Audit findings · Certification decisions
Major vs Minor Nonconformities in ISO Certification Audits
Every certification audit ends with findings, and how those findings are graded shapes what happens next. This guide explains the major vs minor nonconformity ISO audit distinction in plain language: how certification auditors grade findings, what evidence a certification body reviews before closing them, and how open findings affect the certification decision.
About QAC Qatar. We are an ISO certification body: we audit, assess, certify, issue, surveil and renew certificates for management systems.
What a nonconformity is in a certification audit
ISO/IEC 17021-1:2015, the international standard for bodies that audit and certify management systems, defines a nonconformity simply as the “non-fulfilment of a requirement”. In a certification audit, that requirement can come from the management system standard being audited, such as ISO 9001, ISO 14001, ISO 45001 or ISO/IEC 27001, from the organisation’s own documented system, or from other certification requirements that apply to the client.
A nonconformity is always tied to objective evidence. The auditor records what was observed, which requirement it relates to and why the evidence does not meet that requirement. A suspicion, an opinion or a preference about how things could be done differently is not a nonconformity. Once a nonconformity is identified, the audit team grades it as major or minor, and that grade decides how the certification body handles it afterwards.
The clause or documented rule that applies to the activity sampled.
Records, interviews and observations that show what actually happens.
A clear description of how the evidence falls short of the requirement.
Major or minor, based on the effect on the system’s intended results.
How major and minor findings differ
ISO/IEC 17021-1 draws the line by asking one question: does the nonconformity affect the capability of the management system to achieve its intended results? A major nonconformity is one that does. A minor nonconformity is one that does not. The size of the paperwork error or the number of records involved is not the test; the effect on the system is.
The standard gives two examples of circumstances in which a nonconformity could be classified as major. The first is where there is significant doubt that effective process control is in place, or that products or services will meet specified requirements. The second is where a number of minor nonconformities associated with the same requirement or issue together demonstrate a systemic failure. In other words, three similar slips found in three departments may be graded as one major finding rather than three minors.
| Aspect | Major nonconformity | Minor nonconformity |
|---|---|---|
| Definition | Affects the capability of the system to achieve intended results. | Does not affect that capability. |
| Typical signal | Significant doubt about process control or product and service conformity. | An isolated lapse where the process still works. |
| Pattern | Several related minors can add up to a systemic failure. | A single, contained instance. |
| Before a decision | Correction and corrective action reviewed, accepted and verified. | Client’s plan for correction and corrective action reviewed and accepted. |
| Later follow-up | Verified before certification is granted or renewed. | Effectiveness typically checked at a later audit. |
Certification schemes and sector programmes can add their own grading rules on top of these definitions. Where a scheme applies, the certification body follows both the general standard and that scheme’s specific rules.
Opportunities for improvement vs findings
Audit reports sometimes contain a third type of note: an opportunity for improvement. ISO/IEC 17021-1 allows auditors to identify and record these, unless a certification scheme prohibits it. An opportunity for improvement is not a nonconformity. It does not require a response, it does not stop a certification decision and it is not a hidden finding.
The reverse also holds. A genuine nonconformity must not be downgraded and recorded as an opportunity for improvement to make a report look cleaner. If the evidence shows that a requirement is not met, it is graded and reported as a nonconformity.
Grading is not advice
As an impartial certification body, QAC grades and verifies findings but cannot advise on how to resolve them; read more about certification body impartiality.
Correction, root cause and corrective action evidence
After the audit, the certification body requires the client to analyse the cause of each nonconformity and describe the specific correction and corrective actions taken, or planned, within a defined time. In ISO terminology, a correction is action to eliminate a detected nonconformity, while a corrective action is action to eliminate the cause of the nonconformity and prevent it from recurring. A certification body expects to see both, together with the identified cause.
The certification body then reviews the submission to decide whether it is acceptable, and verifies its effectiveness. Depending on the finding, verification may rely on documented evidence, an additional limited audit or an additional full audit, and the client is told which applies. Closure is a judgement on the evidence presented, not a rating of the effort involved.
Evidence that the specific nonconforming situation has been dealt with.
The cause identified by the client and how it links to the finding.
Action on that cause, with records showing it is in place.
Evidence that the action has worked, verified by the certification body.
Timelines for responses
There is no single, universal deadline for closing nonconformities. ISO/IEC 17021-1 requires the client to respond “within a defined time”, and at the closing meeting the audit team explains the timeframe expected for the client to present a plan for correction and corrective action. The actual timeframes depend on each certification body’s procedures, the grade of the finding, the type of audit and the rules of any certification scheme that applies.
Treat any figure you hear as specific to that certification body and that audit, not as an industry rule. If you are unsure, the audit report and the closing meeting are the authoritative sources for the dates that apply to your findings.
How open findings affect the certification decision
Before any decision to grant, renew, expand, reduce, suspend, restore or withdraw certification, ISO/IEC 17021-1 requires the certification body to review the audit outcome. For any major nonconformity, it must have reviewed, accepted and verified the correction and corrective actions. For any minor nonconformity, it must have reviewed and accepted the client’s plan for correction and corrective action.
In practice, an open major finding after a Stage 2 audit prevents the initial certificate from being issued until verification is complete, while accepted plans for minor findings allow the decision to proceed with effectiveness checked later. The decision itself is made by people who were not on the audit team. Our guide to Stage 1 vs Stage 2 ISO audits explains where findings fit into initial certification.
Findings at surveillance and recertification
Grading works the same way after the certificate is issued. Surveillance audits check, among other things, the actions taken on nonconformities identified during the previous audit. A minor finding that was not effectively addressed may be raised again and, where it shows a systemic pattern, graded as major. Our article on the ISO certificate surveillance and three-year cycle explains how these visits fit together.
At recertification, the certification body sets time limits for correction and corrective action on any major nonconformity, and those actions must be verified before the certificate expires. Where a certified system has persistently or seriously failed to meet certification requirements, the certification body may suspend certification, and where the issues behind a suspension are not resolved in the time set, certification can be withdrawn or its scope reduced.
| Audit type | How findings are handled |
|---|---|
| Initial (Stage 2) | Major findings verified before the certification decision; minor plans accepted. |
| Surveillance | Previous findings followed up; new findings graded and responded to. |
| Recertification | Major findings verified before the current certificate expires. |
| Special audits | Scope extensions and short-notice audits grade findings in the same way. |
Frequently asked questions
Can several minor nonconformities become a major one?
Yes. ISO/IEC 17021-1 notes that a number of minor nonconformities associated with the same requirement or issue could demonstrate a systemic failure and so constitute a major nonconformity.
Does an opportunity for improvement need a response?
No. Opportunities for improvement are not nonconformities and do not affect the certification decision, although a client may choose to consider them.
Is there a fixed number of days to close a major nonconformity?
There is no universal figure. Response and closure timeframes depend on the certification body’s procedures and the applicable scheme rules, and they are confirmed at the closing meeting and in the audit report.
Contact QAC about certification audit scope
Tell us which standard, activities and sites you want audited, and we will explain how the certification audit is planned and how findings are reported. Explore our ISO certification services in Qatar, see how Stage 1 and Stage 2 audits work, and learn about the surveillance cycle.
