I answered that they did not find NCs that existed in the system, but I don't feel that is a problem. Auditing is by nature a sampling activity, and there is no way in a couple days that an auditor is going to find every NC in a company. It would be totally unrealistic to expect them to do so.
Internal audits should find more NCs if they are done correctly, and that is why registrars always check internal audits on every visit. But even a thorough internal audit program will miss some NCs.
I don't think it is necessary to find every single NC at the moment it occurs. The important thing to to keep getting better, keep uncovering and fixing problems, and never assume that an audit with no NCs means there were none to be found.
FWIW - I did an internal audit about a week after our final 9001:2000 transition audit and I found a glaring omission in our QSM - something that has to be there but was not. We fixed it, of course, and it was an easy fix. But it could have held up our certificate if our registrar had noticed it.
Nothing is ever perfect.
Ed Gibbs