Audit Findings: Major vs Minor Nonconformity, With Examples

An audit report lists findings, and for many people the word “nonconformity” alone sounds threatening. Yet findings are what an audit actually delivers: they show exactly where you need to act. What matters is understanding the levels, being able to challenge a grading and responding correctly.

What a finding is, according to the standard

The term comes from ISO 19011:2026, the guidance for auditing management systems. An audit finding is the result of evaluating the collected audit evidence against the audit criteria (3.11). The criteria are the standard, your own requirements, a contract or a law.

One consequence gets lost almost every time: a finding can show conformity. The standard says so explicitly in a note. A second note lists risks, opportunities for improvement and good practice as possible results. If your report only contains nonconformities, half of the information is missing.

Where the criteria come from statutory or regulatory requirements, the standard speaks of compliance and non-compliance. For an audit against ISO/IEC 42001 or ISO/IEC 27001, it stays conformity and nonconformity.

The levels of a finding

Major and minor nonconformities are defined in ISO/IEC 17021-1, the standard for bodies that audit and certify management systems. The standard mentions opportunities for improvement as an option. Every other level is the wording of the individual certification body.

• Major nonconformity: a requirement is not fulfilled, and this affects the capability of the management system to achieve its intended results (3.12). A typical case according to the note: there is significant doubt that a process is effectively controlled.
• Minor nonconformity: a requirement is not fulfilled, but the capability of the system remains intact (3.13). Usually an isolated case or a limited gap.
• Observation or note: not a term defined in 17021-1. I counted. The word “observation” appears four times in the standard, not once as a level of finding. What an observation means is set by your certification body. Ask.
• Opportunity for improvement (OFI): the standard allows such notes as long as the certification scheme does not prohibit them (9.4.5.2). A real nonconformity, however, must never be recorded as an opportunity for improvement.

The most important rule sits in the note to 3.12: several minor nonconformities against the same requirement can together demonstrate a systemic failure and then constitute a major one. Three missing training records are three isolated cases. Three missing training records, and nobody knows who is supposed to keep them, is a process that does not exist.

Examples: major or minor?

The grading always depends on the case: on scope, on risk and on whether there is a pattern behind it. This is how I would grade the following example cases for ISO/IEC 42001 and ISO/IEC 27001.

The rows come in pairs on purpose. The same weakness can become a major the moment it is no longer a slip. This is exactly where it pays to ask in the closing meeting whether the auditor saw a pattern or a single case.

How to check a finding before you accept it

A nonconformity must be recorded against a specific requirement and state the objective evidence it is based on (ISO/IEC 17021-1, 9.4.5.3). The same clause requires the auditor to discuss nonconformities with you, so that the evidence is accurate and the nonconformity is understood. That gives you three questions for the closing meeting:

• Against which requirement exactly? A clause, an Annex A control or your own requirement. “Could be better” is not a requirement.
• What evidence? A document, a record, an observation on site or a statement that was verified.
• Why this level? For a major, the auditor must be able to explain why it affects the system’s capability to achieve its intended results.

What you will not get is a solution. The audit team of a certification body may identify opportunities for improvement but must not recommend specific solutions (9.4.8.1). That is not reluctance. Whoever writes your solution would audit it next year, and then nobody audits anymore. For the same reason, I do not advise any company I audit.

The right response in three steps

• Correction (immediate): fix the specific problem right away.
• Root cause analysis: understand why it happened, not just the symptom.
• Corrective action (CAPA): eliminate the cause so it does not recur, then verify that the action was effective.

If you only fix the symptom, you will see the same nonconformity again at the next audit. Root cause analysis is the real lever.

For your own management system, ISO/IEC 42001 and ISO/IEC 27001 require exactly these steps in clause 10.2. That applies to every nonconformity, including those from your internal audit.

What does this mean for certification?

This is where the levels become hard. Before deciding on the certificate, the certification body must have reviewed, accepted and verified the correction and corrective actions for any major nonconformity. For minors, it is enough that it has reviewed and accepted your plan (ISO/IEC 17021-1, 9.5.2).

• Initial certification: if the body cannot verify the implementation for a major nonconformity within six months after the last day of stage 2, another stage 2 must take place before certification is recommended (9.5.3.2).
• Recertification: the body sets time limits for every major nonconformity, and the actions must be implemented and verified before the certificate expires (9.6.3.2.2). If that fails, recertification is not recommended and the certificate is not extended (9.6.3.2.4).
• Minor nonconformities: the body usually reviews the implementation of the accepted plan at the next surveillance audit.

A clean, honest root cause analysis counts for more than a quick cosmetic fix. At the next visit the auditor will see whether the action worked or only exists on paper.

Mature organizations welcome findings. They are expert pointers to real weaknesses, identified in the protected setting of an audit and not only in an actual incident. Once you internalize that, the audit becomes a tool for improvement instead of a source of exam-style anxiety.