Using Indented Lists to Present Audit Evidence

[Originally published in 2015, but still works. I have used this method for every type of audit, and every possible standard. I’ve updated the article slightly. – CP]

Internal ISO 9001 or other QMS audits are always better when the reports include clear and accurate objective evidence; for external audits, this is actually mandatory. The reason objective evidence is important is twofold: first, it allows someone to verify the audit details at a later date. More importantly, however, it provides the auditee with critical information on what specifically was examined when a nonconformance is issued. Without indicating the evidence of what was found, the auditee can’t perform containment or proper correction of any problems identified.

Most auditors will complete their audit reports in an app like MS Word, but the following approach even works if you’re still filling out audit reports by hand. The method here relies on indented or “bulleted” lists to organize the evidence in a simple, yet powerful, way that keeps an auditor’s thoughts organized, and allows the auditee to read the data in an orderly fashion later.

Now here’s the thing: I like to record a lot of objective data, and I always advocate this for my clients or students. But you can tailor this to whatever level of data you intend on recording. This approach assumes there is space on your audit report form to record the data; if not, you may want to add a “Notes Page” or append a separate file with the data. Whatever works.

Organize your data by the process you are auditing or (if you’re hardcore oldschool) by clauses. No matter what proponents of either approach say, both work.

Then, begin to layer in your evidence starting with a master bullet that says what the subsequent bullets will be regarding. Below this top bullet, indent once and begin to add what you verified. As you read this, you will see I use the word “verified” a lot; it hammers home that the audit verified evidence, and didn’t just obtain the evidence. It’s also a practice that slowly trains your brain to reject any subjective opinions, and to spot areas where you didn’t actually “lay eyes” on evidence. Also, always be sure to indicate who you spoke with, as conversations are another form of evidence — not all forms of evidence are documents and records. My personal preference is to reference people by their titles, since some people feel nervous if their name appears in an audit report.

So we might begin to see something like this:

• Re: Purchasing process:
  • Interviewed Purchasing Manager
  • Verified Purchasing procedure rev 3
  • Verified procedure requires Approved Vendor Database entry
  • Verified Approved Vendor Database screens in the Purchax 3000 ERP system

Below that, layer in additional details of the specific evidence. When you have a finding of nonconformity or an opportunity for improvement, indicate them here. I like to add yellow highlighting to those, as it will help draw the eye to them.

• Re: Purchasing process:
  • Interviewed Purchasing Manager
  • Verified Purchasing procedure rev 3
  • Verified procedure requires Approved Vendor Database entry
  • Verified Approved Vendor Database screens in the Purchax 3000 ERP system
    • Verified entry for APE-X Company, compared vs. PO # 3453 – entry OK
    • Verified entry for Landlubber Rubber Scrubbers, compared vs PO # 4500 – entry OK
    • PO # 5544 was issued to Toxico Baby Wipes, for raw material P/N 400-876353, but Toxico is not listed in the Approved Vendor Database.
    • Verified Approved Vendor Database is on a server subject to backups
    • OFI: some Purchasing staff reported the size of the Approved Vendor Database fields are too small and data entry errors are not easily spotted.
• Re: Customer Service process:
  • Interviewed Customer Service Manager
  • Verified procedure SOP 99-43 rev A
  • Verified Customer Complaint Log, live data with entries as of today

And so on. You will eventually build up a long list of evidence, but one that is easily navigable and read by the auditee and top management.

Regarding the findings of nonconformity, which (again) I highlighted: when you are recording your evidence, you can do so in a free-form manner. Later, when you want to write these as formal requests for corrective action, you can go back and see the text you highlighted. Then, craft the “official” nonconformity write-up providing the three minimum required elements of a nonconformity: the objective evidence, the requirement, and an explanation of the disconnect between the two.