ISO 9001 nonconformities: major, minor, and how to close them before they cost you the certificate

How certification bodies grade a nonconformity

A nonconformity is the non-fulfilment of a requirement, whether it sits in ISO 9001 or in your own system, such as a procedure you wrote. ISO/IEC 17021-1, the standard to which certification bodies are accredited, defines two grades. A major nonconformity "affects the capability of the management system to achieve the intended results"; a minor one does not.

The standard names two situations in which a finding can be graded major: significant doubt that a process is under effective control, or that products or services will meet specified requirements; and a number of minors against the same requirement or issue that together demonstrate a systemic failure. An opportunity for improvement is not a nonconformity at all. The auditor may record one where the certification scheme allows it, and no formal response is required.

How a nonconformity is written: requirement, evidence, statement

Certification rules require each nonconformity to be recorded against a specific requirement, with a clear statement and the objective evidence behind it, identified in detail. A sound finding has all three parts:

• Requirement: ISO 9001 clause 7.2, Competence: people whose work affects the performance of the quality management system must be competent, with evidence to show it.
• Evidence: three of the five final inspectors sampled had no record of training or assessment for the dimensional check they sign off.
• Statement: the organisation could not demonstrate the competence of all personnel performing final inspection.

The auditor has to discuss each finding with you so that the evidence is accurate and understood: that is the moment to produce any record the auditor missed. The auditor must not suggest the cause or the fix, which would mean auditing their own advice later.

Correction, root cause and corrective action

Clause 10.2 of ISO 9001, Nonconformity and corrective action, sets the sequence for every nonconformity, whether an auditor, a customer or your own inspection found it. Weak responses blur its three parts. Taking the competence finding above:

Correction: deal with the instance

Assess the three inspectors and record the result; until then, someone competent signs off final inspection. Then deal with the consequences by checking whether anything they released needs rechecking.

Root cause: find out why

Keep asking why until the answer is a process, not a person. Here, onboarding covered safety and HR induction but had no step for role-specific competence. Clause 10.2 also asks whether the same problem exists, or could occur, elsewhere, so check every role that releases work.

Corrective action: remove the cause

Add a competence step to onboarding for those roles and a skills matrix reviewed each quarter. Be wary of "operator retrained" as a corrective action: unless the training process itself failed, retraining one person will not stop the next one making the same mistake. Then review whether the action worked, and keep the record of the nonconformity, the action and its result.

The deadline and the evidence that closes a finding

The certification body sets the deadline, commonly within a fixed number of days, and gives it at the closing meeting as the timeframe for presenting your plan for correction and corrective action; sector schemes such as IATF 16949 fix their own limits. It then reviews your causes and actions and verifies that they worked, by a further visit or by documented evidence.

Closure evidence shows change that has happened, not change that is promised:

• new records dated after the audit, such as the competence assessments;
• the changed control with its new revision and approval, such as the onboarding checklist;
• the first records completed under that control, not a blank form;
• for effectiveness, enough data over time to show the problem has not returned.

Eight real-world ISO 9001 nonconformities and their fixes

The findings below are composites from audits across sectors, not extracts from any one report. Grades assume an isolated finding and rise where product has reached customers or the pattern repeats.

What happens when a major nonconformity is not closed

At initial certification

No certificate can be granted while a major is open. If the certification body cannot verify its correction and corrective action within six months after the last day of Stage 2, it must conduct another Stage 2 before recommending certification.

While the certificate is valid

Certification bodies suspend certification when, for example, a certified organisation fails to meet certification requirements; a major left open past its deadline is one way to get there. A suspended certification is temporarily invalid, so it cannot support a tender or a customer's supplier approval. If the issue is not resolved, certification is withdrawn or its scope reduced.

At recertification

Corrections and corrective actions for any major raised at recertification must be implemented and verified before the certificate expires; if not, it is not renewed. Certification can be restored within six months of expiry once the outstanding recertification work is complete; after that, at least a Stage 2 is needed. The surveillance and recertification guide covers the whole three-year cycle.

Keeping findings few, and minor

Many Stage 2 majors can be seen coming: a process the internal audit never reached, a record nobody kept, or small lapses in three departments that add up to one systemic failure. Let your internal audit find them first, treat a pattern as one problem, and close actions with evidence rather than dates. The common mistakes guide covers the ten that fail audits.

ISO 9001 nonconformities: questions buyers ask