A nonconformity is one of the most important outcomes of an audit because it identifies a gap between what is required and what is actually happening. However, not every nonconformity has the same level of significance.
One of the most important skills an auditor must develop is the ability to determine whether a finding should be treated as a major nonconformity or a minor nonconformity.
This decision should never be based simply on how serious the auditor personally feels the issue is. It should be based on objective evidence, applicable requirements, the extent of the failure, and its impact on the effectiveness of the management system.
For auditors working with standards such as ISO 9001, ISO 14001, ISO 45001 and other management system standards, understanding this distinction is essential for producing accurate, defensible and consistent audit results.
What Is a Nonconformity?
A nonconformity occurs when a requirement has not been fulfilled.
The requirement may come from several sources, including:
The applicable ISO standard
Legal or regulatory requirements
Customer requirements
Organizational procedures
Contractual requirements
Internal policies
Documented processes
Other requirements applicable to the management system
For example, if an organization’s procedure requires all measuring equipment to be calibrated at defined intervals, but an auditor finds equipment being used after its calibration period has expired, there may be a nonconformity.
The auditor’s responsibility is not simply to identify the problem. The auditor must determine what requirement applies, what evidence demonstrates the failure, and how significant the failure is.
Major vs Minor Nonconformity: Why Does the Difference Matter?
The classification of a nonconformity influences how the organization responds to the finding and how the effectiveness of its management system is evaluated.
A minor nonconformity generally represents an isolated or limited failure to meet a requirement that does not indicate a significant breakdown of the management system.
A major nonconformity, on the other hand, generally indicates a significant failure that affects the system’s ability to achieve its intended results, or a substantial failure to meet an applicable requirement.
The exact classification criteria can vary depending on the certification scheme, audit program, applicable standard and certification body’s rules. Therefore, auditors should always follow the relevant audit and certification requirements rather than relying on a universal definition.
What Is a Minor Nonconformity?
A minor nonconformity is generally a limited failure to fulfill a requirement where the management system remains capable of achieving its intended outcomes.
The important point is that “minor” does not mean “unimportant.”
A minor finding still requires correction and appropriate corrective action where applicable.
Example
Suppose an organization has 200 employees and requires employees who perform a particular process to complete annual competency evaluations.
During the audit, the auditor discovers that one employee’s evaluation was not completed on time.
The organization has:
- A defined competency process
- Records for almost all employees
- Evidence that evaluations are routinely conducted
- A functioning system for monitoring competency
The evidence may indicate an isolated failure rather than a systemic breakdown.
Depending on the applicable requirements and certification body’s classification rules, this could potentially be treated as a minor nonconformity.
The auditor should document the objective evidence rather than simply writing:
“One employee was not evaluated.”
A stronger finding would identify the requirement, evidence and failure clearly.
What Is a Major Nonconformity?
A major nonconformity generally indicates a significant failure of the management system or a failure that affects its ability to achieve intended results.
It may arise when:
An entire required process is missing or ineffective.
A critical requirement has not been implemented.
A repeated or widespread problem demonstrates systemic failure.
There is significant doubt that the management system can achieve its intended outcomes.
A requirement is fundamentally not being addressed.
Multiple related minor findings collectively demonstrate a systemic problem.
For example, imagine that an organization claims to have a documented internal audit program, but the auditor discovers that:
Internal audits have not been conducted for several years.
No audit program is being implemented.
Audit records do not exist.
Management has not evaluated whether the system is functioning effectively.
This is considerably different from finding one missing audit record.
The issue may indicate that the internal audit process itself is not effectively implemented.
Depending on the applicable certification criteria, this could support classification as a major nonconformity.
The Most Important Question: Is the Problem Isolated or Systemic?
One of the most useful questions an auditor can ask is:
Is this an isolated failure, or does the evidence indicate a systemic breakdown?
Consider two scenarios.
Scenario 1: Isolated Failure
An organization has a purchasing procedure requiring supplier evaluations.
The auditor reviews 30 supplier files and finds that one file is missing the latest evaluation record.
The other 29 files contain the required records, and interviews and sampling show that the process is generally implemented.
This may indicate an isolated failure.
Scenario 2: Systemic Failure
The auditor reviews the same process and finds:
18 of 30 supplier files have no evaluation records.
Employees are unclear about the evaluation process.
The purchasing procedure has not been followed for months.
Management has no evidence that supplier performance is being monitored.
