In short
A major nonconformity affects the system's capability to achieve the intended results; a minor one does not (ISO/IEC 17021-1).
Several minors on the same requirement can demonstrate a systemic failure and become a major.
At the initial audit, majors must be closed and verified before certification; for minors an accepted plan is enough.
If actions on a major are not verified within 6 months of the end of Stage 2, another Stage 2 is required.
An effective response combines correction, cause analysis, corrective action and dated evidence.
A minor nonconformity is an opportunity to improve; a major one can block your certificate. How to tell them apart and how quickly to close them is the question every company asks after an audit, when the first major and minor nonconformities appear in the report. The difference does not depend on how serious a problem feels, but on its effect on the management system: a minor one signals a requirement missed at a single point, while a major one calls into question the system's ability to deliver the results it exists for.
In this guide we look at how ISO/IEC 17021-1, the standard that sets the rules for certification bodies, defines them, with examples drawn from a typical SME. Then we move on to the practical side: what happens after the closing meeting, which deadlines apply at the initial audit, at surveillance and at recertification, how to write a corrective action plan the certification body will accept, and which mistakes cause the same nonconformity to be reopened at the next audit. If you need a refresher on how certification works in general, start with our guide on what ISO certifications are. The clause references in brackets follow the 2015 edition of ISO/IEC 17021-1.
What is a nonconformity in a certification audit?
A nonconformity is the non-fulfilment of a requirement. That is the definition in ISO/IEC 17021-1 (clause 3.11), and it applies to any certified management system: quality, environment, information security, health and safety, artificial intelligence.
The requirement can come from different sources. It may be a clause of the standard, such as the obligation to plan internal audits. It may be a rule the company has set for itself in a procedure, a legal obligation within the scope of the certificate, or a customer requirement the system has committed to meet. The auditor does not judge whether a company "works well" in a general sense: they compare what they see with a precise requirement. This is why the standard (9.4.5.3) requires every nonconformity to be recorded against a specific requirement, with a clear statement and the objective evidence on which it is based.
Nonconformities, observations and opportunities for improvement
An audit report usually contains three types of finding. Nonconformities are the only ones that formally require a response: cause analysis, correction and corrective action. Opportunities for improvement are suggestions: the auditor has seen something that works but could work better. Many certification bodies also use "observations" to flag a weak point that, if neglected, could become a nonconformity.
The boundary is set by the standard itself (9.4.5.2): a finding that is a nonconformity cannot be downgraded to an opportunity for improvement. So when we say a minor nonconformity "is an opportunity to improve", we mean it in a practical sense, not a technical one. It remains a nonconformity, it must be closed with a formal plan and the certification body will check it again.
Who decides the grading and what you can do
Grading is the audit team's responsibility, and it is decided before the closing meeting (9.4.6). Nonconformities must be discussed with the company to make sure the evidence is accurate and the finding is understood. "Understood", however, does not mean "accepted": the standard says so explicitly in a note. If you disagree, the audit team leader must try to resolve the difference of opinion, and any unresolved points are recorded (9.4.5.4).
One detail surprises many companies: the certification body's auditor must not suggest causes or solutions (9.4.5.3). This is not unhelpfulness, it is impartiality. Whoever certifies cannot design the remedy they will later have to judge. Cause analysis and the choice of actions remain your job, possibly with the support of whoever is guiding you through the process.
What is the difference between a major and a minor nonconformity?
The difference lies in the effect on the system. According to ISO/IEC 17021-1, a major nonconformity affects the system's capability to achieve the intended results (3.12); a minor one does not (3.13). What matters is not how serious the problem looks, but whether the system, as it stands, can still do its job.
When a nonconformity is major
The standard gives two typical situations in a note to the definition. The first: there is significant doubt that effective process control is in place, or that products and services will meet specified requirements. The second: a number of minor nonconformities associated with the same requirement or issue demonstrate a systemic failure and, taken together, constitute a major one.
In practice, a major nonconformity arises when an entire part of the system is missing, for example no internal audit carried out or no management review. It also arises when a critical process is not under control, such as a company that claims tight tolerances but does not manage the calibration of its measuring instruments. Or when the same error recurs widely, across several departments or several periods.
