The grade of a non-conformity determines what happens next. Minor findings need credible corrective action; major findings can block issue or threaten an existing certificate.
- A minor is usually isolated; a major points to missing or collapsed system control.
- Correction fixes the case, while corrective action fixes the cause.
- Closure evidence must prove effectiveness, not just activity.
The first question every management team asks is "how bad is it?" The answer hinges on one classification: major or minor.
This guide explains what the grades actually mean, what each does to your certification, and how to close findings in a way that satisfies the certification body first time.
What a non-conformity actually is
A non-conformity (NC) is the non-fulfilment of a requirement: a requirement of the standard, of your own documented system, or of applicable legal/customer requirements within your scope. Three elements make a finding legitimate, and a competent auditor will give you all three in writing:
- The requirement (with clause reference);
- The objective evidence observed;
- The statement of non-conformity connecting the two.
If any of the three is missing or wrong, you are entitled to challenge the finding, professionally, at the audit, before it is finalised. What you cannot usefully argue with is evidence: if the record does not exist, it does not exist.
Minor non-conformity
A minor NC is a failure that is isolated or sporadic and does not indicate the collapse of a system element, and does not, by itself, put conformity of your product or service at risk.
Typical examples:
- One instrument out of a controlled calibration system found overdue;
- A training record missing for one employee where the competence process otherwise works;
- One document at the point of use at the wrong revision, where document control otherwise functions;
- A corrective action closed without recording the effectiveness check, in an otherwise operating CAPA process.
Effect on certification: minors do not block certification or continued certification. You must submit, within the certification body's stated deadline, the correction, root cause analysis and corrective action plan (many CBs also want implementation evidence for the plan). Verification of effectiveness typically happens at the next surveillance audit.
The hidden danger of minors is repetition: the same minor recurring at the next audit tells the auditor your corrective action failed, and a repeated or unaddressed minor can legitimately be escalated to a major.
Major non-conformity
A major NC is a failure that raises significant doubt about the capability of the management system, a required process or clause that is absent or has broken down entirely, a breach likely to result in nonconforming product/service reaching the customer, or a systematic pattern of related minors indicating an element is not under control.
Typical examples:
- No internal audits conducted at all during the cycle;
- No management review performed;
- CCP monitoring records absent for a production period in a food safety system;
- Legal requirement knowingly breached (e.g. operating without a required licence);
- Widespread failure of calibration across measuring equipment used for product acceptance;
- Falsified records, which is also an integrity issue and treated more severely than an ordinary NC.
Effect on certification:
- At initial certification: the certificate cannot be issued until the major is closed and closure is verified by the certification body, through submitted evidence or, frequently, a follow-up audit. Certification bodies set a time limit for this; blow the deadline and stage 2 may need to be repeated in part or full.
- At surveillance or recertification: a major puts existing certification at risk. Fail to close it within the allowed period and the certificate faces suspension, and ultimately withdrawal.
Correction vs corrective action: the distinction that decides acceptance
Most rejected NC responses fail on the same confusion:
- Correction fixes the instance: calibrate the overdue gauge, complete the missing record, retrain the individual.
- Corrective action fixes the cause so it does not recur: why did the recall system miss the gauge? Why did the process allow the record to be skipped?
A response containing only correction ("we fixed it") will be rejected by any competent reviewer. The standards, and clause 10.2 of ISO 9001 specifically, require you to evaluate the cause and act on it.
Closing an NC properly: a five-step method
1. Contain and correct. Deal with the immediate issue and its consequences. If the failure may have affected product already shipped or certificates already relied on, evaluate the extent: auditors expect you to ask "where else?" (Was only this gauge overdue, or did the same lapse affect others?)
2. Find the root cause, honestly. Use a structured method (5 Whys, fishbone) but avoid the two classic dead ends:
- "Human error" is not a root cause; it is where analysis gave up. Why was the error possible, undetected, or likely?
- "Lack of awareness" answered with "we conducted awareness training" is the weakest acceptable pattern and reviewers know it. If training is your whole answer, expect scrutiny.
3. Define corrective action proportionate to the cause. Change the process, the control, the checklist, the responsibility, the system setting: whatever removes or reduces the cause. Assign an owner and a date.
4. Implement and evidence. Certification bodies accept plans for minors, but evidence closes findings: the revised procedure, the new alert configured, records from the changed process in operation.
5. Verify effectiveness, separately and later. After the action has been operating, check whether the problem has actually stopped recurring, and record that check. This is the step organisations most often skip, and its absence is itself a common audit finding.
Deadlines: don't lose the certificate over admin
Every certification body defines response and closure timeframes in its certification rules, commonly in the range of days for the response and up to around 90 days for closure of majors, but the binding numbers are the ones in your CB's communication and rules, so read them. Late responses are treated as failures in their own right: a manageable technical finding becomes a suspension because nobody owned the reply. Assign an owner to every NC on the day of the closing meeting, with internal deadlines ahead of the CB's.
Observations and OFIs: the findings that aren't
Auditors also record observations or opportunities for improvement: matters not (yet) non-conformities. No formal response is required, but treat them as early warnings. This year's OFI at the edge of a requirement is frequently next year's minor.
The mindset shift
Companies with mature systems don't fear NCs; they mine them. A well-evidenced finding is a precise diagnosis of a weak point, delivered by an experienced outsider who has seen a hundred systems like yours. Close it properly (cause, action, effectiveness) and the system is genuinely stronger. Close it cosmetically and you will meet the same finding again, wearing a bigger classification.
QSI Cert is a SAAC-accredited, SFDA-approved certification body based in Riyadh and Al Khobar.
Common questions from this guide.
A non-conformity (NC) is the non-fulfilment of a requirement: a requirement of the standard, of your own documented system, or of applicable legal/customer requirements within your scope. Three elements make a finding legitimate, and a competent auditor will give you all three in writing: The requirement (with clause reference); The objective evidence observed; The statement of non-conformity connecting the two. If any of the three is missing or wrong, you are entitled to challenge the finding, professionally, at the audit, before it is finalised. What you cannot usefully argue with is evidence: if the record does not exist, it does not exist.