ISO 45001 guide
ISO 45001 nonconformities: major, minor, and how to close them with evidence from the workplace
Clause by clause: ISO 45001 Clause 10.2: Investigate Incidents and Test Actions →
How certification bodies grade ISO 45001 nonconformities, why many are raised on the site tour, correction versus corrective action under clause 10.2, the evidence that closes a finding, six typical findings and what an open major costs.
Key points
- ISO 45001 nonconformities are graded by the certification body under ISO/IEC 17021-1: a major one undermines the ability of your OH&S management system to deliver its intended results, a minor one does not.
- Many OH&S findings are raised on the shop floor, not at the desk, because the audit includes seeing work being done at your facilities and work sites.
- ISO 45001 puts incidents and nonconformities in one clause, 10.2, so the same discipline applies to both: make the situation safe, investigate with workers, remove the cause and check the fix worked.
- Before a certificate is granted, every major must be verified as closed and every minor needs an accepted action plan; a major still open six months after Stage 2 means repeating Stage 2.
What makes an ISO 45001 finding major or minor?
In certification language, a nonconformity means a requirement was not met, whether it comes from ISO 45001, from a legal duty your system commits you to, or from your own procedure. The certification body decides the grade, using the definitions in ISO/IEC 17021-1, the standard it is accredited against.
A major nonconformity is one that "affects the capability of the management system to achieve the intended results". For an OH&S system those results are preventing work-related injury and ill health, so the test is blunt: does this gap leave people exposed to a hazard the system should be controlling? A minor nonconformity is a genuine lapse that stops short of that.
ISO/IEC 17021-1 gives two routes to a major grade: significant doubt that effective process control is in place, such as high-risk work going ahead with no working control around it; or a cluster of minors against the same requirement or issue that together show a systemic failure. An opportunity for improvement is neither grade and needs no formal response.
Why so many OH&S findings come from the site tour
IAF MD 22, the IAF's mandatory document for OH&S certification, requires the audit to evaluate the system while operational activities are under way, through a tour of facilities and other work sites. Auditors compare the risk assessment with what they see: the machine guard, the barrier round the excavation, the permit on the board, the contractor's induction card.
Contractor and subcontractor personnel under your control or influence count in the audit, so their work is sampled too. Where sites carry different activities and risks, sampling across them is not appropriate, so the site you hoped would be skipped may well be visited. The Stage 1 and Stage 2 guide explains how visits are planned.
How an ISO 45001 nonconformity is written
Each finding must cite a specific requirement, state the problem clearly and identify the objective evidence in detail. A well-formed OH&S finding reads like this:
- Requirement: clause 8.1.4.2, Contractors, under which the hazards and risks that contractors bring to your workplaces must be brought under the control of your OH&S management system.
- Evidence: two of the four contractor crews observed on the warehouse roof had no record of site induction, and the permit to work for the roof had expired the previous day.
- Statement: the organisation could not demonstrate that contractor work at height was controlled in line with its own permit and induction arrangements.
The auditor must talk the finding through with you so the evidence is right. If the induction records sit in a site office the auditor did not reach, produce them then. The auditor will not propose the cause or the remedy; that analysis is yours, and verifying it is theirs.
Correction, root cause and corrective action under clause 10.2
ISO 45001 handles incidents and nonconformities together in clause 10.2, Incident, nonconformity and corrective action. An injury, a near miss and an audit finding go through the same steps, and the investigation involves the workers. Using the roof finding:
Correction: make it safe now
Stop the uninducted crews, induct them, and reissue the permit only after the area is rechecked. Then ask whether anyone worked at height under the lapsed permit and whether anything happened that should be reported as an incident.
Root cause: why the control failed
Bring in the supervisors and crews, not only the safety officer. Suppose permits came from one coordinator who was on leave with no deputy, and the gate admitted contractors without checking induction status. Then test every site that admits contractors for the same gap.
Corrective action: change the system
Name a deputy permit issuer, link gate access to induction records and update the contractor risk assessment. Judge the action against the hierarchy of controls in clause 8.1.2: a reminder or more PPE is weaker than a change that removes the chance of failure. Then review whether it worked and keep the record.
Response deadlines and the evidence that closes a finding
At the closing meeting the certification body gives the timeframe for your plan for correction and corrective action. It differs by body and grade, so confirm it before you leave the room. The body then verifies your actions by an additional full audit, a limited audit or documented evidence confirmed later.
OH&S closure evidence shows the hazard is now controlled, not that someone intends to control it:
- the revised risk assessment or procedure, approved and dated;
- records made after the audit under the new control, such as permits issued by the deputy;
- the investigation record showing worker involvement, the cause and the other sites checked;
- for physical controls, proof the control is installed and used, which the body may want to see itself.
