A nonconformity is the non-fulfilment of a requirement — from the standard, from your own documented system, or from a statutory or regulatory obligation you have committed to.
Three things trip people up.
It is not the same as a defect. A defect is a product that fails to meet requirements. A nonconformity is a system failing to meet requirements. You can produce perfectly good product through a nonconforming process, and auditors regularly find exactly that.
Your own procedures count. If your documented procedure says supplier re-evaluation happens annually and it has not happened for two years, that is a nonconformity even though the standard never mentions “annually”. Writing a demanding procedure and then not following it is one of the most common ways organisations create findings for themselves.
It has to be evidenced. An auditor cannot raise a nonconformity on a feeling. Every finding must cite objective evidence and the specific requirement it breaches.
Major and minor
A major nonconformity is a total breakdown of a requirement, or a failure serious enough to put the integrity of the product or the management system in doubt. It usually blocks certification until it is closed.
A minor nonconformity is an isolated lapse in an otherwise functioning system. Certification can normally proceed with an agreed corrective action plan.
The distinction is a judgement call by the auditor, and reasonable auditors sometimes disagree. If you believe a finding has been graded too harshly, you are entitled to say so and to have the reasoning explained.