Internal audit · findings

Three levels, and what each one actually means

Observation
Also called an opportunity for improvement
Example

Your policy says quarterly access reviews. You do them monthly, so the document is out of date.

Nothing is broken. Tidy it up when you can.
Minor nonconformity
A single slip in something that works
Example

Your rule gives two working days to remove a leaver's access. For one leaver it took eleven.

Fix the case, then fix the cause.
Major nonconformity
Missing altogether, or failing everywhere
Example

No access reviews have ever been run, or there is no risk treatment plan at all.

At a certification audit, this holds up the certificate.