---
title: "A Nonconformity Isn't a Failure: How to Handle ISO Audit Findings Well"
description: What an ISO nonconformity really is, how certification bodies grade majors and minors, and the six-step response in Clause 10.2 of ISO 27001, 27701 and 42001.
---

[Insights | Cybercontrols](https://www.cybercontrols.io/blog)

# [A Nonconformity Isn't a Failure: How to Handle ISO Audit Findings Well](https://www.cybercontrols.io/blog/a-nonconformity-isnt-a-failure-how-to-handle-iso-audit-findings-well)

 Written by [Marius van Aswegen](https://www.cybercontrols.io/blog/author/marius-van-aswegen) | Oct 16, 2026, 7:54:57 AM

**In short:** Tony the Auditor's quote this week is "A nonconformity isn't a failure. It's free advice with a deadline." He is right. A finding tells you exactly where your management system and the day job have drifted apart, and it comes with a date by which to close the gap. ISO 27001, ISO 27701 and ISO 42001 all set out the same six-step response in Clause 10.2. The organisations that improve fastest treat findings as information, fix the cause rather than the symptom, and keep the evidence. This post explains what a nonconformity actually is, how certification bodies grade them, and how to handle one well.

## What a nonconformity is, and what it is not

A nonconformity is simply the non-fulfilment of a requirement. The requirement might come from the standard itself, from your own policies and procedures, from a contract or from the law. If your access control policy says leavers are removed within 24 hours and the auditor finds three accounts still active a month after people left, that is a nonconformity. Not because anything bad happened, but because the system said one thing and the evidence showed another.

That is worth sitting with for a moment. A nonconformity is a statement about the gap between plan and practice. It is not a verdict on your people, and it is not a sign that certification is at risk. Every management system we have ever audited, including our own, has produced findings. A clean audit with nothing to report usually means the auditor did not look hard enough.

Auditors also raise opportunities for improvement and observations. These are not nonconformities. They are suggestions and early warnings, and you are free to decide what to do with them. Treat them seriously, but do not confuse them with findings that need a corrective action.

## Major, minor and what the grading means

Certification bodies grade nonconformities in two levels, following the rules that govern accredited certification.

A **major nonconformity** is the absence or total breakdown of a requirement, or a situation that raises significant doubt about whether the system can achieve what it is meant to achieve. No risk assessment at all, an internal audit programme that has never run, or a pattern of minors that together show a process is not working are typical examples. A major has to be closed before a certificate can be issued, and at a surveillance audit it is normally given a short window, often around three months, with evidence of correction and corrective action reviewed before the certificate continues.

A **minor nonconformity** is an isolated lapse that does not undermine the system as a whole. A supplier review missed for one supplier, a policy past its review date, a training record that cannot be found. For a minor, the certification body usually accepts a corrective action plan and verifies it at the next visit.

The grading tells you how urgent the response is. It does not change what a good response looks like.

## The six steps all three standards ask for

Clause 10.2 of ISO 27001, ISO 27701 and ISO 42001 reads almost identically, because all three share the harmonised structure. When a nonconformity occurs, the organisation shall:

1. **React to it.** Take action to control and correct it, and deal with the consequences. This is the correction: remove the leavers' accounts today.
2. **Evaluate the need for action to eliminate the cause,** so that it does not recur or occur elsewhere. That means reviewing the nonconformity, working out why it happened, and asking whether the same thing exists or could happen in other places.
3. **Implement the action needed.** This is the corrective action: fix the leaver process so the gap cannot open again.
4. **Review the effectiveness** of that action after it has had time to work.
5. **Make changes to the management system** if the finding shows the system itself needs to change.
6. **Retain documented information** on the nature of the nonconformity, the actions taken and the results.

Most organisations do step one well and step six badly, and skip steps two and four altogether. That is why the same finding comes back a year later with a different account name attached.

## Correction is not corrective action

The distinction matters more than any other part of this process. A correction fixes the instance. A corrective action removes the cause. Deleting the three dormant accounts is a correction. Changing the leaver process so HR's exit notification automatically opens a ticket for IT, with a weekly reconciliation against the HR system, is a corrective action.

When we see a finding closed with only a correction, we know we will see it again. When we see a thoughtful corrective action, we usually see a system that is maturing.

## Finding the real cause

Root cause analysis does not need to be elaborate. Asking "why" several times, honestly, usually gets there. The trap is stopping too early at an answer that sounds like a cause but is really a restatement of the problem.