The issue is no longer simply a missing record.
The evidence suggests that the supplier evaluation process is not effectively implemented.
That distinction can be critical when determining the classification.
The Five Questions an Auditor Should Ask
Before classifying a nonconformity, an auditor can work through a structured evaluation.
1. What Requirement Has Not Been Fulfilled?
Start with the requirement.
Ask:
What exactly was required?
The requirement should be traceable to an objective source.
For example:
ISO standard requirement
Regulatory requirement
Customer requirement
Internal procedure
Contractual requirement
Avoid writing findings based solely on personal expectations.
An auditor should never create a requirement that does not exist.
2. What Is the Objective Evidence?
The next question is:
What did I actually observe, review or verify?
Objective evidence could include:
Records
Documents
Interviews
Observation of activities
Production data
Inspection results
Training records
Calibration records
Audit reports
Customer complaints
Process measurements
An auditor should distinguish between evidence and assumptions.
For example:
Weak conclusion:
“Employees do not understand the procedure.”
Better audit evidence:
“During interviews with three operators, two were unable to explain the required inspection frequency specified in procedure XYZ.”
The second statement is based on specific evidence.
3. How Extensive Is the Failure?
The auditor should consider the extent of the problem.
Ask:
Is it one occurrence?
Are several departments affected?
Does it involve multiple products?
Has it occurred repeatedly?
Does it affect multiple records or processes?
Is the failure widespread?
Sampling is particularly important here.
An auditor should not automatically classify a finding as minor simply because only one example was identified. Likewise, finding one example does not automatically prove a major systemic failure.
The auditor needs sufficient evidence to understand the extent of the problem.
4. Does the Failure Affect the Effectiveness of the Management System?
The auditor should evaluate whether the failure threatens the organization’s ability to achieve the intended outcomes of the relevant process or management system.
For example, a missing signature on one isolated record may have limited significance.
But if required monitoring is consistently absent, management may no longer have reliable information about whether the process is operating effectively.
This changes the nature of the finding.
The auditor should therefore look beyond the individual record and consider the process behind the record.
5. Is There a Pattern?
Patterns are important audit evidence.
Suppose an auditor finds one expired calibration certificate.
The auditor should investigate further.
Are there other expired instruments?
Does the organization have a functioning calibration monitoring system?
Has the same issue appeared in previous audits?
Are employees aware of the calibration requirements?
If additional sampling reveals multiple similar failures, the auditor now has stronger evidence that the issue may be systemic.
The classification should be based on the evidence available during the audit—not on speculation.
Major vs Minor Nonconformity: A Practical Comparison
| Factor | Minor Nonconformity | Major Nonconformity |
|---|---|---|
| Extent | Usually limited or isolated | Significant, widespread, or systemic |
| Management system | Generally functioning | Significant breakdown or ineffective implementation |
| Process effectiveness | Limited impact | Significant impact on intended outcomes |
| Requirement | Partially or inconsistently fulfilled | Fundamental or significant failure to fulfill |
| Evidence | Usually limited in scope | Strong evidence of systemic or significant failure |
| Recurrence | May be isolated | Repeated or persistent failures may support major classification |
| Corrective action | Requires correction and appropriate action | Requires robust corrective action and often closer follow-up |
| Auditor concern | Localized weakness | Significant loss of confidence in system effectiveness |
This table is a practical guide, not a replacement for the specific classification criteria applicable to the audit.
Examples of Major vs Minor Nonconformities
Example 1: Training Records
Requirement: Employees performing a defined process must receive appropriate training.
Finding A
One employee’s training record is missing a required signature. Other evidence confirms that the employee completed the required training.
This could potentially be a minor nonconformity, depending on the applicable requirements and certification criteria.
Finding B
The organization has no effective system for identifying training needs. Several employees performing critical activities have no evidence of required training, and management cannot demonstrate that competency is being evaluated.
This could potentially support a major nonconformity because the issue is broader than a missing record.
Example 2: Internal Audits
Finding A
The internal audit schedule shows that one department’s audit was completed several weeks later than planned, but the audit program is otherwise implemented and effective.
This may be a minor issue, depending on the circumstances.
Finding B
The organization has not implemented its internal audit program. Required internal audits have not been conducted across the management system, and there is no evidence of systematic evaluation of conformity.
This may indicate a significant failure of the internal audit process.
