Examples are a policy past its review date, one access review missed out of four, or a record missing for a control that otherwise operates. The auditor still expects a root-cause analysis and a corrective action plan, usually accepted on paper before the certificate is issued and verified at the next surveillance audit.
Several minor findings in the same area can be escalated to a major one. See major nonconformity.
Read more
Related terms
- Major nonconformity
- A major nonconformity is an audit finding that a mandatory requirement is missing or has broken down, serious enough to block or suspend an ISO certificate.
- Nonconformity
- A nonconformity is a failure to meet a requirement of a management system standard or of the organization's own documented management system.
- Corrective action
- A corrective action is what an organization does to remove the root cause of a nonconformity so that it does not recur, with the result checked and recorded.
- Opportunity for improvement
- An opportunity for improvement is an auditor's note that something could be done better, recorded without being a nonconformity or requiring corrective action.