ISO 14001 nonconformities: major, minor, and how to close them without putting the certificate at risk

Major or minor: how an environmental finding is graded

A nonconformity is simply a requirement that has not been met, whether it comes from ISO 14001 or from your own system, such as a monitoring frequency in a permit procedure. ISO/IEC 17021-1, the standard against which certification bodies are accredited, defines both grades. A major nonconformity "affects the capability of the management system to achieve the intended results"; a minor one leaves that capability intact.

For an EMS, a gap that leaves a permit limit unmonitored weighs far more than a late signature. The accreditation standard points to two routes to a major: serious doubt that a process is effectively controlled, and a cluster of minors against the same requirement that together reveal a systemic failure. An opportunity for improvement sits outside both grades: it needs no formal reply and does not affect the certification decision.

How a nonconformity is written

Under the accreditation rules each finding must name the requirement concerned, state the nonconformity clearly and identify the objective evidence in detail. A well-formed ISO 14001 finding therefore reads in three parts:

• Requirement: clause 9.1.2, Evaluation of compliance: the organisation evaluates whether its compliance obligations are met and keeps evidence of the results.
• Evidence: the site's discharge consent sets quarterly effluent sampling; results were available for two of the last four quarters, and no evaluation of compliance had been recorded for the consent this year.
• Statement: the organisation could not show that it had evaluated fulfilment of its discharge consent conditions.

The auditor must go through each finding with you to confirm the evidence is right, which is your chance to produce a laboratory report the auditor missed. The auditor may not suggest the cause or the remedy.

Correction, root cause and corrective action under clause 10.2

ISO 14001:2026 places the requirement in clause 10.2, Nonconformity and corrective action, whoever raised the finding: the certification auditor, a regulator, a complaint or your own internal audit. Continuing the effluent example:

Correction: contain the instance and its consequences

Commission the missing samples now, compare the results with the consent limits and record a compliance evaluation for the consent. If a result exceeds a limit, deal with the discharge itself and any duty to notify the regulator.

Root cause: why the sampling slipped

Keep asking why until the answer is a process, not a person. Suppose the quarterly sampling relied on one laboratory contact who had left the contractor, and the compliance obligations register listed the consent without linking it to a monitoring schedule. Then check whether the same weakness exists for other permits and sites.

Corrective action: remove the cause for good

Link each permit condition in the register to a scheduled monitoring task with an owner and a deputy, and add the evaluation of compliance to the monthly environmental review. "Reminded the environmental officer" is not a corrective action. Later, review whether the action worked, and keep the records.

Response deadlines and the evidence that closes a finding

ISO 14001 sets no response period. The certification body does, and states it at the closing meeting as the timeframe for your plan of correction and corrective action. It differs between bodies and grades, so confirm it in writing. It then verifies that your actions worked, by a further full audit, a limited follow-up visit or documented evidence.

Evidence that closes a finding proves something has changed. Promises and plans do not:

• records created after the audit, such as the new laboratory results and the signed compliance evaluation;
• the revised control itself, with its new revision and approval, such as the updated obligations register;
• the first completed records produced under the revised control, never an empty template;
• for effectiveness, monitoring data over enough time to show the gap has not reopened.

Eight typical ISO 14001 findings, with correction and corrective action

These are composites of findings raised across sectors, not extracts from any one report. Grades assume an isolated finding; the certification body decides each case.

What an unresolved major costs you

Before the first certificate

The certification body cannot decide in your favour while a major is unverified. If it cannot verify the correction and corrective action within six months after the last day of Stage 2, a fresh Stage 2 is required before certification can be recommended.

During the certificate's life

Leaving a major open past its deadline is one way to fail certification requirements, which is a recognised ground for suspension. While suspended, the certification is temporarily invalid and cannot support a tender or a customer's supplier assessment. If the matter is not resolved, the certificate is withdrawn or its scope reduced.

At recertification

Any major raised at the recertification audit has to be corrected and verified before the certificate expires, or the certificate is not renewed. Certification can be restored within six months of expiry once the outstanding work is done; after that, at least a Stage 2 is needed. The surveillance and recertification guide covers the full three-year cycle.

Keeping findings few, and minor

Most environmental majors can be predicted months ahead: an unevaluated site, a fire-only emergency plan, or small waste-handling lapses that add up to one systemic weakness. Let your internal audit reach every site and significant aspect first, and close actions only when the evidence exists. The common mistakes guide lists the ten that most often fail audits, and the audit questions guide shows the evidence auditors ask for.

ISO 14001 nonconformities: questions buyers ask