When a nonconformity is minor
A minor nonconformity is an isolated failure to meet a requirement, which does not undermine the overall capability of the system. A missing training record for a new hire, an outdated external document in one department, an occasional supplier not yet evaluated. The system works, but there is a gap at that point.
Be careful with the word "isolated", though. If the auditor finds three missing training records in three different departments, the picture changes: it is no longer an oversight, it is a sign that the competence management process is not working. That is exactly the case in which several minors become a major.
The comparison at a glance
Minor nonconformity | Major nonconformity | |
|---|---|---|
Effect on the system | Does not affect the capability to achieve the intended results | Affects the capability to achieve the intended results |
Typical situation | A requirement missed at a single, isolated point | Critical process not controlled, requirement ignored as a whole, repeated minors on the same issue |
What the certification body needs before deciding | Review and acceptance of the correction and corrective action plan | Review, acceptance and verification of the correction and corrective action |
Effect on the initial certificate | The certificate can be issued with the accepted plan | The certificate is not issued until the actions are verified |
The last two rows come from clause 9.5.2 of the standard, which sets out what the certification body must have checked before making the certification decision.
Practical examples: how a nonconformity is graded
Examples help more than definitions. Take a typical company: a 40-employee machine shop, certified to ISO 9001, that manufactures made-to-drawing components for industrial machinery builders.
During the surveillance audit, the auditor finds four situations. First: one calliper in a department is two months past its calibration date, but all the other instruments are in order and the calibration register is up to date. Second: the latest management review contains no analysis of complaints, even though complaints have doubled compared with the previous year. Third: one sampled order has no record of the review of customer requirements. Fourth: product nonconformities are recorded, but nobody analyses them, and the same defect has reappeared several times within a few months.
Situation | Likely grading | Why |
|---|---|---|
One calliper out of calibration, everything else in order | Minor | The calibration process exists and works; the gap is a one-off |
Management review with no analysis of complaints | Minor or major | It depends on the weight: if complaints are the main issue of the year, top management is not steering the system |
One order without a requirements review | Minor | Isolated case in the sample examined |
Recurring defects never analysed | Major | There is significant doubt about process control and product conformity |
The middle column says "likely" for a precise reason. Grading depends on the context and on the evidence collected: the same finding can be minor in one company and major in another. An out-of-calibration calliper in a deburring area carries little weight; the same calliper used for final inspection of a safety component changes the reasoning completely.
The same logic applies to other standards
The logic does not change when you move from quality to information security. In a software house certified to ISO/IEC 27001, a single former contractor whose account is still active will most likely be a minor nonconformity, if the access revocation process exists and works in the other cases. If, instead, there is no periodic access review and the auditor finds orphaned accounts across several systems, the doubt concerns the effectiveness of the control as a whole: we are in major territory.
What happens after the audit: deadlines and consequences for the certificate
Everything starts at the closing meeting. There the audit team leader presents the nonconformities and the timeframe for responding is agreed (9.4.7.1), including the deadline for submitting the correction and corrective action plan. The standard does not set a number of days that applies to everyone: it requires the certification body to define a time (9.4.9). So you will find the precise deadlines in your certification body's rules and in the audit report, and you should read them straight away.
At the initial certification audit
In initial certification, the difference between major and minor becomes concrete. Before deciding, the certification body must have reviewed, accepted and verified the actions for every major nonconformity; for minor ones, it is enough to have reviewed and accepted the plan (9.5.2). In other words: with only minors, the certificate can be issued with the approved plan; with an open major, it cannot.
There is also a fixed deadline. If the certification body cannot verify the corrections and corrective actions for a major nonconformity within 6 months of the last day of Stage 2, it must conduct another Stage 2 before recommending certification (9.5.3.2). We explain how the two stages work in our guide on Stage 1 and Stage 2. A practical tip: at the end of Stage 1, the certification body tells you about any areas of concern that could be classified as nonconformities at Stage 2 (9.3.1.2.3). Use them as a work list, not as a courtesy comment.
During surveillance
After certification, surveillance audits take place at least once a calendar year, except in recertification years (9.1.3.3). Every surveillance includes a review of the actions taken on nonconformities from the previous audit (9.6.2.2). A minor closed badly will resurface here, and a minor that recurs can become a major.
