I'd have thought you only really need two categories, NC & OFI/Recommendation. Record anything that is wrong with your system/process is recorded as a NC, you don't need to record things that are right. OFI or recommendation is where the auditor has used their experience or outsider's viewpoint to see where there is a better way, something that makes the process or system element better performing. It could be an improvement that saves the company money/reduces the costs or makes the system more robust. If acted upon it improves things but if not acted upon there is still no NC caused.
Mind you, if the auditor sees something that is not a NC but believes will become a NC later on then they should act. Perhaps that too is an OFI or is it still a NC?
There are some internal auditors out there who assume that OFI's should
only be written up for nonconforming situations. But even some conforming situations can use improvement, too. In reality, I have written up numerous OFI's for conforming situations where I happened to have sufficient knowledge of the situation to provide my expertise. Did the process owners have to follow my advice? No, but they did nonetheless, and they realized some small benefits.
Why are auditors encouraged to do this? (1)To enable process owners to rise above just doing the bare minimum, and (2) to provide a helping hand as a fellow member of the organization. Internal auditors should be objective when they are auditing, but when it comes down to recommending improvements, auditors must also realize that they are playing for the same team as their fellow co-workers - provide that "helping hand" and not act like they are on the outside of it looking in.
This is an essential hallmark of good auditing, IMHO.
Brian