"Human error" and "lack of awareness" are the two we see most often, and they are almost never the real cause. If a person forgot, ask why the process depended on one person remembering. If people were not aware, ask why the process was designed in a way that needed them to be. The useful causes tend to be structural: nobody owned the step, the process was written for how work used to happen rather than how it happens now, there was no trigger to prompt the action, or the tooling made the right thing harder than the wrong thing.

In ISO 42001 this matters doubly, because many AI findings trace back to a process that was designed before the AI system was introduced. The cause is rarely the model. It is usually that nobody updated the procedure around it.

## Keep the evidence

Clause 10.2 asks for records of the nonconformity, the actions and the results. A simple corrective action log does the job: the finding, its source, the correction, the cause analysis, the corrective action, the owner, the date, and a later entry recording whether it worked. That log is also one of the first things an auditor asks for at the next visit, because it shows whether the organisation learns.

The same log should capture findings from every source, not only certification audits. Internal audits, incidents, customer complaints, supplier reviews, management review actions and near misses all produce nonconformities. A system that only records what the external auditor found is only half listening.

## What this looks like when it works

We practise what we implement, and we have had our share of findings in our own [ISO 27001](https://www.cybercontrols.io/it-compliance/iso-27001-certification) and [ISO 42001](https://www.cybercontrols.io/it-compliance/iso-42001-certification) systems. The ones that improved us most were the ones where the cause turned out to be a process we had quietly outgrown. The correction took an afternoon. The corrective action changed how we work.

That is the sense in which a nonconformity is free advice. Someone independent has looked at your system, found the exact place where it is not holding, and told you. You did not have to wait for an incident to learn the same lesson at a much higher price. The deadline is there to make sure you act on it.

## Five checks for this week

1. **Open your corrective action log.** If you do not have one, that is your first corrective action.
2. **Pick your last three findings.** For each, can you point to the correction, the cause and the corrective action as separate things?
3. **Look for "human error".** Wherever it appears as a root cause, ask why once more.
4. **Check for effectiveness reviews.** Has anyone gone back, after a few months, to confirm the action worked?
5. **Widen the sources.** Are incidents, complaints and internal audit findings landing in the same log as certification findings?

## Frequently asked questions

### Will a nonconformity stop us getting certified?

A minor nonconformity will not. A major nonconformity has to be closed, with evidence, before the certificate is issued. In practice, most organisations close majors within the window the certification body gives them.

### How many nonconformities are normal at a first audit?

There is no fixed number, and the count matters less than the pattern. A handful of minors across different clauses is common and healthy. Several minors in the same area usually signal a process problem, and some certification bodies will raise that as a major.

### Is an observation or opportunity for improvement something we have to act on?

No. They are advice rather than findings. A sensible approach is to record them, decide what to do, and note the decision, so the auditor can see they were considered.

### Can we raise our own nonconformities?

Yes, and you should. Findings from your internal audits, incidents and reviews belong in the same corrective action process. An organisation that only ever records what the external auditor found is not using the system to improve.

If you would like an independent look at your system before the certification body does, our [internal audit service](https://www.cybercontrols.io/it-compliance/iso-27001-internal-audit) covers ISO 27001, ISO 27701, ISO 42001 and ISO 9001, led by senior lead auditors who also audit for certification bodies. Cybercontrols holds ISO 27001 and ISO 42001 certification ourselves. [Book a free scoping call](https://www.cybercontrols.io/contact) or email hello@cybercontrols.io. And if you would like a new piece of audit advice every Friday, [meet Tony](https://www.cybercontrols.io/tony-the-auditor).

[View full post](https://www.cybercontrols.io/blog/a-nonconformity-isnt-a-failure-how-to-handle-iso-audit-findings-well)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Marius van Aswegen"
  },
  "dateModified" : "2026-10-16T07:54:57.830Z",
  "datePublished" : "2026-10-16T07:54:57Z",
  "headline" : "A Nonconformity Isn't a Failure: How to Handle ISO Audit Findings Well",
  "image" : {
    "@type" : "ImageObject",
    "height" : 800,
    "url" : "https://144611087.fs1.hubspotusercontent-eu1.net/hubfs/144611087/Cybercontrols%20blog%20-%20Nonconformity%20-%20header%201600x800.png",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://www.cybercontrols.io/blog/a-nonconformity-isnt-a-failure-how-to-handle-iso-audit-findings-well",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Insights"
  }
}
```