an auditor can report an identified risk to prevent a potential nonconformity
After investigating the effectiveness of risk assessment, the auditor may more usefully report a nonconformity for corrective action.
an auditor can report an identified risk to prevent a potential nonconformity