Major impacts are risks that are significant to a system’s performance, while minor effects are less damaging deviations.
Types of Non-Conformance in ISO: Major, Minor, Observation and How to Fix Each
1000+
Successful Projects
10+ Years
Industry Experience
Worldwide
Certification Services
24/7 Support
Expert Consultation
A non-conformance in ISO is a failure to meet a requirement. The requirement can come from the standard, your own procedures or a legal duty. Auditors usually grade findings as major, minor or observation. A major finding means a requirement is missing or the system may not deliver its results. A minor finding is a limited lapse. An observation isn’t a non-conformance. Your certification body decides the grade and the response deadline.
This article explores the meaning of non-conformance, its key characteristics, common causes, and practical solutions. It also highlights proactive approaches to managing non-conformities and explains how PopularCert supports organizations in identifying gaps, resolving issues, and strengthening their ISO management systems for long-term success.
Table of Contents
What is Non-Conformance in ISO?
A non-conformance, also written as nonconformity, means a requirement was not met. That requirement may come from an ISO standard such as ISO 9001, ISO 14001 or ISO 45001, from your own procedures, from a customer contract or from a law you must follow.
The word sounds alarming, but finding gaps is the whole point of an audit. A few simple examples:
- ISO 9001: inspection records aren’t kept the way the procedure says.
- ISO 14001: hazardous waste is mixed with general waste.
- ISO 45001: required safety training wasn’t delivered.
Most organizations find gaps in both internal and external audits. What matters is your response. A healthy system fixes the cause, so the same gap doesn’t come back.
Types of Non-Conformance: Major, Minor and Observation
Here are all three. Names and rules vary a little between certification bodies, so check yours.
Type | What it means | Example | What usually happens next |
Major | A requirement is missing or not working, or there is serious doubt the system will deliver its intended results. | No internal audit done for the whole year; a legal permit expired and nobody noticed. | A response with root cause and evidence is required, often against a short deadline. If it isn’t closed, the certificate can be delayed, suspended or withdrawn. |
Minor | An isolated or limited lapse that doesn’t put the whole system in doubt. | One calibration certificate is overdue; one record is missing a signature. | A corrective action plan. The fix is often checked at the next audit. |
Observation (also called opportunity for improvement) | Not a non-conformance. A note that something could become one, or could be better. | A procedure is unclear but still followed; a key control depends on one person. | No formal response is required, but acting on it is wise. |
Common Causes of Non-Conformance
Fixing a problem gets easier once you understand why it happens. These causes come up again and again:
- Processes aren’t documented or controlled. People do the work from memory, and everyone does it differently.
- Teams don’t talk to each other. A change in one department never reaches the next.
- Staff don’t follow the agreed steps. The workflow on paper and the workflow on the floor drift apart.
- Too much personal judgment. Where a clear rule is needed, people decide case by case.
- No planned audits. Without regular self-checks, small gaps grow into system failures.
Look one level deeper and most causes trace back to three things: unclear ownership, weak training, or a process nobody checks.
Trending Posts
Get Free Consultation
Our Clients
Projects
Our Happy Clients
⭐⭐⭐⭐⭐
“PopularCert made our ISO certification process smooth and professional.”
— Manufacturing Client, Oman
⭐⭐⭐⭐⭐
“Excellent support and documentation guidance.”
— Healthcare Client, Saudi Arabia
⭐⭐⭐⭐⭐
“PopularCert simplified our ISO certification process with professional guidance and fast support.”
— Manufacturing Client, Saudi Arabia
How Auditors Decide Between Major and Minor
The certification body grades findings under its own rules, which are based on ISO/IEC 17021-1. There’s no single formula, but auditors tend to ask the same questions:
- Missing or partly missed? A requirement that doesn’t exist in practice points to major.
- One-off or pattern? A single lapse is minor. The same gap across records, sites or shifts points to major.
- Could it affect product, service, safety or the environment? Higher risk means a higher grade.
- Is there a legal effect? A missed legal duty is taken seriously.
- Did your own system catch it? A gap you found and logged yourself looks better than one nobody noticed.
- Is it a repeat? A repeat finding after a closed corrective action is a red flag.
Several minor findings in the same area can add up to a major, because together they show the system isn’t working there. Two bodies may also grade the same facts differently, so don’t treat the grade as a prediction.
