was never filed, a corrective action that fixed the symptom and not the cause. Auditors who work across many industries see these patterns repeat.

This article explains the gaps that show up most often in quality management system audits, especially under ISO 9001, the most widely used quality standard. It also shows why each gap happens and what a practical fix looks like, so the same finding does not return at the next audit.

How Audits Sort Their Findings

A quality management system, or QMS, is the set of processes, documents, and responsibilities an organisation uses to deliver consistent quality. An audit checks whether that system meets the standard and whether people actually follow it in daily work.

Audits come in three main types. Internal audits are run by the organisation itself, or by auditors hired on its behalf, to find gaps before outsiders do. Second party audits are run by a customer on a supplier. Third party audits are run by an accredited certification body, which can grant or maintain ISO 9001 certification, with surveillance audits during the cycle and a full recertification audit every three years.

Findings are graded. A major nonconformity means a requirement is missing or has broken down in a serious way, or that there is real doubt the system can deliver conforming output. A minor nonconformity is a smaller lapse that does not by itself break the system. Auditors also record observations, which are risks or chances to improve rather than failures. The gaps below are the ones that most often sit behind both major and minor findings.

Gap One: Document Control and Missing Evidence

Weak control of documented information is consistently among the most cited findings in ISO 9001 audits. Auditors find outdated procedures still in use at workstations, documents with no version number or approval, uncontrolled copies and templates, and records that cannot be found when asked for.

The deeper problem is a mismatch. The documented procedure says one thing and the team does another. Sometimes the document is wrong and the practice is sensible but was never written up. Sometimes the document was updated by one department and the change was never shared, so other teams keep working to the old version.

Missing evidence is the close cousin of this gap. Work was done, but there is no record to prove it: inspection logs left blank, calibration certificates out of date, training attendance not recorded, and corrective action closures with no file attached. Auditors work from objective evidence. If it is not recorded, from an audit point of view it did not happen.

The fix is basic discipline. Give each document an owner, a version, and an approval. Keep one clear place for current versions, remove or mark old copies, and train staff to use only the latest document. Set retention rules for records and test them by asking for old records before the auditor does.

Gap Two: Corrective Actions That Fix Symptoms

Auditors regularly find corrective actions that treat the surface of a problem. A faulty batch is remade, a form is corrected, a worker is reminded to be careful, and the case is closed. Months later the same problem appears again, because the root cause was never found.

ISO 9001 clause 10 expects more: react to the problem, find its root cause, act to stop it recurring, and then verify that the action worked. Skipping the last step is especially common. Actions are closed on the planned date rather than after a check that the problem has actually stopped.

Practical fixes use simple structured tools. The 5 Whys method asks why a problem happened, again and again, until the answer points to a process cause rather than a person. A fishbone diagram groups possible causes under headings such as method, machine, material, and people. Either tool is fine. What matters is that the analysis is recorded, actions have owners and deadlines, and someone checks effectiveness after enough time has passed for the result to show.

Gap Three: Weak Internal Audits and Management Reviews

Internal audits are meant to be the organisation’s own early warning system, yet auditors often find them weak. Common problems include audit programmes that do not cover all processes in the cycle, checklists that stay at surface level, auditors auditing their own work, auditors without proper training, and findings from internal audits left open without follow up.

When internal audits are shallow, the external audit becomes the first real test, and its findings come as a surprise. Strong programmes train auditors, keep them independent of the area they audit, spread audits across the year, and track every finding to closure.

Management review has a similar pattern. Clause 9.3 requires top management to review the QMS at planned intervals, using defined inputs such as audit results, customer feedback, process performance, nonconformities, and risks and opportunities. Findings arise when reviews are overdue, minutes skip required inputs, or the meeting records talk but no decisions, actions, or resource choices. A review that produces no outputs is a meeting, not a management review.

Related gaps appear in quality objectives. Objectives that are not measurable, not monitored, or not linked to the organisation’s direction draw findings under clause 6. An objective you cannot measure cannot show improvement, and improvement is the point of the system.

Gap Four: Competence, Training, and Risk Based Thinking

Competence gaps appear when people do quality critical work without records that show they can do it. Auditors find training files that do not match the person’s actual role, new staff working before their training is complete, and no defined competence criteria for key jobs. Clause 7.2 does not demand training courses for everything. It demands that the organisation decide what competence each role needs, make sure people have it through education, training, or experience, and keep evidence.

Risk based thinking is another frequent weak spot. It entered ISO 9001 in the 2015 revision, in clause 6, yet many organisations still treat it as paperwork. Auditors find risk registers that were written once for certification and never reviewed, risks with no actions attached, and no link between the risks listed and the decisions the business actually makes.

Calibration and process control belong in this group too. Missing or expired calibration records for measuring equipment, undocumented process changes, and processes with no clear owner or performance measure are regular findings in manufacturing and service settings alike. Each one breaks the same chain: define the process, control it, measure it, and keep the proof.

Leadership sits behind many of these gaps. When top management treats the QMS as the quality department’s job, reviews get thin, resources get delayed, and objectives drift away from business goals. Auditors notice, and clause 5 gives them the ground to raise it.

How to Close the Gaps Before Your Next Audit

Start with a honest internal audit cycle. Audit each process against both the standard and your own procedures, record what you find, and fix findings with the same root cause discipline you would want to show an external auditor.

Then work the short list that covers most findings. Sweep work areas for outdated documents. Sample records at random and try to retrieve them fast. Review open corrective actions and ask whether effectiveness was ever checked. Check that training records match the people actually doing each job today, including recent starters. Confirm the last management review covered every required input and produced actions with owners.

Finally, treat every finding as free information. The same gap found in three departments is rarely three separate mistakes. It is usually one system weakness, such as poor communication of document changes, showing up in three places. Fix the system cause once and the finding stops travelling.

FAQs

What is the most common ISO 9001 audit finding?

Weak document control is the finding auditors and consultants cite most often: outdated procedures in use, missing approvals or version control, and records that cannot be produced. Corrective action and internal audit weaknesses follow close behind.

What is the difference between a major and a minor nonconformity?

A major nonconformity shows a missing or seriously broken requirement, or real doubt that the system can deliver conforming output. A minor nonconformity is a limited lapse that does not by itself undermine the system. Both need corrective action.

Why do the same findings repeat every year?

Usually because corrective action stopped at the symptom. The faulty item was fixed, but the process cause, such as unclear ownership or missing training, was never changed, so the problem returns in a new form.

How can a small company reduce audit findings?

Keep the system simple and current. Use short controlled documents that match real practice, keep training and calibration records in one place, run real internal audits, and hold management reviews that end with clear decisions and actions.

You may also read: When Should You Hire a Real Estate Agent?

Final Thoughts

The most common QMS audit findings are not exotic. They are document control, missing evidence, shallow corrective action, weak internal audits and management reviews, training gaps, and risk registers that nobody updates. Any experienced auditor could write that list before entering the building.

That is good news, because predictable gaps are preventable gaps. An organisation that keeps its documents current, keeps its records, and fixes causes instead of symptoms will still get findings from time to time, but they will be new and smaller ones. And that steady closing of gaps is exactly what a quality management system is for.