Quick answer: A nonconformity is an audit finding that a requirement isn't being met. That requirement might come from the ISO standard, your own documented processes, or a legal or customer obligation. In certification audits, findings are graded as major or minor. For a major, the certification body must review, accept and verify your correction and corrective action before granting certification or recertification. For a minor, it normally reviews and accepts your plan, then checks it later. Closing a finding out means fixing the immediate problem, finding the root cause, taking action on that cause and showing the action worked.
Few things worry a business more than an auditor saying "nonconformity" at the closing meeting. This guide explains what a nonconformity is, how major and minor findings are graded, and how to write a corrective action that can be verified and closed.
What counts as a nonconformity
In ISO terms, a nonconformity is the non-fulfilment of a requirement. Most people think of the standard itself, but auditors also test you against the system you wrote. If your procedure says plant pre-start checks are done every shift and the records show gaps, that's a nonconformity even though ISO never told you to check every shift. You set the requirement, and you didn't meet it.
Findings can also come from legal and customer requirements your system says you comply with. That's why a tidy manual doesn't protect you on its own. The audit looks at what actually happens, which is the same point we made in our guide on how to prepare for an ISO certification audit.
Major vs minor: how findings are graded
ISO 9001, ISO 14001 and ISO 45001 don't define "major" and "minor" themselves. In certification audits, certification bodies grade findings under ISO/IEC 17021-1, the standard they're accredited against.
- Major nonconformity: a nonconformity that affects the capability of the management system to achieve its intended results. ISO/IEC 17021-1 notes this can include situations where there's significant doubt that effective process control is in place, or where several minor findings against the same requirement show a systemic failure.
- Minor nonconformity: a nonconformity that doesn't affect that capability.
Grading isn't automatic. A missing internal audit program or a management review that has never been held may indicate a major nonconformity, but the auditor decides based on the evidence and how far the gap affects the system as a whole. A single overdue record is more likely to be graded minor, but again, it depends on the evidence.
Your own internal audits don't have to use the certification body's grading. You can classify internal findings using your organisation's own approved methodology, as long as it's applied consistently.
What a nonconformity means for your certificate
At initial certification and recertification, the two grades are treated differently. For a major, the certification body must review, accept and verify your correction and corrective action before it can make a positive certification decision, which sometimes means a follow-up visit. For a minor, it reviews and accepts your plan for correction and corrective action, then verifies implementation and effectiveness later, usually at the next surveillance audit.
A major raised at a surveillance audit puts an existing certificate at risk until it's resolved. Response timeframes are set by each certification body, so check your audit report for the dates that apply to you.
Correction, root cause, corrective action and effectiveness
Clause 10.2 of ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018 sets out what's expected when a nonconformity occurs. In practice, it breaks into four parts:
- Correction: fixing the specific problem in front of you, such as completing the missed inspection or updating the out-of-date register.
- Root cause: working out why it happened, and whether the same problem exists or could occur elsewhere.
- Corrective action: action on the cause so it doesn't happen again.
- Effectiveness verification: checking, after a reasonable period, that the action actually worked, and keeping documented evidence.
ISO 45001 adds a worker participation requirement. Non-managerial workers are expected to participate in investigating incidents and nonconformities and in determining corrective actions (clause 5.4), and clause 10.2 calls for worker participation when evaluating the need for corrective action. That ties in with your wider arrangements for consulting workers on safety.
A worked example
Here's how a straightforward finding might be written up and closed:
| Finding | Weekly forklift pre-start checks required by procedure WP-07 were not recorded for 3 of the last 8 weeks at the warehouse. |
|---|---|
| Evidence | Pre-start logbook for forklift FL-2; auditor interview with the warehouse supervisor. |
| Correction | Forklift FL-2 inspected and the result recorded on the day of the audit. |
| Extent check | Logbooks for the other two forklifts and the second site reviewed. One further gap found and corrected. |
| Root cause | Checks were done by the regular operator. When he was on leave, relief operators weren't told the check was required, and the logbook wasn't kept with the forklift. |
| Corrective action | Pre-start check added to the relief operator handover, logbook fixed inside the forklift cab, and the supervisor reviews logbooks weekly. |
| Action owner and due date | Warehouse supervisor, within four weeks. |
| Effectiveness check | Health and safety coordinator samples logbooks for all forklifts at 4 and 12 weeks. No missed checks means the action is effective. |
Why corrective actions get knocked back
Auditors see the same weak responses again and again:
- The root cause is recorded as "human error" or "staff forgot" without asking why the system allowed it.
- The corrective action is just the correction repeated, such as "inspection completed".
- Retraining is the answer to everything, even when the real cause is an unclear procedure or an unrealistic schedule.
- Nobody checked whether the same gap exists elsewhere.
- There's a plan and a due date, but no evidence that anything changed.
If you're working toward certification or carrying open findings from a recent audit, our ISO certification support covers gap analysis, corrective action planning and audit preparation for ISO 9001, ISO 14001 and ISO 45001.
Frequently asked questions
Can you lose ISO certification over a minor nonconformity?
Not usually on its own. A minor is normally managed through an accepted plan for correction and corrective action, which the certification body verifies later. If minors aren't addressed, or the same issue keeps coming back, they can be graded as a major at a later audit.
What's the difference between a nonconformity and an opportunity for improvement?
A nonconformity means a requirement isn't being met. An opportunity for improvement (sometimes called an observation) is a suggestion where the requirement is being met but could be done better. Opportunities for improvement don't normally need formal corrective action, but it's worth recording what you decided to do with them.
How long do we have to respond to a nonconformity?
Each certification body sets its own timeframes, and they're usually shorter for majors. Your audit report or the closing meeting should confirm the dates. If you're unsure, ask before the closing meeting ends.
Sources: ISO/IEC 17021-1:2015, Conformity assessment: Requirements for bodies providing audit and certification of management systems (definitions 3.12 and 3.13; certification decision 9.5). ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018, clause 10.2; ISO 45001:2018, clause 5.4.
This article is general information, not legal advice. Last reviewed 29 October 2026.