Example 3: Corrective Action
Finding A
One corrective action record does not clearly document the verification of effectiveness.
If the broader corrective action process is functioning, the issue may be limited.
Finding B
The organization repeatedly closes nonconformities without investigating causes or verifying whether corrective actions have been effective.
If this pattern is widespread, it may demonstrate that the corrective action process itself is ineffective.
Example 4: Document Control
Finding A
One obsolete printed procedure is found at a workstation, while the organization’s document control system otherwise operates effectively.
The auditor should investigate whether the document was actually being used and whether the issue is isolated.
Finding B
Multiple departments are using obsolete procedures, employees cannot identify the current versions, and the organization has no effective mechanism for controlling documented information.
This could indicate a broader management system failure.
Does Risk Automatically Determine Major vs Minor Nonconformity?
Not necessarily.
Risk is an important consideration, but auditors should avoid using a simplistic rule such as:
“High risk = major.”
A high-risk activity can have an isolated documentation error that does not necessarily demonstrate a systemic management system failure.
Similarly, a seemingly administrative issue can reveal a significant systemic weakness.
For example, a missing signature may appear minor. But if the missing signature represents the organization’s only control for verifying authorization of a critical activity, the auditor may need to investigate further.
The key is to evaluate the requirement, evidence, extent, effectiveness and consequences within the applicable audit criteria.
Can Several Minor Nonconformities Become a Major Nonconformity?
Yes, depending on the circumstances and applicable certification rules.
Several findings that appear individually limited may collectively demonstrate a systemic problem.
For example:
- One missing supplier evaluation
- One overdue calibration
- One incomplete training record
- One missed internal audit
- One unresolved corrective action
Individually, each finding might be limited.
But if the auditor discovers that these issues are all caused by the same underlying weakness—such as ineffective monitoring of the management system—the auditor may need to consider whether the combined evidence demonstrates a more significant failure.
The auditor should not simply “add up” minor findings mechanically.
The question is whether the findings collectively demonstrate a systemic breakdown or significant failure.
Common Mistakes Auditors Make
1. Classifying Based on Personal Opinion
An auditor may think:
“This looks serious, so I’ll call it major.”
That is not sufficient.
The classification should be supported by objective evidence and applicable criteria.
2. Treating Every Repeat Finding as Major
Recurrence is important, but repetition alone does not automatically make a finding major.
The auditor should determine:
What has been repeated?
How often?
Across which processes?
Why did it recur?
Does it indicate a systemic failure?
3. Focusing Only on Documents
A management system is not just a collection of documents.
An organization may have an excellent procedure but fail to implement it.
Conversely, an organization may have limited documentation but demonstrate effective process control where the applicable requirements permit it.
Auditors should evaluate implementation and effectiveness, not documents alone.
4. Writing Vague Findings
A finding such as:
“The process is not effective.”
does not provide enough information.
A strong nonconformity statement should allow the organization to understand:
What requirement was not met?
What evidence demonstrates the failure?
Where was the failure observed?
How to Write a Strong Nonconformity Statement
A useful structure is:
Requirement + Objective Evidence + Statement of Nonconformity
For example:
Requirement: The organization’s procedure requires calibration of measuring equipment at defined intervals.
Evidence: Equipment ID M-014 was observed in production on 10 August, while its calibration certificate expired on 30 June. The calibration monitoring record did not show evidence of renewal.
Nonconformity: The organization did not ensure that the measuring equipment was maintained within the defined calibration requirements.
This is much stronger than:
“Calibration system is not working.”
The first version gives the organization and the certification body something that can be objectively evaluated.
The Auditor Should Not Prescribe the Solution
Another important principle is that the auditor identifies the nonconformity, not the organization’s corrective-action solution.
For example, an auditor should avoid writing:
“The company must purchase calibration software.”
The requirement may not specify that software must be used.
Instead, the auditor should identify the failure:
“The organization did not ensure that measuring equipment was calibrated within the defined interval.”
The organization is then responsible for determining the appropriate correction and corrective action.
When faced with a nonconformity, an auditor can work through the following sequence:
Step 1: Identify the requirement
What requirement applies?
Step 2: Confirm the evidence
What did you actually see, hear, review or verify?
Step 3: Define the gap
How does the evidence demonstrate that the requirement was not fulfilled?
Step 4: Determine the extent
Is the failure isolated, repeated, widespread or systemic?
