Major and minor nonconformity in an ISO 22000 audit
A major nonconformity (afwijking) is a shortcoming that affects how well your food safety system works. A minor nonconformity is a shortcoming that does not affect that, but still needs to be fixed. The certification body decides which grade a nonconformity receives, based on the rules of the scheme. The ISO 22000 standard itself does not define those grades. The FSSC 22000 scheme version 7 (May 2026) (FSSC = Food Safety System Certification) does. Certification bodies that offer only ISO 22000 use their own criteria and deadlines, so ask them. The deadlines on this page come from the FSSC scheme. You can read more about how the audit runs on the audit process page.
A major nonconformity that is not closed in time can lead to suspension of your certificate. So plan your correction straight after the audit.
Major and minor at a glance
| Grade | When | What you need to do |
|---|---|---|
| Minor | The shortcoming does not affect the system | Supply evidence of the correction and the cause; the body approves a plan within 28 days |
| Major | The shortcoming affects the system’s ability to perform, or a legal shortcoming with quality impact | Investigate the cause, correct it immediately, close it within 28 days |
| Critical (in FSSC) | Serious system failure, direct danger to food safety without appropriate action, or legality or integrity of the certificate at stake | Suspension within 3 working days, for a maximum of six months; root cause analysis within 14 days |
What is a minor nonconformity?
A minor nonconformity means the system still works, but something is missing. Think of a record form that is not filled in everywhere, or a supplier list that has not been updated even though the supplier has already been replaced.
You do not need a new audit to close a minor. You supply evidence of the correction, an investigation into the cause and a plan for corrective actions. Under the FSSC scheme, the body approves this within 28 calendar days after the last audit day. If that does not happen, the certificate is suspended. At the next audit, the body checks whether it works.
Note: a minor that you did not address at the previous audit can become a major at the next one. This is a common trap.
What is a major nonconformity?
A major nonconformity affects the system’s ability to achieve its objectives. For example: the CCP monitoring of pasteurisation is carried out, but the limit in the record does not match the control plan. That makes the evidence unusable.
Major nonconformities have strict deadlines. Under FSSC scheme version 7, you must submit evidence of the cause and the correction within 28 calendar days after the last day of the audit. The body also closes the major within the same deadline. If that does not happen, the certificate is suspended. For this, the body makes a visit on site or, if documents are sufficient, a desk review.
If you cannot complete the correction within 28 days, you must submit temporary measures that cover the risk. These must also be accepted within 28 days. For a major found in a Stage 2 audit (the first certification audit), the body agrees a deadline for the lasting solution, no later than six months after the audit. If the major is then not closed, or the temporary measure is not accepted, the full Stage 2 audit must be repeated.
What is a critical nonconformity?
FSSC has a third level: the critical nonconformity. It arises in the case of a serious system failure, a situation with a direct adverse effect on food safety where nothing is done about it, or where the legality or integrity of the certificate is at stake.
For a critical nonconformity, the certificate is suspended within three working days, for a maximum of six months. You submit the root cause analysis and a plan within 14 calendar days after the last audit day. A separate follow-up audit on site takes place between six weeks and six months after the audit. If it is not resolved within six months, the certificate is withdrawn. For a critical nonconformity in an initial audit, the audit is failed and the whole certification audit must be repeated.
Fictional example
A biscuit factory receives two findings at the audit:
- Minor: the cleaning checklist of the packaging department has not been signed off for three weeks. The system exists, but it was not followed everywhere. The factory supplies the cause (new shift leader, no instruction) and a plan with an extra instruction. It is approved.
- Major: the allergen list was not updated after the new chocolate filling with hazelnut was introduced. This has a direct impact on food safety. The factory updates the list within the day, puts temporary checks on the line, and supplies the evidence within 28 days. The body closes the major.
Common mistakes
- Only fixing the symptom. The auditor wants to see the cause. “We filled it in again” is not a root cause analysis.
- Letting the deadline pass. Majors that are not closed within 28 days lead to suspension (FSSC v7, section 6.2.2).
- Leaving minors open. An open minor can become a major at the next audit.
- Thinking a nonconformity means nothing. A nonconformity handled well shows that your system corrects itself. Record them and resolve them. You can read how to organise this on the checklist with evidence.
The approach to nonconformities also belongs with the mandatory documents, because their records are always checked.
How do you write a good response to a nonconformity?
A response to a nonconformity consists of three parts. At each part, the auditor checks whether it is convincing.
| Part | Question you answer | Example of a weak version | Example of a strong version |
|---|---|---|---|
| Correction | What did you do immediately? | ”We updated the list." | "The list was updated on day 1 and shared with the new supplier.” |
| Cause | Why did it happen? | ”The employee forgot." | "The change notification only went to purchasing, not to quality.” |
| Lasting solution | How do you prevent recurrence? | ”We will pay more attention." | "Change notifications now go automatically to quality from this month; we check this monthly.” |
The weak versions name a consequence or a promise. The strong versions name a cause and a check that you can demonstrate.
Common mistakes with nonconformities
- Downgrading a nonconformity to minor without justification. If you decide the grade yourself, the auditor often overturns it later. If in doubt, discuss the grade with the auditor straight away.
- Mixing up the correction and the cause. A correction repairs the consequence. Only a root cause analysis prevents recurrence.
- Not appointing an owner. A nonconformity without a named person is left lying until the deadline has passed.
- Not updating the register. The nonconformity register must show the status, not just the audit report.
What does this mean for your customers?
An open major nonconformity can be a signal for customers and retailers. Some customers ask for a copy of the audit report or for the status of the nonconformity. Be open about it, and keep your correspondence with the certification body in good order.
A minor that you have resolved yourself and documented well is often not relevant to customers. A major that you have closed quickly and demonstrably shows that your system works.
More information
Official references
- FSSC 22000 Scheme Version 7.0 (May 2026) , section 6.2 on nonconformities and section 7.3 on suspension and withdrawal
- ISO 22000:2018 - Food safety management systems