What is a nonconformity?
A nonconformity is an ISO audit finding that a requirement is not met. A minor nonconformity needs an accepted corrective action plan; a major one must be resolved, and the fix accepted by the certification body, before a certificate is issued.
Major and minor
The grading comes from ISO/IEC 17021-1, the standard certification bodies are accredited against. A major nonconformity affects the ability of the management system to achieve its intended results. A minor one does not. The requirement can come from the standard itself, from your own policies and procedures, or from a legal or contractual obligation you have committed to.
- Major. A required element is missing or has broken down, such as no internal audit before Stage 2, or no risk assessment for part of the scope. Several related minors in one area can also be graded as a major.
- Minor. A single lapse in an otherwise working process, such as one leaver whose access was removed late.
- Observation. Not a nonconformity. A note on something that could become one, or an opportunity for improvement, with no formal response required.
What happens after a finding
For a minor nonconformity, the certification body reviews and accepts your plan for correction and corrective action, then checks at the next audit that it worked. For a major, it has to review and accept the correction and corrective action, and often verifies them with a follow-up visit, before it recommends certification. The certification body sets the deadlines for responding.
A major raised at a surveillance or recertification audit that is not resolved in time can lead to the certificate being suspended.
Responding under clause 10.2
ISO 27001 and ISO 42001 both set out the response in clause 10.2. You react to the nonconformity and deal with its consequences, find the cause, check whether the same problem exists or could occur elsewhere, take action, and then review whether the action worked. You keep records of each nonconformity, what you did and the result.
The distinction auditors look for is between correction and corrective action. Correction fixes the instance, such as removing the leaver’s access. Corrective action removes the cause, such as connecting the HR leaver process to access removal so it cannot be missed again.
Questions
Nonconformity, answered
Can we be certified with open minor nonconformities?
Yes. The certification body can recommend certification once it has accepted your plan for correction and corrective action. It then checks the plan was carried out at the next surveillance audit.
Is a nonconformity the same as a SOC 2 exception?
They are similar but not the same. A nonconformity is an ISO finding that a requirement is not met. A SOC 2 exception is an instance where a control did not operate as described, and the report lists it for readers to judge.
Do internal audits raise nonconformities too?
Yes. Internal auditors raise them in the same way, and they are handled under the same clause 10.2 process. Findings closed before the certification audit show the system is working.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them