How to Identify Non-Conformance
Non-conformances can show up from several places:
- Internal audits: one of the best ways to find gaps early, on your own terms.
- External audits: certification body and customer audits often find what you’ve stopped seeing.
- Customer complaints: a clear sign that a process or product didn’t work as expected.
- Incident reports: especially common in health, safety and environment systems.
- Process monitoring, supplier problems and near-misses: often the earliest warning of all.
Log every finding from every source in one place. That way nothing is lost and you can spot patterns.
Steps to Resolve a Non-Conformance
1. Capture the facts and contain the problem
Write down what happened, when and where, who was involved, and which requirement wasn’t met. Attach evidence such as a record, photo or log. Then stop the problem from spreading: hold the affected product, brief staff, and make a quick fix to the immediate issue. This quick fix is called a correction.
2. Find the root cause
Ask why it happened, not just what happened. Useful tools are the 5 Whys, a fishbone (Ishikawa) diagram and Pareto analysis. “Human error” is a starting point, never an answer. Keep asking until you reach a cause you can actually change.
3. Take corrective action that removes the cause
A correction fixes this one case. A corrective action stops it happening again. Give each action an owner, a due date and a result you can measure. Update procedures, training and risk records if the cause lives there.
4. Check it worked, then close it
Wait long enough to see results, then check. Did the problem come back?
Is the evidence on file? Close the record only when you can show the fix works. If it doesn’t, go back to step 2.
Root Cause Analysis and Corrective Actions: Three Worked 5-Why Examples
These examples are illustrative, not real client cases. Each shows how a “simple” finding turns out to be a system problem.
- Example 1: Overdue calibration (ISO 9001)
Example 1: Overdue calibration (ISO 9001)
Finding: a torque wrench was used on the line two months after its calibration expired.
- Why was it used? Nobody noticed the due date.
- Why not? The date was only in a spreadsheet, not on the tool.
- Why wasn’t the spreadsheet checked? No one reviews it each week.
- Why not? That task belonged to a technician who left, and it was never reassigned.
- Why wasn’t it reassigned? The leaver handover checklist doesn’t list recurring quality tasks.
Root cause: no owner and no trigger for calibration control, caused by a weak handover process.
Corrective action: name an owner and a backup, label every tool with its due date, set automatic reminders, add recurring tasks to the handover checklist, and review product measured with the overdue tool.
Effectiveness check: no overdue tools in the next three monthly reviews.
- Example 2: Hazardous waste in the general bin (ISO 14001)
Finding: used solvent rags were found in general waste.
- Why? The operator used the nearest bin.
- Why? The hazardous waste bin was across the hall, and its label was text only.
- Why didn’t the operator know? He was new and was trained by a colleague.
- Why didn’t training cover it? The induction doesn’t include site waste rules.
- Why not? The induction was written before the solvent process started and was never updated.
Root cause: a new process added a hazardous waste stream, but the change wasn’t assessed, so induction and labels stayed the same.
Corrective action: move the hazardous bin to the point of use, add picture labels, add waste rules and a short check to induction, and add “waste impact” to the change checklist.
Effectiveness check: weekly bin checks show no misplaced waste for three months.
- Example 3: Entry without a permit (ISO 45001)
Finding: a worker entered a tank-cleaning area without a work permit.
- Why? He wanted to finish before the end of his shift.
- Why didn’t he get a permit? The supervisor who signs permits was off site.
- Why was there no one else? Only one person is authorized to sign.
- Why only one? The process was designed assuming that person is always there.
- Why wasn’t that noticed? Nobody tested the process against night and weekend shifts.
Root cause: the permit process depends on a single approver. The failure was in the design, not only in one worker’s choice.
Corrective action: authorize backup approvers on every shift, make stop-work authority clear to all staff, and retrain on the revised process.
Effectiveness check: permit audits across all shifts show every entry covered for three months.
How to Write a CAPA Record: Field by Field
CAPA means corrective and preventive action. A good record is short, clear and complete. Here is what to write in each field, using the overdue calibration case from Example 1. The names and dates are illustrative.
- Reference, date and source: CAPA-2026-014, 5 October 2026, internal audit.
