A nonconformity is a requirement not met: a clause of ISO 27001, a control in your Statement of Applicability, or a rule in your own policies. Certification bodies grade them. A major nonconformity is a breakdown that puts the ISMS's intended results in doubt and blocks certification until it is corrected and verified; a minor one is an isolated lapse that needs an accepted corrective action plan and is checked at the next audit. Clause 10.2 sets the response: react and correct, find the root cause and check whether the same problem exists elsewhere, act on the cause, review whether the action worked, change the ISMS if needed, and record all of it.
Every ISO 27001 audit produces findings, and the first certification audit of a young ISMS usually produces several. What decides the outcome is not whether there are findings but how they are graded and how you respond. This article explains the grades certification bodies use, the clause 10.2 process for closing a finding, and the timelines that apply.
Where nonconformities come from
- The internal audit, which should find most of them first.
- The certification body's Stage 2, surveillance and recertification audits.
- Monitoring and measurement under clause 9.1: a control that stops running, an objective missed.
- Incidents, when the investigation shows a control was not followed.
- Complaints and feedback from customers, regulators or staff.
Major, minor and opportunities for improvement
| Finding | Definition | Examples | What the certification body requires |
|---|---|---|---|
| Major nonconformity | A requirement not met in a way that puts the ISMS's ability to achieve its intended results in doubt | No internal audit; a control declared applicable with no evidence it exists; several minors in one area showing a process has failed; a policy nobody follows | Correction, root cause analysis and corrective action verified by the body before certification; at surveillance, resolution within the time set or the certificate is suspended |
| Minor nonconformity | An isolated lapse against a requirement that does not undermine the management system | One quarterly access review missed; a policy past its review date; a leaver whose access was removed late; a record missing for a control that otherwise operates | A corrective action plan with root cause, accepted on paper before the decision; implementation verified at the next audit |
| Opportunity for improvement | The requirement is met, but the practice is weak, inefficient or likely to slip | A risk register that is accurate but hard to maintain; training that is complete but generic | Nothing formal; the organisation decides whether to act, and repeated OFIs on the same point can become findings |
Clause 10.2, step by step
- React: control and correct the nonconformity and deal with its consequences. Restore the missed access review, remove the leaver's access, patch the system.
- Evaluate: decide whether action is needed to eliminate the cause so it does not recur, by reviewing the nonconformity, determining its cause, and checking whether similar nonconformities exist or could occur elsewhere.
- Act: implement the corrective action. Change the process, the tooling, the ownership or the training that let it happen.
- Review: check that the action was effective, after enough time for the process to run again.
- Update: change the ISMS, the policy or the risk assessment if the finding showed they were wrong.
- Record: keep documented information on the nature of the nonconformity, the actions taken and their results.
Correction versus corrective action
The distinction is the one auditors test. Correction is the fix to the instance: the access was removed. Corrective action addresses why the instance happened: the leaver process depended on HR emailing IT, so it was moved into the HR system's offboarding workflow with a check against the identity provider. A response that stops at correction is accepted for an opportunity for improvement and rejected for a nonconformity, because without the cause removed the finding will reappear at the next audit, upgraded.
Writing a corrective action plan that is accepted
- The finding, quoted as the auditor wrote it, with its reference.
- The correction already made, with a date and evidence.
- The root cause, in one or two sentences, found by asking why until the answer is a process or a decision rather than a person.
- The extent: whether the same cause affects other controls, teams or sites, and what was checked.
- The corrective action, with an owner and a target date.
- How effectiveness will be reviewed, and when.
Timelines
The certification body sets the deadlines, within the rules of ISO/IEC 17021-1. For the initial certification, major nonconformities from Stage 2 have to be corrected and the correction verified before the certificate can be recommended; if that cannot be done within six months of the last day of Stage 2, the body has to repeat Stage 2. Minor nonconformities need an accepted plan before the decision and are verified at the first surveillance audit. At surveillance and recertification, unresolved majors lead to suspension, and a suspension not resolved within the time the body sets, usually no more than six months, leads to withdrawal. The surveillance guide covers that sequence.
Trends: the management review input
Clause 9.3 lists trends in nonconformities and corrective actions among the management review inputs, so the log is not closed and forgotten. Group findings by area and by cause, show how many are open and how long closure takes, and let the review decide where the ISMS needs resources. A log that shows the same cause three years running is a finding of its own. The management review article covers the other inputs.
Tracking findings in Noru
Findings raised in Noru's internal audits are recorded against the control they concern, carried into the audit report, and tracked until they are closed, so the corrective action and its evidence sit next to the control the next auditor will test. Security findings from connected systems are linked to risks and tracked to resolution in the same way.