--- title: "Major vs Minor Nonconformity (ISO 27001) Explained" description: "Major vs minor nonconformity in an ISO 27001 audit: what each means, closure timescales, examples, and the four-part corrective response auditors accept." canonical: https://www.isosecurity.co.uk/resources/major-vs-minor-nonconformity updated: 2026-11-10 --- # Major vs minor nonconformity: what the grading really means A major nonconformity says a required part of your management system is missing or has broken down, and it must be closed before certification. A minor says a working system lapsed once, and it follows you to the next audit with an agreed plan; the grade matters less than the quality of your response. ## What is the difference between a major and a minor nonconformity? | | Major | Minor | | ----------------------- | -------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | | Meaning | Absence or systemic breakdown of a required element | Single lapse within a system that otherwise works | | Effect on certification | Blocks it until corrected and verified | Certificate can be issued with an accepted plan | | Closure | Root cause, action and verification, commonly 30–90 days | Plan agreed now; evidence checked at next surveillance | | Examples | No internal audit performed; SoA exclusions unjustified; risk methodology absent | One access review missed; one policy past its review date; one supplier file incomplete | Observations sit below both: no requirement breached, but a weakness worth fixing. Treat them seriously anyway, because at the next visit the auditor will look, and an ignored observation is how minors are born. ## How do you respond to a nonconformity? 1. **Correct the instance.** Do the missed review, update the document, complete the record. 2. **Find the root cause.** Why did it happen: no owner, no diary trigger, a process nobody understood? Keep asking why until the answer points to a system weakness. 3. **Check for siblings.** Does the same cause affect other controls, sites or suppliers? Look, and record that you looked. 4. **Fix the cause and verify.** Change the process, assign the owner, set the trigger, then check later, with evidence, that it worked. Clause 10.2 requires exactly this shape of response wherever a nonconformity arises: from audits, incidents, monitoring or complaints. It applies to your [internal audit](/resources/iso-27001-internal-audit) findings in exactly the same way as to external ones. ## Where do findings come from at each audit stage? At [Stage 1](/resources/iso-27001-stage-1-stage-2-audit), problems usually surface as areas of concern to resolve before Stage 2 rather than graded findings. At Stage 2 and at [surveillance](/resources/iso-27001-surveillance-audit), grading applies in full. At surveillance the common majors are unglamorous: no internal audit since certification, no management review, corrective actions from last year still open. All three are prevented by the rhythm in my [maintenance guide](/resources/how-to-maintain-iso-27001-certification). ## What should you do if you have just received a major nonconformity? Understand the finding before you dispute the grade, and resist rushing a cosmetic fix into the response window. Agree the timescale with the certification body and put a named owner on the root-cause work. Submit evidence that shows the system now operating, because records over time beat a single heroic document. If the finding exposes something structural (the ISMS has no owner, the risk process never ran), say so and fix that: auditors respond well to honesty backed by action. ## Frequently asked questions about major and minor nonconformities ### What is the difference between a major and minor nonconformity in ISO 27001? A major nonconformity means a required element of the management system is absent or has broken down systemically (no risk methodology, an unjustified Statement of Applicability, no internal audit), and it blocks certification until corrected and verified. A minor is a single lapse inside a system that otherwise works, such as one missed access review; certification can proceed with an agreed corrective plan, checked at the next surveillance audit. ### Can you be certified with minor nonconformities? Yes, and most organisations are: the certification body reviews and accepts your corrective action plan before the certificate is issued, and verifies closure at the next surveillance visit. What matters is the quality of the plan (root cause, action, owner and date), and auditors read that quality quickly. ### How long do you get to close a major nonconformity? The certification body sets the timescale, commonly 30 to 90 days, and must verify your corrective action (sometimes from evidence, sometimes with a short follow-up visit) before a certification decision. At surveillance, an unclosed major can lead to suspension of the certificate, which is why it should be treated as the priority it is. ### How should we respond to a nonconformity? In four parts: contain and correct the immediate instance; find the root cause (why it happened, and the system weakness behind it); check whether the same cause exists elsewhere; implement action that removes the cause, then verify it worked. 'We have now done the missed review' answers only the first part, and it is the response auditors reject most often. ## Contact Findings to close, and a deadline on them? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.