At surveillance, a major nonconformity does not automatically invalidate the certificate, but the audit team leader must report it so that certification body personnel other than those who carried out the audit can decide whether certification can be maintained (9.6.1). If the system has seriously or persistently failed to meet requirements, the certification body suspends the certificate (9.6.5.2), which is temporarily invalid in the meantime. If the issue is not resolved within the time set, the result is withdrawal or a reduction of scope (9.6.5.4). The standard notes that in most cases suspension would not exceed six months.
At recertification
At the recertification audit, for any major nonconformity the certification body sets time limits for corrections and corrective actions, which must be implemented and verified before the expiry of the current certificate (9.6.3.2.2). If it cannot do so, recertification is not recommended and validity is not extended (9.6.3.2.4). This is why it pays to schedule recertification with some margin: a major found close to the expiry date leaves very little time to close it. The full calendar is in our guide on surveillance and recertification audits.
How to handle a nonconformity step by step
Handling a nonconformity properly means doing three different things in the right order: correct it, understand the cause, stop it from happening again. ISO/IEC 17021-1 asks for exactly this: the certification body must require the company to analyse the cause and describe the correction and corrective actions, taken or planned, within a defined time (9.4.9).
Correction and corrective action are not the same thing
A correction eliminates the nonconformity detected: you calibrate the expired calliper, update the document, evaluate the missing supplier. A corrective action eliminates the cause, so the problem does not come back: you change how the calibration schedule alerts departments, assign an owner, add a check to the process.
Many rejected responses mix the two up. "We calibrated the calliper" is a correction; without action on the cause, the same minor will come back at the next audit, perhaps on a different instrument. The reverse is also true: a well-designed corrective action is not enough if the expired calliper is still in use. For analysis techniques such as the 5 Whys or the cause-and-effect diagram, see our dedicated guide on corrective action and root cause analysis.
The plan in five steps
Contain the problem straight away: if needed, quarantine the product or stop the activity involved and assess the consequences, for example which parts were measured with the expired calliper.
Correct the nonconformity detected and keep the evidence: calibration certificate, updated document, record.
Analyse the cause methodically, asking why the system allowed the error, not who made it.
Define the corrective action with an owner and a deadline, and check whether the same problem could exist elsewhere.
Verify effectiveness after a reasonable period and record the result.
The fourth step is the one that makes the difference. If the expired calliper was due to a schedule nobody looked at, the right question is: how many other instruments, documents or suppliers depend on the same schedule? Extending the check shows the auditor that you have understood the problem, not just the symptom.
How the certification body verifies closure
The certification body reviews the corrections, causes and corrective actions to decide whether they are acceptable, and verifies their effectiveness (9.4.10). It must also tell you how it will do so: through an additional full audit, an additional limited audit, or documented evidence to be confirmed during future audits. Verification can be based on the documents you send or, where necessary, carried out on site. Either way, what counts is organised, dated evidence: the calibration certificate, the new approved work instruction, the training record.
How to write a response the certification body will accept
A good response is short, precise and verifiable. The auditor must be able to understand in a few minutes what happened, why, what you did and how you can prove it.
Back to the machine shop. A weak response reads: "The calliper has been calibrated. Staff will be made aware." A solid response reads: "Correction: calliper calibrated, certificate attached; batches measured during the overdue period rechecked, no parts out of tolerance (register attached). Cause: the calibration schedule was a shared spreadsheet with no alerts, checked only by the quality manager, who was absent for two months. Corrective action: due dates managed in a system with automatic alerts to the department supervisor and a deputy; calibration status added to the shift start-up checklist. Effectiveness check: review of all listed instruments after three months."
The difference is plain to see. The second response demonstrates control of the process, which is precisely the point on which a minor risks becoming a major.
Mistakes that get a nonconformity reopened
The first mistake is giving human error or forgetfulness as the cause. It is almost never the real cause: the next question is why the system allowed a person to forget. The second is using "staff awareness" as the only action: without a change to the process, the effect lasts a few weeks.
The third mistake is closing on paper without evidence, or with evidence produced the day before the audit. The fourth is treating each nonconformity on its own, without noticing that three minors share the same root cause. The fifth is responding after the agreed deadline: even a minor handled late complicates the certification body's decision and weighs on the next audit.
How to prevent nonconformities before the external audit
The best prevention is to find nonconformities before the certification body does. Internal audits exist precisely for this, provided they are carried out with the same yardstick as a certification audit: real samples, evidence, honest grading. An internal audit that never finds anything is not a good sign: it is usually an audit that did not dig deep enough.