Step 5: Evaluate effectiveness
Does the failure affect the ability of the relevant process or management system to achieve its intended results?
Step 6: Investigate patterns
Are there similar findings elsewhere?
Step 7: Check applicable classification criteria
Use the relevant standard, certification scheme, audit procedure or certification body’s rules.
Step 8: Classify and document
Select the appropriate classification and write a clear, evidence-based finding.
This approach helps auditors avoid making classification decisions based purely on intuition.
A Simple Auditor Decision Tree
An auditor can ask:
Is there a requirement?
→ If no, do not create a nonconformity based on personal preference.
→ If yes, continue.
Is there objective evidence that the requirement was not fulfilled?
→ If no, gather more evidence.
→ If yes, continue.
Is the failure isolated or limited?
→ Consider whether it represents a minor nonconformity under the applicable criteria.
Is the failure widespread, repeated, systemic, or significantly affecting the management system’s ability to achieve intended results?
→ Consider whether it meets the applicable criteria for a major nonconformity.
Is the classification supported by evidence?
→ If not, investigate further before finalizing the finding.
What Should an Auditor Do When Unsure?
Auditors will sometimes encounter borderline cases.
When that happens, the best response is not to classify the finding immediately.
Instead:
Review the applicable requirement.
Gather additional objective evidence.
Expand sampling where justified.
Determine the extent of the issue.
Discuss the evidence with the audit team where applicable.
Refer to the applicable certification body’s classification criteria.
Ensure the final finding is defensible.
Audit conclusions should be based on evidence—not pressure from the organization, assumptions or the auditor’s personal expectations.
Why Auditor Judgment Matters?
Audit standards provide requirements and auditing principles, but auditors still need professional judgment.
Two auditors may encounter the same type of issue and initially view its significance differently.
That is why auditors need to develop the ability to:
Ask effective questions
Follow audit trails
Sample intelligently
Evaluate objective evidence
Recognize patterns
Distinguish symptoms from systemic failures
Understand process effectiveness
Document findings precisely
Strong auditors do not simply identify errors.
They determine what the evidence means in relation to the audit criteria.
Final Takeaway
The difference between a major vs minor nonconformity is not simply the size of the mistake.
The real question is the significance and extent of the failure in relation to the applicable requirements and the effectiveness of the management system.
A useful mindset for auditors is:
Don’t classify the finding based on how serious it looks. Classify it based on what the evidence demonstrates.
An isolated failure may be minor. A widespread or systemic breakdown may be major. But the auditor must establish that distinction through objective evidence, appropriate sampling and the applicable classification criteria.
For anyone preparing to become an ISO lead auditor, this is one of the practical skills that separates simply knowing the clauses from being able to conduct an effective audit.
Frequently Asked Questions
What is the difference between a major vs minor nonconformity?
A minor nonconformity is generally a limited failure to fulfill a requirement, while a major nonconformity generally involves a significant or systemic failure that affects the effectiveness of the management system or its ability to achieve intended results. The exact classification criteria depend on the applicable audit and certification requirements.
Does one nonconformity always mean the organization has a major problem?
No. One finding may represent an isolated failure. The auditor needs to evaluate its extent, recurrence, significance and relationship to the effectiveness of the relevant process and management system.
Can a repeated minor nonconformity become major?
Potentially, yes. Repeated or widespread failures may provide evidence of a systemic weakness. However, auditors should evaluate the overall evidence rather than automatically upgrading a finding simply because it has occurred before.
Is risk the only factor used to determine classification?
No. Risk can be relevant, but classification should also consider the applicable requirement, objective evidence, extent of the failure, recurrence and impact on management system effectiveness.
Should auditors tell organizations exactly how to fix a nonconformity?
Generally, auditors should identify and document the nonconformity rather than prescribe the organization’s corrective-action solution. The organization is responsible for determining how to address the issue in accordance with its management system and applicable requirements.
What makes a good nonconformity statement?
A strong statement clearly identifies the applicable requirement, provides objective evidence of the failure and explains the resulting nonconformity. It should be specific enough that another competent auditor can understand and evaluate the finding.
Understand ISO 9001 in Manufacturing Industry
Conclusion
Understanding major vs minor nonconformity is fundamental to effective auditing.
The strongest auditors are not those who issue the most findings. They are those who can distinguish isolated weaknesses from systemic failures, support conclusions with objective evidence and communicate findings clearly and consistently.
That is the foundation of professional audit judgment.
