It has happened to every quality professional. You are standing in the audit room, or on the shop floor, or in the documentation library, and you feel the air change. The auditor has found something. Not a minor nonconformity — the kind you can explain away with a corrective action and a revised procedure. Something real. Something you knew about, or should have known about, or suspected existed but chose not to investigate because the investigation itself would have opened a door you were not ready to walk through.
I have been on both sides of this moment. As a quality director at Airbus, I have been the auditee. As a certified lead auditor, I have been the one holding the file. I can tell you that the moment of discovery feels the same on both sides — a sharp, silent pressure in the chest, followed by the rapid mental calculation of consequences.
Here is what I have learned about that moment, and why it matters more than any other moment in your quality career.
The thing you are afraid of is never the thing they find
Before every major audit, I sit with my team and we do a simple exercise. I ask: "What are we afraid they will find?" We list the areas, the processes, the records, the physical locations that worry us most. Then we prioritise our preparation around those areas.
In twenty years of doing this, the auditor has almost never found the thing we were afraid of. Because we were afraid of it, we had already looked at it, probed it, shored it up. The auditor finds the thing we were not afraid of — the thing that was so comfortable, so routine, so "obviously fine" that we never thought to question it. The procedure that has been in place for nine years and was never updated after the process changed. The calibration record that was signed by a technician who left the company two years ago. The supplier on the approved list whose last performance review was conducted by someone who has since been promoted and delegated the task to nobody.
The finding that hurts is never the one you prepared for. It is the one that was hiding in plain sight, protected by its own ordinariness.
The Slovak supplier audit, 2019
In 2019, I was leading a supplier audit at a precision machining company in eastern Slovakia. The plant was clean, organised, well-staffed. The quality manual was current. The control plans were thorough. The inspection records were complete. Everything pointed to a well-run operation.
On the second day, the auditor — a colleague from our customer quality team — asked to see the training records for the operators of a particular CNC cell. The HR manager produced them promptly. Every operator was trained, assessed, and signed off. The auditor flipped through the records and then asked a simple question: "Who conducted the competence assessment for operator number four?"
The HR manager looked at the record. The assessor signature was from a supervisor who, according to the HR system, had transferred to a different department three months before the assessment date. The assessment had been backdated — not maliciously, not to deceive, but because the actual assessment had been done informally on the shop floor and the paperwork was completed later, with the wrong name carried over from a template.
This was a minor administrative error. But it was a finding. And the auditor, doing their job correctly, escalated it: if the competence assessment record was unreliable, how could we trust that the operator was competent? And if we could not trust competence, how could we trust the parts?
The finding cascaded. We had to pull the last ninety days of production from that cell, initiate a containment action, and re-verify every part. It cost six weeks of engineering time and a significant customer credit. The root cause was not a quality failure. It was a paperwork shortcut.
The three responses to a major finding
When an auditor finds the thing — the real thing, not the minor nonconformity — I have seen three responses from quality leaders. Only one of them is correct.
Response one: defend. The quality leader argues. They explain why the finding is not valid, why the auditor does not understand the context, why the standard does not actually require what the auditor thinks it requires. This response is driven by ego and fear. It never works. The auditor has the finding, and arguing makes it worse because it signals that the organisation does not understand the requirement — which is itself a finding.
Response two: minimise. The quality leader accepts the finding but immediately downgrades it. "This is an isolated incident." "This is a documentation issue, not a product issue." "This affected three parts, not three hundred." This response is driven by damage control. It sometimes works in the short term — the auditor may narrow the finding — but it is catastrophic in the long term because it tells the organisation that findings are PR problems to be managed, not quality problems to be fixed.
Response three: own it. The quality leader says: "You are right. This is a real finding. Thank you for finding it. Here is what we are going to do about it." This response is driven by integrity. It is the hardest response because it requires you to stand in front of your management team and say, publicly, that something is broken. But it is the only response that converts a finding into an improvement.
The finding that saved a product line
In 2021, an IATF surveillance audit at one of my plants produced a major nonconformity against the control plan. The auditor found that the control plan specified an in-process inspection that was not being performed. The inspection — a dimensional check on a critical bore diameter — had been dropped six months earlier when the line was rebalanced for higher throughput. The engineering change that rebalanced the line did not include a review of the control plan. The control plan still called for the check. Nobody was doing it.
The finding was serious. A missing control plan execution is a major nonconformity under IATF 16949, and it triggers a set of requirements that include containment, notification of affected customers, and a corrective action with root cause analysis. My plant manager wanted to minimise it. My quality team wanted to defend it. I chose to own it.
We notified the customer. We contained the last six months of production and re-inspected every part — found three nonconforming bores that had escaped detection. We conducted a root cause analysis that revealed a systemic gap in our engineering change process: control plans were not automatically included in the change review. We fixed the process, and the fix applied to all twelve product lines, not just the one that was audited.
The auditor's finding prevented a field failure. Those three nonconforming bores, if they had reached the customer, would have caused an assembly line stoppage. The cost of that stoppage would have been ten times the cost of the corrective action. The auditor was not our enemy. The auditor was the only person in the last six months who had looked at the control plan and compared it to what was actually happening on the shop floor.
What the finding is really telling you
When the auditor finds the thing — the real thing — it is telling you something that your management review did not catch, your internal audit did not catch, and your daily walk-through did not catch. It is telling you that your self-assessment processes have a blind spot. And that blind spot is almost always the same: the distance between what the system says and what the floor does.
Every major finding I have received in twenty years has, in retrospect, been a gift. Not because it felt good at the time — it never does. Because it revealed a gap that I could not see from my position. The auditor sees the system from the outside. They are not invested in the system working. They are not emotionally attached to the procedures they wrote or the processes they approved. They see what is there, not what is supposed to be there.
The quality leaders who fear auditors are the ones whose systems are built on the assumption that the system works. The quality leaders who welcome auditors are the ones who know that every system has gaps, and who would rather find those gaps in an audit than in a customer complaint, a field failure, or an accident investigation.
When the auditor finds the one thing you hoped nobody would find, do not flinch. Do not defend. Do not minimise. Say thank you, write the corrective action, and fix the system. That is the job. Everything else is paperwork.
