A nonconformity is a requirement that has not been met. Certification bodies commonly grade them as major or minor. A major one means the system, or a part of it, is likely to fail to achieve its intended results. A minor one is an isolated or small lapse. Either way, fix the cause, not just the symptom.
Last reviewed: 17 October 2026. Facts checked. This guide follows the published structure of the management system standards (for example clause 10.2 of ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018) and the general approach of ISO 19011:2018 and ISO/IEC 17021-1. These are paid documents and we have not reproduced them. The major and minor grading is a common certification practice, and the exact definitions and deadlines are set by each certification body. Check your body's rules.
Edition note (17 October 2026). ISO 9001:2026 was published on 16 September 2026 and replaces ISO 9001:2015 after a transition of about three years. Sources give slightly different end dates (around September 2029), and the International Accreditation Forum and your certification body set the rules, so ask yours. ISO 14001:2026 was published in April 2026 with a similar three-year transition. This guide uses the 2015 clause structure, because we could not verify the 2026 clause numbering. If you audit to a 2026 edition, check each reference against it.
Key terms
- Nonconformity: failure to meet a requirement. The requirement can come from the ISO standard, your own procedures, customer contracts or the law.
- Correction: the immediate fix of the specific problem, for example re-calibrating the gauge.
- Corrective action: action to remove the cause so it does not happen again.
- Root cause: the underlying reason the problem happened.
- Observation or opportunity for improvement: a comment that is not a nonconformity but could become one, or could make the system better. Terms differ between bodies.
Major vs minor
| Major | Minor | |
|---|---|---|
| Idea | A requirement is not met in a way that affects the system's ability to deliver its intended results | A requirement is not fully met, but the system still works |
| Typical shape | Absence or total breakdown of a required process, or many minors pointing to one weakness | An isolated lapse or small gap |
| Example | No internal audit carried out at all | One calibration record missing for one instrument |
| In certification | Usually must be closed before the certificate is issued or continued | Plan is usually accepted and checked later |
| Risk | Can delay or suspend certification | Needs a plan and fix |
Judging severity takes context. The same gap can be minor in one place and major in another, depending on risk. Repeats of a minor in the same area can be escalated. In an internal audit you can use the same grades or your own scale, as long as it is defined and applied consistently.
How to write the finding
Use three parts every time.
- Requirement: which clause, procedure or contract term.
- Evidence: what you saw, with the record number, date, place and person.
- Gap: how the evidence falls short.
Weak: "Training is poor."
Strong: "Clause 7.2 requires the organisation to ensure people are competent on the basis of education, training or experience. Three of five operators on Line 2 sampled (records T-14, T-17, T-19) had no training record for the new filling procedure released on [date]. Competence for this task was not shown."
Rules for good findings:
- State facts, not opinions or blame.
- Do not name the fix.
- One finding, one requirement.
- Agree the facts with the auditee at the closing meeting.
What counts as evidence
Evidence must be verifiable: records, observations, statements you can confirm. Note the sample size and how you picked it. A finding built on one verbal comment is weak. For method, see how to run an ISO internal audit.
Corrective action that works
Management system standards ask for a sequence along these lines when a nonconformity occurs:
- React to it and, as applicable, take action to control and correct it.
- Evaluate whether action is needed to eliminate the cause, so it does not recur or happen elsewhere.
- Implement the action needed.
- Review the effectiveness of the action taken.
- Update risks and opportunities, and change the system if necessary.
- Keep records of the nonconformity, the actions and the results.
Finding the root cause
A simple method is the "five whys": keep asking why until you reach a cause the company can control. Example: the operator did not follow the procedure. Why? He was not trained. Why? Training is only triggered by manual request. Why? The procedure release process has no training step. The root cause is the release process, not the operator.
Retraining one person is usually correction, not corrective action.
Check effectiveness
Closing the action when the training session is held is not enough. Come back later and check that the problem has not recurred, for example by sampling new records. Set the date when you raise the action.
Tracking
Keep a corrective action log with: reference, clause, grade, description, owner, root cause, action, due date, completion date, effectiveness check and status. Review it at management review. Audit it next time. Recurring items point to a system weakness.
Common mistakes
- Fixing the example, not the cause.
- Blaming "human error" and stopping.
- Closing on completion, not effectiveness.
- Due dates that slip with no escalation.
- Reports that grade everything minor to avoid conflict.
Frequently Asked Questions
What is the difference between a nonconformity and an observation?
A nonconformity is a requirement not met. An observation is a comment that is not a failure of a requirement but is worth attention. Certification bodies use their own terms, so check yours.
Is "major" and "minor" required by ISO standards?
The management system standards require action on nonconformities but do not use the major and minor labels. The grades come from certification practice and body rules.
How long do I have to close a nonconformity?
It is set by the certification body or your own procedure. We have not listed periods, as they differ. Ask your body in writing.
Can a minor become a major?
Yes. If it is repeated, not corrected, or shows a wider breakdown, it can be escalated.
Do internal audits need the same grading?
Not necessarily, but a defined and consistent scale helps. See the ISO 9001 internal audit checklist.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error