Plain definition
A nonconformity is the non-fulfillment of a requirement. The requirement may come from an ISO management system standard, the organization's own documented information, a customer contract, or applicable law and regulation that the system commits to meet.
In audits, a nonconformity is a finding supported by evidence against a stated requirement — not a vague opinion.
How findings are often classified
Certification bodies commonly distinguish major and minor nonconformities (terminology can vary). Majors typically indicate absence of a required system element or a serious failure that raises doubt about the system's ability to achieve intended results. Minors are localized failures that do not indicate system breakdown.
Opportunities for improvement are not nonconformities; they are suggestions. Do not confuse the categories.
Illustrative examples (not exhaustive)
Required process not established. Calibration overdue on measuring equipment used for product acceptance. Competence not determined for a critical role. Customer complaints not analyzed. Internal audit programme not implemented. Corrective action that never addresses cause.
Examples must always be tied back to a specific requirement in the audit criteria.
What to do when a nonconformity is raised
Contain the immediate issue (correction). Evaluate impact and similar potential occurrences. Investigate causes proportionate to risk. Define corrective action to eliminate causes and prevent recurrence. Implement, verify effectiveness, and update documented information if needed.
For certification audits, follow the CB's submission format and deadlines precisely.
Need help applying this?
Use the guide, then discuss your requirements when ready — without sales pressure.
Need help applying this?Healthy nonconformity culture
Organizations that hide issues learn slowly and fail audits later. Organizations that record nonconformities, analyze them, and improve build resilient systems. Leadership tone determines which culture wins.
Internal audits should surface nonconformities early so external audits are not the first detection mechanism.
Nonconformity vs observation vs OFI
A nonconformity asserts a requirement was not fulfilled. An observation or opportunity for improvement (OFI) may highlight risk or better practice without asserting non-fulfillment. Treat OFIs seriously when useful, but do not invent fake nonconformities from them — or ignore real nonconformities by relabeling them.
Consultancy vs certification
Beyond Carbon provides ISO consultancy, implementation support, documentation assistance, and audit preparation support. Independent certification bodies issue certificates after successful certification audits. Beyond Carbon does not present itself as a certification body or accreditation body.
FAQs
No. Auditors may raise opportunities for improvement or notes. Nonconformities specifically assert unmet requirements with evidence.
Your certification body's procedures define classification rules. Ask for clarification during the closing meeting if needed.
You may discuss evidence and interpretation professionally. Ultimately the audit team documents findings under CB rules; unresolved disputes follow the CB's appeal process.
Not automatically. Many certificates are issued after nonconformities are closed within required timeframes. Severity and responsiveness matter.
Correction fixes the immediate instance. Corrective action addresses causes to prevent recurrence. Both are usually needed for meaningful closure.
Yes when requirements are not fulfilled. Internal honesty reduces external surprise.
Yes — we provide corrective action support and coaching. The organization remains responsible for evidence, and the CB remains responsible for accepting closure for certification purposes.
A complaint indicates dissatisfaction; it becomes a nonconformity when a requirement was not met or when the system's complaint-handling requirements were not followed. Analyze each case.
What happens after you submit?
We do not promise minute-level response times unless operationally guaranteed.
- We received your request
- Your requirements are reviewed
- A consultant contacts you
- Scope is clarified
- Next steps are recommended
Ready to strengthen your management system?
Tell us about your organization, scope, and requirements. We’ll help clarify the appropriate next step.