Six typical ISO 45001 nonconformities and their fixes
These are composites from OH&S audits in several sectors, not quotations from any one report. Grades assume an isolated case and rise where people were exposed to serious harm or the gap repeats across sites.
| Finding | Requirement and usual grade | Correction | Corrective action |
|---|---|---|---|
| The forklift risk assessment was a generic template naming none of the site's routes or loading bays | 6.1.2, hazard identification and risk assessment Minor; major if high-risk work is unassessed | Reassess on the floor with the drivers | Assessments per activity and site, done with operators |
| The legal register omitted a work-at-height regulation that applies to the site | 6.1.3 and 9.1.2, legal requirements and evaluation of compliance Minor; major if a legal duty goes unmet | Add it and evaluate compliance | Named owner per jurisdiction; scheduled register updates |
| Safety committee minutes showed only managers at the last three meetings | 5.4, consultation and participation of workers Minor | Reconvene with worker representatives | Representation by area and shift, meetings timed so they can attend |
| A new mixing line was commissioned with no assessment of its hazards | 8.1.3, management of change Minor; major if serious hazards were uncontrolled | Assess the line and apply controls | Commissioning blocked until the assessment is signed |
| The night shift had never run an evacuation drill | 8.2, emergency preparedness and response Minor | Run and review the drill | Drill calendar covering every shift, with lessons logged |
| A falling-load near miss was closed as "operator careless" | 10.2, incident, nonconformity and corrective action Minor; major if investigations are routinely superficial | Reopen the investigation with the crew | Method that tests controls before people and revisits the risk assessment |
What an unresolved major costs you
At initial certification, no decision can be taken while a major is open. If the body has not verified the correction and corrective action within six months of the last day of Stage 2, a fresh Stage 2 is required: more audit days and a later certificate.
Once certified, a major left unresolved can lead to suspension, during which the certification is temporarily invalid, a problem for any client whose contractor prequalification relies on it. If the suspension is not resolved, the certificate is withdrawn or its scope cut back. At recertification, majors must be verified before expiry or the certificate is not renewed; it can be restored within six months, after which at least a Stage 2 is needed. The surveillance and recertification guide covers the cycle.
How to keep ISO 45001 findings few and minor
Most OH&S majors are foreseeable: a shift the internal audit never reached, contractors managed on paper only, investigations that stop at the injured person. Walk your sites as the certification body will and treat three similar lapses as one problem. The audit questions guide and the common mistakes guide cover the rest.
How Sterling closes OH&S findings
Findings raised by us first, then closed on the ground.
Sterling's consultants conduct your internal audit across sites and shifts before the certification body arrives, and close what they find with evidence. If the Stage 2 auditor still raises a nonconformity, we work through the cause with your supervisors and workers, check the fix on site and help you submit a response the reviewer can verify, with records held in Effivity, included with the engagement at no additional cost. We ensure successful certification for our clients. Grading and the certification decision rest with the independent, accredited certification body; Sterling does not certify.
Book a free discovery callISO 45001 nonconformities: questions buyers ask
How many minor nonconformities are allowed in an ISO 45001 audit?
ISO/IEC 17021-1 sets no limit. Before its decision the body needs an accepted plan for each minor and verified closure of each major, and several minors on one issue can be regraded as a major.
Does a workplace accident automatically lead to a nonconformity?
No. An accident is an incident handled under clause 10.2, and the auditor checks whether you reported, investigated and acted on it as your system requires. A serious incident at a certified site can, however, prompt a special audit under IAF MD 22.
Can a contractor's unsafe work result in a nonconformity against us?
Yes. Controlling contractor hazards is your requirement under clause 8.1.4.2, and contractor personnel under your control count in the audit, so uncontrolled contractor work becomes your finding.
Does closing an ISO 45001 major nonconformity require another site visit?
Not always. The body chooses a full audit, a limited audit or documented evidence; where the fix is a physical control or a change in how work is done, expect it to want to see it.
Can we challenge a nonconformity the auditor has raised?
Yes, on the evidence, ideally while the finding is discussed with you during the audit. Accredited certification bodies must also run a documented appeals process.
More ISO 45001 guides
Every guide in the ISO 45001 series is written for one question and links back to the hub for the whole picture.
- ISO 45001 certification process, step by step
- ISO 45001 contractor management: prequalification to permits
- ISO 45001 certification cost: what moves the price
- ISO 45001 hazard identification and risk assessment
- ISO 45001 internal audit: planning, conduct and reporting
- ISO 45001 legal register and evaluation of compliance
- ISO 45001 management review
- ISO 45001 for manufacturing
- ISO 45001 certification in the Netherlands and Europe
- ISO 45001 for oil and gas and energy
- ISO 45001 for offices and professional services
- ISO 45001 requirements explained, clause by clause
Keep exploring
Explore more about ISO 45001
Watch a video on how to implement ISO 45001 here.
Watch a video on ISO 45001 requirements here.
ISO 45001 resources
Services for ISO 45001
Talk to a consultant
Close your ISO 45001 audit findings with evidence the certification body can verify on site.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice