What Is Nonconformity in ISO Audits?

If you’ve ever sat through an ISO audit debrief and heard the word “nonconformity” land with a noticeable drop in the room’s energy, you already sense that it matters — but a lot of people working toward or maintaining certification never actually get a clear, precise explanation of what the word means, where it comes from, and what happens next. This guide fixes that. By the end, you’ll understand exactly what a nonconformity is, how it differs from related terms people often confuse it with, and what your organization is actually required to do about it.

What Is a Nonconformity?

The starting point is the standard’s own definition, because everything else in this guide builds from it. ISO 9000:2015, clause 3.6.9, defines a nonconformity as:

“Non-fulfilment of a requirement.”

That’s it. Four words. But it’s worth sitting with that definition for a moment, because it’s more precise — and broader — than most people initially assume.

Notice what the definition does not say. It doesn’t say a nonconformity is a defective product. It doesn’t say it’s a customer complaint. It doesn’t say it’s a mistake that caused harm. It simply says: something that was required did not happen.

This matters because it means a nonconformity can exist even when nothing “went wrong” in the everyday sense. If a procedure required a document to be reviewed annually, and eleven months passed without that review, that’s a nonconformity — even if the document itself turned out to be perfectly fine. The gap is between what was required and what actually happened, not between what was good and what was bad.

What Counts as a “Requirement”?

Since a nonconformity is defined entirely in relation to a “requirement,” it’s worth being clear about where requirements actually come from. A requirement isn’t limited to the ISO standard itself — it can originate from any of the following:

The ISO standard being audited against (e.g., a specific clause of ISO 9001, ISO 45001, or ISO 22000)
Regulatory or statutory obligations — legal requirements applicable to the organization’s industry or location
Customer requirements — specifications, contracts, or service level agreements a customer has set
The organization’s own documented procedures — if your own quality manual says a process happens a certain way, that becomes a requirement your organization is now measured against, even if the standard itself doesn’t mandate that specific detail

This last category catches a lot of people off guard. Organizations sometimes over-document their own procedures, unintentionally creating internal requirements stricter than what the ISO standard actually demands — and then get flagged for nonconformities against their own rules, not ISO’s.

Nonconformity vs. Defect: Not the Same Thing

These two terms get used almost interchangeably in casual conversation, but ISO 9000:2015 defines them differently, and the distinction is genuinely useful.

A nonconformity (clause 3.6.9) is non-fulfilment of any requirement.

A defect (clause 3.6.10) is specifically the non-fulfilment of a requirement related to an intended or specified use — in other words, a defect is a particular category of nonconformity, one tied specifically to whether a product or service can actually do what it’s meant to do.

Put simply: every defect is a nonconformity, but not every nonconformity is a defect. A missing training record is a nonconformity, but it isn’t a defect — nothing about the product or service itself failed to meet its intended use. A product manufactured outside its specified tolerance, on the other hand, is both.

Nonconformity vs. Observation vs. Opportunity for Improvement

This is one of the most common sources of confusion during audits, so it’s worth separating clearly.

Nonconformity — a requirement was not met. This is factual and evidence-based: either the requirement existed and wasn’t fulfilled, or it was.

Observation — different certification bodies use this term slightly differently, but it generally refers to something an auditor notices and records that doesn’t itself constitute a clear breach of a specific requirement, though it may be worth attention (sometimes used as a lower-severity category adjacent to a minor nonconformity, depending on the certification body’s own grading scheme).

Opportunity for Improvement (OFI) — this is fundamentally different from a nonconformity. An OFI identifies a possible way to improve a process where no requirement has actually been breached. Nothing failed; the auditor is simply suggesting the process could work better. OFIs are not nonconformities and don’t require the same formal corrective action response, though well-run organizations often act on them anyway.

The clean distinction to remember: if no requirement was breached, it’s not a nonconformity — whatever else it might be called.

Major vs. Minor Nonconformity

Not every nonconformity carries the same weight. A minor nonconformity is an isolated slip — the process exists and generally works, but failed once, like a single missing training record. A major nonconformity signals something bigger: a required process is missing entirely, or the failure is widespread enough to put the whole management system at risk. Get the classification wrong, and certification can be delayed until it’s resolved.

→ Full breakdown: Major vs. Minor Nonconformity: What’s the Difference?

How a Nonconformity Gets Documented?

When an auditor identifies a nonconformity, it isn’t simply noted verbally — it needs to be recorded formally, typically in what’s called a Nonconformity Report (NCR), sometimes referred to as an NCAR when it explicitly includes the corrective action response.

According to ISO’s own Technical Committee (TC 176) guidance on documenting nonconformities, a properly documented nonconformity has three essential parts:

The audit evidence — the specific, factual evidence that supports the auditor’s finding (what was actually observed, checked, or reviewed)
A record of the requirement — a clear reference to exactly which requirement (standard clause, procedure, contract term, or regulation) was not fulfilled
The statement of nonconformity — a clear, precise description connecting the evidence to the requirement, explaining exactly what gap exists between them

This structure exists for a good reason: a vague nonconformity statement (“training records are inadequate”) is far less useful — and more open to dispute — than a precise one (“Clause 7.2 requires documented evidence of competence for all personnel performing internal audits; audit of the training file for [role] found no evidence of completed internal auditor training, contrary to this requirement”).

What Happens After a Nonconformity Is Found?

ISO 9001:2015’s Clause 10.2 (Nonconformity and Corrective Action) sets out what an organization is actually required to do once a nonconformity has been identified — and this same underlying logic applies across other management system standards built on the same Harmonized Structure, including ISO 45001 and ISO 22000.

The required sequence generally involves:

React to the nonconformity — take immediate action to control and correct it, and deal with any consequences that resulted from it

Evaluate the need for corrective action — determine whether the root cause needs to be eliminated so the nonconformity doesn’t happen again, by reviewing and analyzing the nonconformity, determining its cause, and checking whether similar nonconformities exist or could potentially occur elsewhere

Implement any corrective action needed — actions specifically aimed at addressing the root cause, not just the immediate symptom

Review the effectiveness of the corrective action taken — confirming the fix actually worked, rather than simply assuming it did

Update risks and opportunities, and make changes to the management system, if necessary, based on what was learned

It’s worth being precise about one distinction here too: a correction addresses the immediate nonconformity itself (fixing the specific instance), while a corrective action addresses the underlying cause, to prevent it from recurring. Organizations are required to do both — correcting what happened, and addressing why it happened in the first place.

Why Nonconformities Matter for Certification?

The practical consequence of a nonconformity depends heavily on its classification. If an auditor identifies one or more major nonconformities during a certification audit, certification is generally not recommended until the major nonconformity has been properly addressed and verified as closed — sometimes requiring a follow-up visit before the certificate can be issued.

Minor nonconformities typically don’t block certification outright, but they still require a documented corrective action response within a defined timeframe, and unresolved or recurring minor nonconformities can escalate into a major finding at a subsequent audit.

This is precisely why internal audits matter so much before an external certification audit ever happens: a well-trained internal auditor catches and resolves nonconformities on the organization’s own timeline, rather than having them surface — and potentially delay certification — in front of an external certification body.

Frequently Asked Questions

Is a nonconformity the same as a failure?

Not necessarily in the everyday sense of the word. A nonconformity means a requirement wasn’t fulfilled — it doesn’t always mean something broke or caused harm. A missed documentation deadline is a nonconformity even if the underlying work was done correctly.

Who decides if a nonconformity is major or minor?

The auditor makes the classification during the audit, based on a documented, objective grading system that the certification body is required to maintain under ISO/IEC 17021-1. ISO 9001 and ISO 19011 themselves don’t define the major/minor distinction directly.

Can a business still get ISO certified with nonconformities?

Minor nonconformities generally don’t block certification, provided a corrective action plan is submitted within the required timeframe. Major nonconformities typically must be resolved and verified before certification is granted.

What’s the difference between a nonconformity and a corrective action?

A nonconformity is the finding itself — the gap between what was required and what happened. A corrective action is the response: the action taken to address the root cause so the nonconformity doesn’t recur.

Does every nonconformity need a formal corrective action?

Every nonconformity requires a reaction and correction of the immediate issue. Whether a full root-cause corrective action process is required depends on the organization evaluating the need for it — though in practice, most formally documented nonconformities do receive one.

Final Thoughts

“Nonconformity” sounds like a harsh word, but at its core it’s a simple, precise concept: a requirement existed, and it wasn’t met. Understanding exactly what that means — and how it differs from a defect, an observation, or an opportunity for improvement — makes audits far less intimidating and far more useful, because you start seeing nonconformities for what they actually are: specific, evidence-based signals about where a management system needs attention, not verdicts on whether your organization is “good” or “bad” at what it does.