In audit, NC stands for nonconformity: a requirement that was not met. The requirement can be a clause of a standard such as ISO 9001, a legal rule, or the organisation's own procedure. The terms around it (NCR, CAR, CAPA, OFI) describe how the finding is recorded and fixed.
Last reviewed: 17 October 2026. Facts checked. We ran a web search on nonconformity terms and read study guides and a certification body's help page. They give the definition of a nonconformity as the non-fulfilment of a requirement, taken from ISO 9000:2015, and say that ISO 19011 allows nonconformities to be graded but does not define "major" and "minor". We could not open ISO 9000 or ISO 19011, which are paid documents. Acronym usage varies between organisations and certification bodies, so check the audit procedure you work under. The examples are invented.
The terms at a glance
| Term | Full form | Plain meaning |
|---|---|---|
| NC | Nonconformity | A requirement was not met |
| NCR | Nonconformity report (some use "non-conformance report") | The record of that NC |
| CAR / CAPA | Corrective action request / Corrective and preventive action | The request to fix it, and the fix |
| OFI | Opportunity for improvement | A suggestion, not a failure |
| Observation | Observation | Something noted that may become an NC if it gets worse |
| Major / minor NC | Major / minor nonconformity | Grades of seriousness |
Usage differs. Some firms say NCR and CAR for the same document. Some use CAPA where others only say corrective action. Use the wording your procedure uses.
What counts as a requirement?
The definition covers a stated, implied or obligatory need. In practice, an auditor checks the organisation against three kinds of requirement:
- The standard. For example, a clause of ISO 9001 that asks for documented information.
- Legal and customer requirements that the organisation has committed to meet.
- The organisation's own system. If your procedure says visitors sign in and nobody does, that is an NC against your own procedure.
The third kind surprises people. A written procedure you do not follow is worse than none.
The three parts of a good NC
A well-written finding has three parts, and an auditor who leaves one out will have it challenged.
- The requirement. Which clause or procedure applies.
- The evidence. What was seen, heard or read, with dates, record numbers or names.
- The gap. How the evidence falls short of the requirement.
Weak: "Training records are poor."
Better: "Clause 7.2 requires evidence of competence. Of ten operator files sampled, four had no training record for the machine they operate (records 14, 17, 22, 31)."
For worked examples of the major and minor split and the evidence behind each, read ISO audit nonconformities: major vs minor.
Major and minor
The sources we read agree on the broad idea but not on a fixed test.
- A major NC is typically systemic or high-impact, for example a required element of the system that is absent, or a failure that casts serious doubt on the system's ability to deliver its intended results.
- A minor NC is typically an isolated lapse.
- Several minors against the same requirement can be escalated to a major.
- An open major NC can block initial certification or continuation until it has been corrected and verified.
The grading scheme is set by the certification body or the organisation, and timelines also vary. Check the one you are working under.
From NC to closure
- Raise it. The auditor writes the NC and agrees the facts with the auditee at the closing meeting.
- Correct it. The auditee fixes the immediate problem, for example by writing the missing record.
- Find the cause. A root cause analysis asks why it happened. Our post on the corrective action process covers this.
- Plan the corrective action. Fix the cause so the NC does not return.
- Verify. The auditor checks that the action was done and that it worked.
- Close. The NC is closed only when verification is complete.
A common mistake is to stop at step 2. Fixing the missing record does not stop the next missing record.
OFI and observation: not the same as an NC
An OFI is a suggestion. The organisation is not breaking a rule, but the auditor sees a better way. An observation notes something that could become an NC. Neither needs a formal corrective action, though a good organisation reads both. Mixing them up can lead to over-reaction or to a missed warning.
For auditors: keep the language precise
- Use "nonconformity" for a failure against a requirement, and nothing else.
- Do not label an NC "major" without a written reason that ties to the scheme in use.
- Name the requirement every time.
- Avoid blame. Write what the evidence shows, not who is at fault.
For the audit process around the findings, see how to run an ISO internal audit step by step and the ISO 9001 internal audit checklist.
Frequently Asked Questions
What is the NC full form in audit?
Nonconformity: a failure to meet a requirement.
What is the NCR full form?
Nonconformity report, sometimes written as non-conformance report. It is the record of an NC.
What is the difference between NC and OFI?
An NC is a failure against a requirement. An OFI is a suggestion to improve where no requirement is broken.
Is NC used in financial audit?
The term is mainly used in management system audits such as ISO. Financial audits use words like misstatement, deficiency and non-compliance.
What is CAPA?
Corrective and preventive action: the steps taken to fix a problem and stop it happening again.
Related Articles
Last reviewed: 17 October 2026. Facts checked. Opened: web search results (study guides and a certification body's help page); our own site posts. Could not open: ISO 9000:2015 and ISO 19011, which are paid documents. Check definitions and grading in the standards and your certification body's rules.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error