Major vs minor
A major nonconformity means a requirement is not met at all or a control is failing in a way that puts the management system at risk. It can stop or delay certification until it is fixed. A minor nonconformity is an isolated lapse that does not undermine the system as a whole. Auditors may also raise observations or opportunities for improvement, which are not nonconformities.
What happens next
The organisation must correct the issue, find the root cause and take corrective action so it does not happen again. For major nonconformities, the certification body usually needs evidence of the fix before issuing or keeping the certificate.
Common examples
Typical findings include access reviews that were never done, missing evidence of training, an out of date risk assessment, or a Statement of Applicability that does not match reality.
Internal nonconformities
Nonconformities found in internal audits follow the same process. Finding them internally first is the point of the internal audit.
