Major and minor nonconformities: what an audit finding actually commits you to

A nonconformity is non-fulfilment of a requirement, supported by audit evidence. Major and minor nonconformities commit you to different work. A minor obliges you to produce a plan for correction and corrective action that your certification body accepts. A major obliges you to complete the action and have its implementation verified before a certification decision goes your way, and where several sites sit under one certificate, a major at one site holds up the whole listed organisation.

The window for closing a finding comes from your certification body. It is written into your contract and your audit report rather than into the standard, so two entities in one group using different bodies can be working to different windows. Read the report before you agree a plan.

What a properly documented nonconformity contains

The ISO 9001 Auditing Practices Group set out the anatomy in guidance published on 13 January 2016. Its papers describe how auditors should work rather than the text of any standard, which is why they are familiar to anyone audited against ISO 27001.

The guidance quotes the definition in ISO 9000 as "non-fulfillment of a requirement".

Three things have to be on the page:

"There are three parts to a well-documented nonconformity:
• the audit evidence to support auditor findings,
• a record of the requirement against which the nonconformity is detected,
• the statement of nonconformity."

The middle one is worth checking first: "if the auditor cannot identify a requirement, then the auditor cannot raise a nonconformity". That requirement can come from ISO 9001, from your own management system, from regulation or from a customer. A finding that names none of those is unfinished.

The statement carries the weight. It "drives the cause analysis, correction, and corrective action by the organization, so it needs to be precise", and should "not be a restatement of the audit evidence".

Correction, root cause and corrective action are three different things

The Group's guidance on reviewing and closing a nonconformity quotes ISO 9000 for all three terms:

"Nonconformity: non-fulfillment of a requirement
Correction: action to eliminate a detected nonconformity
Corrective action: action to eliminate the cause of a nonconformity and to prevent recurrence."

Correction deals with what the auditor found. Corrective action deals with why it was there. The cause analysis sits between them and decides whether the second one works. "Corrective action cannot be taken without first making a determination of the cause of nonconformity", and "The extent and effectiveness of the corrective actions depends upon identifying the true cause".

Two failure modes get named. The organisation "should not be identifying the first failure factor it finds as being the root cause". And an auditor checks whether the cause "was systematic in nature or merely accidental", because a systematic failure treated as a one-off is free to recur.

One line in the guidance is aimed squarely at technology businesses: "for software, it is inadvisable to implement a correction until the cause is known". Where the cause is an exposure you already carry, it belongs on the risk register too.

Major and minor nonconformities: what each grade triggers

Certification bodies working to ISO/IEC 17021-1 grade findings as major or minor, and the IAF mandatory documents sitting on top of that standard attach different consequences to each. A finding is major where it affects the management system's capability to achieve the results it is supposed to achieve.

The asymmetry is clearest in the rules for moving between certification bodies. IAF MD 2:2023, Issue 2, Version 2, clause 2.3.1, applying clause 9.5.2 of ISO/IEC 17021-1:2015:

"the accepting certification body shall not issue certification to the transferring client until:
(i) it has verified the implementation of corrections and corrective actions in respect of all outstanding major nonconformities; and
(ii) it has accepted the transferring client's plans for correction and corrective action for all outstanding minor nonconformities."

A major has to be done and checked. A minor has to be planned and agreed, and proved later. Proof that the plan worked usually arrives at the next audit, though your certification body decides. See major and minor nonconformities carried into a surveillance audit.

When an opportunity for improvement is really a nonconformity

An opportunity for improvement is a different category of finding. Once audit evidence shows non-fulfilment of a requirement, the finding is a nonconformity whatever the report calls it.

The Group is blunt about the temptation to reclassify. Without audit evidence there is no nonconformity; with evidence, the finding should be documented as a nonconformity instead of being softened into an observation or a recommendation:

"In the longer term, neither the organization, its customers, nor the CRB benefit by the use of softer classifications, as this risks the nonconformity being given a lower priority for corrective action."

CRB is the paper's own abbreviation for the certification body; the expansion is ours. Where the report labels a finding an opportunity for improvement and the auditor has recorded evidence that a requirement was not met, the guidance's own test makes it a nonconformity, and it is fair to say so at the closing meeting.

What closure actually requires

The auditor works to a list that doubles as your drafting checklist. Two of its items carry most of the weight:

"the use of the past tense (was, has or have been, were), as an indicator that the actions taken have been completed.
the date of completion of the corrective actions; past dates should be found that indicate that the actions have been taken (dates indicating future action are not good practice)."

Plans written in the future tense fail on both lines. An undertaking to introduce access reviews describes an intention. A record of access reviews carried out on named dates, with the evidence attached, describes a completed action, and only the second one closes.

Closure is a judgement about evidence. An auditor reviews what was done "in respect of containment, correction, cause analysis and corrective action results" and looks for objective evidence "to demonstrate that the described corrective action has been fully implemented and is effective in preventing the nonconformity from re-occurring". Whether the auditor comes back to site depends on what would demonstrate that. Some closures "will require direct examination on site", others "may be closed-off remotely".

Where a nonconformity was raised last time, guidance from the same Group on audit reports requires the next report to comment on "whether confidence has been restored in the organization's own ability to identify potential nonconformities". By then, the people who wrote the plan may have left.

One site's finding, the whole certificate

A multi-site organisation, in the words of IAF MD 1:2023, Issue 3, issued 18 October 2023, is "covered by a single management system comprising an identified central function" and a number of sites where the work is done. A group holding three separate ISO 27001 certificates for three legal entities sits outside those rules; that ground is covered in managing compliance across multiple entities and products.

Inside a multi-site certificate, one site's finding becomes everyone's. Clause 7.7.1 requires an investigation into whether other sites are affected, and it applies to findings raised "either through the organization's internal auditing or from auditing by the Certification Body". Where the finding indicates a system deficiency, corrective action is performed and verified at the central function and at each affected site. Where it does not, the organisation has to justify limiting its follow-up.

Clause 7.7.2 sets the consequence: the certification body "shall require evidence of these actions and increase its sampling frequency and/or the size of sample until it is satisfied that control is reestablished". In practice that is a wider sample of the group, taken more often.

At the certification decision, clause 7.7.3 applies: "if any site has a major nonconformity, certification shall be denied to the whole multi-site organization of listed sites pending satisfactory corrective action." Clause 7.7.4 rules out excluding the problematic site from the scope to get past the finding.

IAF MD 11:2023, Issue 3, clause 2.5, adds a duty where two standards are audited together: the certification body must "consider the impact that a nonconformity found for one of the management system standard(s)/specification(s) has on the compliance with the other ...".

Holding the record in Naq

Naq's corrective and preventive action register uses the words the auditor wrote on the report: Minor, Major and OFI. A finding from an external audit goes in under the Other source type, with free text for where it came from.

Root cause is a required field before a CAPA can move to In Progress, which puts the cause ahead of the corrective action in the register as well as in the guidance. Action items carry an assignee, a target date and a status. Overdue ones are surfaced in the register list view. The evidence that the action worked sits on a control, and in the version history of the document that changed. Every meaningful action is written to the record's activity stream, and records are archived instead of deleted.

Naq gets an organisation audit-ready against ISO 27001, ISO 9001, UK GDPR, Cyber Essentials and the NHS DSPT; the ISO certificates come from a certification body accredited by UKAS. If you are carrying open major and minor nonconformities and cannot say from one place what was found, why it happened and what was done about it, book a fifteen-minute demo and bring your last audit report.