The second tool is the schedule. Many minors stem from things that expire: calibrations, training, supplier evaluations, document reviews, periodic checks. If due dates live in scattered spreadsheets and inboxes, sooner or later one slips through. The third tool is a management review done properly, with complaints, nonconformities and objectives on the table: that is where top management spots a systemic problem before the auditor does.
Complaion works on exactly these three points. A dedicated Lead Auditor supports the company and conducts the internal audits with the same yardstick as a certification audit, so potential nonconformities emerge while there is still time to close them. The platform collects evidence, manages documents and keeps the schedule, so calibrations, training and supplier evaluations do not depend on one person's memory. When the audit comes, the material is already in order. For a broader view of how to build a system that holds up over time, read our guide on the ISO 9001 quality management system.
How Complaion helps you manage nonconformities
The best way to manage nonconformities is not to get them. The certification path with Complaion is built precisely to avoid them: your Lead Auditor checks the system before the certification body does, through the internal audit and targeted preparation, so gaps surface and are closed before the external audit. That is why companies certifying with us reach the external audit with a 100% success rate.
With Complaion you have a dedicated Lead Auditor who supports you throughout the cycle: they help you read the findings, carry out the cause analysis and set up a clear correction and corrective action plan, and they prepare you for the next audit. The platform collects the evidence for every action, manages up-to-date documents and keeps the schedule of deadlines and effectiveness checks, so you arrive at the audit with everything ready. We propose the path best suited to your company's needs, whether it is your first certification or maintaining the one you already have. It is how we work with more than 1,000 clients.
Have you just received an audit report, or do you want to prepare for the next one? Talk to one of our experts and request a tailored quote.
Frequently asked questions about major and minor nonconformities
Does a minor nonconformity block certification?
No. At the initial audit, the certification body can decide to certify after reviewing and accepting your correction and corrective action plan for minor nonconformities, as ISO/IEC 17021-1 provides. The plan must be followed, though: at the next audit the certification body will check that the actions have been implemented and are effective. A minor that is neglected or repeated can become a major.
How long do I have to close a major nonconformity?
The deadline is set by the certification body and communicated at the audit closing meeting. For initial certification, ISO/IEC 17021-1 sets a limit: if the actions on a major are not verified within six months of the last day of Stage 2, another Stage 2 is required. At recertification, the actions must be verified before the expiry of the certificate.
Can several minor nonconformities become a major one?
Yes. ISO/IEC 17021-1 provides that a number of minors associated with the same requirement or issue can demonstrate a systemic failure and therefore constitute a major. This happens, for example, when training records are missing in several departments. That is why it pays to look for the common cause rather than correcting individual cases.
What is the difference between correction and corrective action?
A correction eliminates the nonconformity detected, for example by calibrating the expired instrument. A corrective action eliminates the cause so the problem does not recur, for example by changing how due dates are managed. The certification body asks for both, together with the cause analysis. A response with only the correction is usually not enough.
Can I dispute a nonconformity?
Yes, if you believe the evidence is not accurate. Nonconformities must be discussed with you during the audit, the audit team leader must try to resolve any differences of opinion, and unresolved points are recorded. Every certification body must also have a documented appeals process. It is best, however, to dispute on the evidence, not on perceived severity.
Should an observation be handled like a nonconformity?
Not formally: observations and opportunities for improvement do not require a corrective action plan. It is still worth assessing them, because they often point to a weak spot that could become a nonconformity at the next audit. Good practice is to record them and decide at the management review whether and how to act.
Can the auditor tell me how to fix the nonconformity?
No. ISO/IEC 17021-1 requires the certification body's auditor not to suggest causes or solutions, to protect their impartiality. The analysis and the choice of actions are up to the company. This is where you need support that is independent of the certification body, such as the Complaion Lead Auditor who works alongside you during preparation.
Does a major nonconformity at surveillance mean losing the certificate?
Not automatically. A major triggers a review by certification body personnel other than those who carried out the audit, who decide whether certification can be maintained. If the system has seriously or persistently failed to meet requirements, the certificate can be suspended and, if the issue is not resolved within the time set, withdrawn. Closing the major on time and with solid evidence is the way to avoid this.
