Typical examples are a clause that is not implemented at all, such as no internal audit having taken place, a control declared applicable in the Statement of Applicability with no evidence it operates, or several minor findings that together show a process has failed. The certificate cannot be recommended until the certification body has verified the corrective action, often in a follow-up visit.
See minor nonconformity and corrective action.
Read more
Related terms
- Minor nonconformity
- A minor nonconformity is an audit finding of a single lapse or partial gap against a requirement that does not undermine the management system as a whole.
- Nonconformity
- A nonconformity is a failure to meet a requirement of a management system standard or of the organization's own documented management system.
- Corrective action
- A corrective action is what an organization does to remove the root cause of a nonconformity so that it does not recur, with the result checked and recorded.
- Stage 2 audit
- A Stage 2 audit is the main part of ISO 27001 certification, in which the certification body tests that the ISMS is implemented and operating as documented.
- Surveillance audit
- A surveillance audit is the yearly audit a certification body performs between ISO certification audits to confirm the management system is still maintained.