Major and minor nonconformities in an ISO audit
A major nonconformity is a shortcoming that affects your management system’s ability to achieve its intended results. A minor nonconformity is a shortcoming that does not. You must resolve a major nonconformity and have it verified before the certification body (CB) issues or renews a certificate. For a minor nonconformity, an accepted action plan is usually sufficient.
These definitions come from ISO/IEC 17021-1 , the standard every accredited CB must comply with. In the Netherlands, the Raad voor Accreditatie (RvA, Dutch Accreditation Council) supervises this. The classification therefore applies to ISO 9001, ISO 27001, ISO 14001 and the other standards. In Dutch, a nonconformity is also called a “tekortkoming” (shortcoming) or “non-conformiteit”.
What is the difference between a major and a minor nonconformity?
ISO/IEC 17021-1 gives two situations as examples in the definition of a major nonconformity. The first is serious doubt about whether a process is under control or whether products meet requirements. The second is several minor nonconformities against the same requirement that together point to a systematic failure.
| Minor nonconformity | Major nonconformity | |
|---|---|---|
| Definition | Requirement not fully met, system still works | System cannot achieve its intended results |
| Typical | One-off, limited, a gap in implementation | Requirement missing entirely, or a systematic failure |
| Initial audit | Action plan must be accepted | Correction and corrective action must be verified before certification |
| Surveillance audit | Follow-up at the next audit | Can lead to suspension if not resolved in time |
| Recertification | Action plan | Must be resolved before the certificate’s expiry date |
Alongside nonconformities, many auditors write down observations or opportunities for improvement. These are not nonconformities. You do not have to do anything about them, but the auditor often checks at the next audit whether you have acted on them.
Examples of major and minor nonconformities
The line is not always sharp. The auditor assesses the impact on the whole system. These examples give an idea.
| Situation | Classification | Why |
|---|---|---|
| Internal audit carried out, but one process was left out | Minor | The audit programme exists and mostly works |
| No internal audit carried out since the previous audit | Major | A mandatory part of clause 9 is missing |
| One measuring instrument with an expired calibration | Minor | A one-off gap, and the system exists |
| No calibration system, several measuring instruments uncalibrated | Major | Doubt about whether products meet requirements |
| Management review held, one mandatory input topic missing | Minor | The review exists but is incomplete |
| No management review | Major | A mandatory requirement is missing entirely |
| Three minors at three departments against the same requirement (for example document control) | Can become major | The pattern points to a systematic failure |
| Corrective action from a previous minor not carried out | Can become major | The nonconformity persists, and the improvement cycle is not working |
A minor you leave unaddressed often becomes a major at the next audit. At every surveillance audit, the auditor checks the follow-up of earlier nonconformities. That is a standard part of ISO/IEC 17021-1.
How much time do you get to resolve a nonconformity?
ISO/IEC 17021-1 leaves the deadline to the CB. It is stated in your certification agreement or in the certification rules of your CB. Ask before the audit, so you know where you stand.
There is one hard limit at the initial audit. If the CB cannot verify the resolution of a major nonconformity within six months after the last day of stage 2, a new stage 2 audit is required before certification is possible. Read more about stage 1 and stage 2 of the initial audit.
At recertification, a major nonconformity must be resolved and verified before your certificate’s expiry date. If that does not happen, the certificate is not renewed.
How do you handle a nonconformity?
Under ISO/IEC 17021-1, the CB requires you to analyse the cause and describe which correction and corrective action you will take. The CB then assesses whether that is acceptable. This is how you approach it.
Understand the finding
Ask during the closing meeting if something is unclear. Which requirement, and which evidence? If you disagree, say so with arguments during the audit, not afterwards.
Take a correction
Fix the immediate problem. For example, carry out the missing internal audit after all.
Analyse the cause
Why could this happen? Use root cause analysis and 5 whys. “Forgotten” is not a cause.
Choose the corrective action
Remove the cause. For example, put the audit programme in the calendar with an automatic reminder and an appointed substitute.
Provide evidence
Send documents, photos or records. For a major nonconformity, the auditor sometimes returns for an additional visit.
Template: response to a major or minor nonconformity
Use this format for your response to the CB. Most CBs have their own form with similar fields.
| Field | Example (minor: internal audit not complete) |
|---|---|
| Number and standard requirement | NC-02, ISO 9001 clause 9.2 |
| Finding | The purchasing process was not audited in the past cycle |
| Scope | Checked: all other processes had been audited |
| Correction | Internal audit of purchasing carried out on 12 May, report attached |
| Cause | The audit programme was linked to one auditor who was off for a long period, and no replacement was arranged |
| Corrective action | A second internal auditor was trained, and the programme is monitored at the quarterly management meeting |
| Owner and date | Quality coordinator, completed by 30 June |
| Effectiveness | Checked at the September quarterly meeting: all planned audits on schedule |
To set up your own records, see nonconformities and corrective actions under ISO 9001 and CAPA under ISO 13485.
Major and minor nonconformities in the internal audit
You can use the same classification in your own internal audit. That is useful. Your organisation becomes familiar with the terms, and you see in advance which points the external auditor will weigh heavily. A major nonconformity that you find yourself and resolve is no longer a nonconformity at the external audit.
What does a major nonconformity mean for your certificate?
With a current certificate, a major nonconformity does not automatically lead to withdrawal. You are given a deadline to resolve it. If you do not resolve it, or you refuse a surveillance audit, the CB can suspend the certificate. During a suspension, your certificate is temporarily invalid. ISO/IEC 17021-1 cites six months as the usual maximum duration. If the problem persists, withdrawal follows. Read more about the surveillance audit and recertification.