What is the difference between a major and a minor nonconformity?
| Major | Minor | |
|---|---|---|
| Meaning | Absence or systemic breakdown of a required element | Single lapse within a system that otherwise works |
| Effect on certification | Blocks it until corrected and verified | Certificate can be issued with an accepted plan |
| Closure | Root cause, action and verification, commonly 30–90 days | Plan agreed now; evidence checked at next surveillance |
| Examples | No internal audit performed; SoA exclusions unjustified; risk methodology absent | One access review missed; one policy past its review date; one supplier file incomplete |
Observations sit below both: no requirement breached, but a weakness worth fixing. Treat them seriously anyway, because at the next visit the auditor will look, and an ignored observation is how minors are born.
How do you respond to a nonconformity?
- Correct the instance. Do the missed review, update the document, complete the record.
- Find the root cause. Why did it happen: no owner, no diary trigger, a process nobody understood? Keep asking why until the answer points to a system weakness.
- Check for siblings. Does the same cause affect other controls, sites or suppliers? Look, and record that you looked.
- Fix the cause and verify. Change the process, assign the owner, set the trigger, then check later, with evidence, that it worked.
Clause 10.2 requires exactly this shape of response wherever a nonconformity arises: from audits, incidents, monitoring or complaints. It applies to your internal audit findings in exactly the same way as to external ones.
Where do findings come from at each audit stage?
At Stage 1, problems usually surface as areas of concern to resolve before Stage 2 rather than graded findings. At Stage 2 and at surveillance, grading applies in full.
At surveillance the common majors are unglamorous: no internal audit since certification, no management review, corrective actions from last year still open. All three are prevented by the rhythm in my maintenance guide.
What should you do if you have just received a major nonconformity?
Understand the finding before you dispute the grade, and resist rushing a cosmetic fix into the response window. Agree the timescale with the certification body and put a named owner on the root-cause work.
Submit evidence that shows the system now operating, because records over time beat a single heroic document. If the finding exposes something structural (the ISMS has no owner, the risk process never ran), say so and fix that: auditors respond well to honesty backed by action.