- Finding and requirement: a torque wrench was used on the line two months after its calibration expired. The requirement is that monitoring and measuring equipment must be calibrated (ISO 9001, clause 7.1.5).
- Evidence: calibration register row 31 and the production log for 3 October.
- Containment and correction: the tool was removed from use, and the parts measured with it were reviewed.
- Root cause and method: no owner or trigger for calibration control after a staff handover. Found with the 5 Whys.
- Corrective action, owner and due date: name an owner and a backup, label every tool with its due date, and set automatic reminders. Owner: Quality Manager. Due: 5 November 2026.
- Effectiveness check: no overdue tools in three monthly reviews, ending 5 February 2027.
- Documents, training or risks updated: handover checklist, calibration procedure and risk register.
- Closure: approved by [name] on [date], after the effectiveness check passed.
Non-Conformance in ISO 9001, 14001 and 45001
ISO 9001 covers quality and customer satisfaction. ISO 14001 covers environmental management. ISO 45001 covers occupational health and safety. All three use the same structure, and each has an improvement clause (clause 10) that deals with nonconformity and corrective action.
The rules are much the same in each. You must react to the problem and deal with its effects, check whether the cause needs removing, take action, review whether it worked, and update risks or the system where needed. You must also keep evidence of what the problem was, what you did and what happened. Since the 2015 versions there’s no separate “preventive action” clause. Preventing problems is handled through risk-based thinking.
How PopularCert Can Help
Getting a finding before a surveillance or certification audit is stressful. We help in these ways:
- Non-conformance resolution support: from documenting the finding through to closure.
- Corrective action planning: root cause analysis and actions that remove the cause.
- Audit support: preparation for internal, external and recertification audits.
- ISO consulting: including ISO 9001, ISO 14001 and ISO 45001.
Our consultants work from the UAE, Oman, India and the Philippines, Saudi and other countries. We prepare you; a certification body makes the final decision.
More in Our Audit Guide Series
Primary Sources
- ISO 9000:2015, Quality management systems: Fundamentals and vocabulary (definition of nonconformity)
- ISO 9001:2015, ISO 45001:2018 and ISO 14001 (current edition, 2026): the clauses on nonconformity and corrective action
- ISO/IEC 17021-1:2015, Requirements for bodies providing audit and certification of management systems
- ISO 19011:2018, Guidelines for auditing management systems
Turn Findings Into Improvement
A non-conformance doesn’t have to slow you down. Handled well, it shows you where your system is weak and gives you a chance to fix it for good. Start with the facts, find the real cause, fix it, and prove it worked. Tell us your standards, sites and audit dates, and we’ll help you plan the response.
Our consultants can help you identify root causes, prepare corrective action plans, and build audit-ready evidence. Contact PopularCert today for practical guidance to close findings and strengthen your management system.
FAQ
What would be typically considered major or minor non-conformance?
Is it possible to lose a certification due to non-conformance?
Indeed, this is possible and applicable where, for example cases of major non-conformances are present, John’s case is an insightful illustration. With minor issues too, often there is a need to solve some issues before touching on more fundamental issues prior to obtaining certification.
After being audited, how long do I have to address non-compliance issues?
Most times 30-90 days but this will depend on your certifying body’s regulations.
Do we need reason analysis for all cases of non-compliance?
Yes, particularly when there are patterns over time that seem repetitive demanding needing explanation behind them even if they seem trivial and understanding why incurring those drawing answers enlightens the situation
Are ongoing audit findings something Popularcert can assist with?
Certainly they can help document every action taken towards resolving each finding ensuring seamless retention of your ISO certification achieving rapid closure for retention purposes.
What is a non conformance in ISO?
A non-conformance in ISO refers to a failure to meet the requirements of an ISO standard, company procedure, or legal obligation. It is commonly identified during internal or external audits and must be corrected to maintain ISO certification and compliance.
What is ISO 9001, 14001, and 45001?
ISO 9001 focuses on quality management and customer satisfaction, ISO 14001 covers environmental management and sustainability, and ISO 45001 addresses occupational health and safety at work. Together, these ISO standards help organizations improve performance, reduce risks, and meet international compliance requirements.
- Join 1000+ Certified Companies
Ready to Get Certified for Your Next Project?
- Free Consultation
- Expert Guidance
- Fast Turnaround
Reach Us Now