The Cyber Academy take
A non-conformity is the auditor finding that a requirement is not met. Major NCs threaten the certificate; minor NCs require a corrective action plan with a deadline. Repeated minor NCs in the same area can escalate to major at the next surveillance audit. The goal is not zero NCs, it is honest, traceable corrective action.
What a non-conformity actually is
A non-conformity records a gap between what a requirement asks for and what an auditor can see in practice. The requirement can come from the standard itself (for example a clause of ISO/IEC 27001), from a control you declared applicable in your Statement of Applicability, or from your own documented policy. If you wrote it down and committed to it, an auditor can hold you to it. That last point catches teams out: over-promising in a policy creates non-conformities that the standard alone never would have.
A non-conformity is not the same as an observation or an opportunity for improvement. An observation flags something the auditor wants on the record without claiming a requirement is breached. A non-conformity is a definite statement that a requirement is not met, backed by objective evidence such as a record, an interview, or a missing artefact. The distinction matters because only non-conformities force a formal response.
Major versus minor, and how minors escalate
Auditors grade findings by impact on the management system, not by how annoyed they are. A major non-conformity means a requirement is fundamentally absent, or a failure is widespread enough to undermine confidence that the system works. Majors put the certificate decision at risk and usually have to be closed before certification or recertification can proceed. A minor non-conformity is an isolated lapse in an otherwise functioning process: a single missing review, one record that was not signed.
The trap is treating minors as harmless. The same minor finding in the same area, audit after audit, tells the auditor your corrective action never fixed the root cause. At the next surveillance audit that pattern can be reclassified as a major, because a control that keeps failing the same way is not actually operating.
| Aspect | Minor NC | Major NC |
|---|---|---|
| Scope | Isolated, contained lapse | Systemic or total absence of a requirement |
| Effect on certificate | Certificate normally proceeds | Can block or suspend certification |
| Response required | Corrective action plan with a deadline | Often correction plus on-site or evidence re-verification |
| If repeated | Can escalate to major next time | Already at the top of the scale |
What practitioners actually do with one
Closing a non-conformity well is a process, not an apology. The recognised pattern is correction, then corrective action, then verification of effectiveness. Correction is the immediate fix to the specific instance the auditor found. Corrective action is the deeper move: a root-cause analysis that explains why the gap existed and a change that stops it recurring. Verification confirms, with evidence and after enough time has passed, that the change actually held.
Each of these belongs in a corrective action plan with an owner and a realistic deadline that the auditor agrees to. The evidence you submit should let someone who was not in the room reconstruct what happened and confirm it is closed. This is where honesty pays: an auditor would rather see a small number of well-traced corrective actions than a clean-looking report that does not survive scrutiny.
Frequently asked questions
01What is the difference between a non-conformity and an observation?
An observation notes something worth recording without asserting that a requirement is breached. A non-conformity is a definite finding, backed by objective evidence, that a requirement is not met and therefore demands a formal corrective action.
02Will a minor non-conformity stop us getting certified?
Usually not on its own. Certification typically proceeds once you submit an accepted corrective action plan with a deadline. A major non-conformity is the one that can block or suspend the certificate.
03Can a minor non-conformity become a major one?
Yes. The same minor finding recurring in the same area across audits signals that your corrective action never reached the root cause, so the auditor can reclassify it as a major at the next surveillance audit.
04What does it take to close a non-conformity?
Correction of the specific instance, a corrective action that addresses the root cause so it does not recur, and verification with evidence that the fix actually held. All three go into a corrective action plan with an owner and a deadline.
05Should we aim for zero non-conformities?
No. A small number of honestly identified findings, each with a traceable corrective action, is a healthier signal than a spotless report. Zero findings often means the system is not being genuinely tested.